Many Commercial Software Projects Contain Older, Vulnerable Open-Source Code

More than one-fifth contain older and less secure versions of open-source code, new study finds

Dark Reading Staff, Dark Reading

December 4, 2013

2 Min Read

A study of nearly 3,000 commercial software projects found that some 23 percent of them contain open-source components with security flaws.

White Source Software also found that some 98.7 percent of those vulnerable open-source libraries were not the most up-to-date versions. Rami Sass, CEO of White Source, says that's because there's typically a disconnect between the open-source community and the developers who adopt their code in their software projects.

"Developers don't have a good way to keep track and in touch with the work the open-source community members do and the patches and security issues they track," Sass says. "The chances [are better] that developers hear about [open-source] security vulnerabilities in their projects only if it comes out in the press. Otherwise, they're not going to go out and look."

White Source studied open-source library information from various commercial projects as well as an index of known vulnerabilities to gather the data.

Open-source software increasingly is being scrutinized for vulnerabilities, and security experts have been warning enterprises to ensure they are using the most updated versions of open-source libraries. An estimated 80 to 90 percent of custom software uses open-source libraries.

The FS-ISAC (Financial Services Information Sharing and Analysis Center) last month proposed a series of basic security controls for ensuring the security of third-party software used by financial services firms, including policy management for open-source software libraries and components. The goal is to help financial firms ensure their developers are adopting the most current and secure versions of open-source code.

White Source's Sass says open-source software is typically secure. "Open-source communities are very diligent and go through a lot of trouble fixing and identifying problems. The real issue is the disconnect between that community and its end users," he says. Many organizations who build their apps with open-source code don't keep track of updates or patches, for example, he says.

The most common open-source security flaws found in the study were CVE-2011-2730, a configuration flaw in the Spring Framework; CVE-2012-0213, a resource management error in Apache; CVE-2011-2894, a permissions, privileges, and access control flaw in Spring; CVE-2009-2625, a permissions, privileges, and access control flaw in Apache Xerces2; and CVE-2013-0248, a permissions, privileges, and access control flaw in Apache Commons FileUpload.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

About the Author(s)

Dark Reading Staff

Dark Reading

Dark Reading is a leading cybersecurity media site.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights