Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

4/30/2013
11:45 PM
50%
50%

Open Source Software Libraries Get Renewed Scrutiny

The Open Web Application Security Project adds common software components to its list of threats to spur developers to look more deeply at software libraries

As companies increasingly create applications and internal tools on top of open-source building blocks, vulnerabilities in those common components are becoming a serious threat.

Yet, the lion's share of companies continue to ignore the problem, according to a report released this week. While nearly 80 percent of companies rely on open-source components for their development efforts, more than three-quarters lack any meaningful controls over the usage of such libraries and frameworks, according to the annual Open Source Software Development Survey conducted by Sonatype, a manager of a large repository of open-source components. While many companies have started to develop their own applications with security in mind, they have typically treated online components with less rigor, says Wayne Jackson, the firm's CEO.

"We have a very mature component-usage ecosystem," he says. "Companies are getting enormous benefits from the ability to leverage byte-sized innovation ... but the ecosystem to support that consumption, to bring order to all of that, is completely missing."

The Open Web Application Security Project has recognized the threat as well. For the first time since the group began compiling its OWASP Top-10 List of Web security weaknesses, the list has singled out software components with known vulnerabilities as a top threat in its 2013 list of candidates. For example, two vulnerabilities--Apache CXF Authentication Bypass and the Spring Remote Code Execution--affected components that were downloaded 22 million times in 2011, the group noted.

"Virtually every application has these issues because most development teams don’t focus on ensuring their components stay up to date," the OWASP entry reads. "In many cases, the developers don’t even know all the components they are using, never mind their versions."

[Poor communication and significant friction between developers and the software-security team is a key reason that software issues continue to go unaddressed. See Building A Detente Between Developers And Security.]

The problem will only be made worse by the growing popularity of common components and libraries. In 2012, use of components skyrocketed. From Sonatype's repository alone, some 8 billion software components were downloaded during the year, almost doubling the number of components downloaded in 2011, the firm states.

Solving the problem will be hard. Companies should not rely on the open-source project to get it right. While open-source developers like to trust in "many eyes" that peruse the code to catch most vulnerabilities, only a few projects garner enough attention for contributors to catch a good percentage of security flaws, says Chris Wysopal, chief technology officer and co-founder of application-security firm Veracode.

"The many eyes theory only works for the very largest projects," Wysopal says.

Companies should instead treat open-source components and libraries in a similar way to the firm's own code and analyze them for vulnerabilities, Wysopal adds. "If you are doing static or dynamic analysis on the code you are writing, you need to do the same thing to the open-source software that is coming into your environment," he says.

Security teams need to work with the developers to make sure that open-source policies are both enforceable and do not slow down development so much that programmers attempt to go around the policies, Sonatype's Jackson says. In the firm's study, developers listed enforcing policies, slower development and the delayed notification of vulnerabilities as the top-3 issues affecting implementation of open-source policies.

In the end, companies must be prepared to check the components themselves, rather than trust an open-source project's maintainers to find all the bugs, agrees Jacob West, chief technology officer of the Enterprise Security Products group at Hewlett-Packard.

"For the foreseeable future, the onus is on the organization to determine how much risk open-source components produce," West says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
How SolarWinds Busted Up Our Assumptions About Code Signing
Dr. Jethro Beekman, Technical Director,  3/3/2021
News
'ObliqueRAT' Now Hides Behind Images on Compromised Websites
Jai Vijayan, Contributing Writer,  3/2/2021
News
Attackers Turn Struggling Software Projects Into Trojan Horses
Robert Lemos, Contributing Writer,  2/26/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-21331
PUBLISHED: 2021-03-03
The Java client for the Datadog API before version 1.0.0-beta.9 has a local information disclosure of sensitive information downloaded via the API using the API Client. The Datadog API is executed on a unix-like system with multiple users. The API is used to download a file containing sensitive info...
CVE-2021-27940
PUBLISHED: 2021-03-03
resources/public/js/orchestrator.js in openark orchestrator before 3.2.4 allows XSS via the orchestrator-msg parameter.
CVE-2021-21312
PUBLISHED: 2021-03-03
GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is a vulnerability within the document upload function (Home > Management > Documents > Add, or /front/documen...
CVE-2021-21313
PUBLISHED: 2021-03-03
GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is a vulnerability in the /ajax/common.tabs.php endpoint, indeed, at least two parameters _target and id are not proper...
CVE-2021-21314
PUBLISHED: 2021-03-03
GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is an XSS vulnerability involving a logged in user while updating a ticket.