The most widely-used open-source software packages are exposing businesses to significant and unnecessary risk, according to Fortify.
In its Open Source Security Study, which examined 11 of the most common Java open source packages, Fortify claimed that open-source software development communities were not working securely and leaving dangerous vulnerabilities unaddressed.
The packages tested included application server, customer relationship manager(CRM), web application and content management system (CMS) projects. Most did not have documentation covering security, an email for users to report vulnerabilities, or easy access to internal experts to discuss security issues. Also, in every project analysed, there were security issues that weren't addressed.
Two vulnerabilities were especially prevalent, with 22,828 examples of cross-site scripting and 15,612 SQL injection vulnerabilities - the latter of which IT PRO has recently covered.
The survey showed that most open source communities did not follow business-level control standards, and that there was a hidden cost for companies using open source as they had to test and patch for unanticipated security bugs.
Howard A. Schmidt, a former cyber security officer to the White House, said that open-source software was valuable, but needed to be a point of concern for chief information officers who depended on it to run their business.
"This is an endemic issue that starts in the open source community," he said of the security problems. "Open-source software faces the same vulnerabilities as commercial or in-house developed software."
He added: "The mechanisms to test and analyse software code need to be done with great rigour in open source communities to influence a secure development process."
Fortify recommended that government and commercial organisations which use open source do so with great caution, and that open source communities needed to raise security awareness as well as adopt commercial security practices from the commercial world.
Fortify said that open source development team Mozilla's recent move to hire independent security consultant Rich Mogul this month was a move that others needed to follow.
