Story image

Report: Open source software plagued with vulnerabilities

21 May 18

The adoption of open source software and components has permeated almost every aspect of technology, but the number of vulnerabilities per commercial codebase are increasing at almost the same rate – and even cybersecurity applications are at risk.

The Black Duck by Synopsys 2018 Open Source Security and Risk Analysis (OSSRA) report scanned more than 1100 commercial codebases across industries including automotive, big data, cybersecurity, IoT, mobile apps, financial services, manufacturing, healthcare, and enterprise software.

"Since modern software and infrastructure depend heavily on open source technologies, having a clear view of components in use is a key part of corporate governance," says Black Duck by Synopsys technical evangelist Tim Mackey.

The report found that 96% of the scanned applications contained open source components, with an average of 257 components per codebase.  

While the number of components per codebase has increased 75% over the previous year, more codebanks often contain more open source than proprietary code.  

In addition, 78% of the examined codebases contained at least one open source vulnerability, with an average of 64 vulnerabilities per codebase.

The report says that 54% of the vulnerabilities found are considered high-risk vulnerabilities. Furthermore, 17% contained highly-publicised vulnerabilities like Heartbleed, Poodle, Drown, Freak, and Logjam.

"The report clearly demonstrates that with the growth in open source use, organisations need to ensure they have the tools to detect vulnerabilities in open source components and manage whatever license compliance their use of open source may require,” Mackey continues.

The internet and software infrastructure vertical is the most at-risk: 67% of applications contained high-risk open source vulnerabilities.

The cybersecurity vertical was also heavily affected – 41% of applications have high-risk open source vulnerabilities.

The report also offers insights into the Equifax breach, which was compromised through Apache Struts.

Overall, 33% of the audited codebases that contained Apache Struts also contained the vulnerability that caused the Equifax breach.  On average, identified vulnerabilities in the report’s audit were disclosed almost six years ago.

"When Equifax was breached through the Apache Struts vulnerability, the need for open source security management became front-page news," says Black Duck product marketing manager responsible for the OSSRA report, Evan Klein.

"Yet even though it was disclosed in March 2017, many organisations apparently still have not checked their applications for the Struts vulnerability."

The report also found that 74% of the codebases audited also contained components with license conflicts, the most common of which were GPL license violations.

The percentage of applications with license conflicts within verticals ranged from the retail and ecommerce industry's relative low of 61% to the high of the telecommunications and wireless industry—where 100% of the code scanned had some form of open source license conflict.

What MSPs can learn from Datto’s Channel Ransomware Report
While there have been less high profile attacks making the headlines, the frequency of attacks is, in fact, increasing.
Cisco expands security capabilities of SD­-WAN portfolio
Until now, SD-­WAN solutions have forced IT to choose between application experience or security.
AlgoSec delivers native security management for Azure Firewall
AlgoSec’s new solution will allow a central management capability for Azure Firewall, Microsoft's new cloud-native firewall-as-a-service.
Kiwis losing $24.7mil to scam calls every year
The losses are almost five times higher compared to the same period last year, from reported losses alone.
How to configure your firewall for maximum effectiveness
ManageEngine offers some firewall best practices that can help security admins handle the conundrum of speed vs security.
Exclusive: Why Australian enterprises are prime targets for malware attacks
"Only 14% of Australian organisations are continuously training employees to spot cyber attacks."
Exclusive: Why botnets will swarm IoT devices
“What if these nodes were able to make autonomous decisions with minimal supervision, use their collective intelligence to solve problems?”
"Is this for real?" The reality of fraud against New Zealanders
Is this for real? More often than not these days it can be hard to tell, and it’s okay to be a bit suspicious, especially when it comes to fraud.