The recent discovery of a potentially serious Secure Socket Layer (SSL) flaw affecting a popular Linux distribution should act as a wake up call to the open source community, experts warn.
John Pescatore, vice president and distinguished analyst at Gartner, called for open source developers and their vendor counterparts to improve communications processes to address the flaw that could lead to the exposure of encrypted data.
The Sans Institute issued a 'yellow alert' on 16 May over the SSL vulnerability in some Debian distros.
The vulnerability affects encryption key pairs used by the Debian OpenSSL package and could enable hackers to access encrypted transaction data, passwords, financial information and other sensitive data.
A Debian advisory offers recommendations for patching the software.
"This vulnerability, which was apparently introduced by Debian's developers, not open source OpenSSL developers, highlights one of the risks of using software products that incorporate open source modules," said Pescatore.
"In May 2006, the Debian developers chose to make changes to the OpenSSL package used in Debian to fix what appeared to be a memory leak, rather than wait for the OpenSSL developer community to investigate and address the issue."
Pescatore claimed that the Debian "fix" resulted in a serious weakness in the OpenSSL random number generator that made it easy for attackers to discover encryption keys.
"In general, encryption code should not be modified without a very thorough process designed to determine the impact of the modifications on the proper functioning of the code and on Federal Information Processing Standards compliance status," he said.
Pescatore noted that the OpenSSL developers' mailing list shows that Debian developers tried to communicate with the OpenSSL development community, but that the informal communication processes "were clearly inadequate in this instance" .
"We believe this experience confirms our view that open source process communications require significant improvements," he said.
"In many other cases, product vendors have made changes to open source packages without even attempting to contact the 'upstream' developers.
"This approach significantly increases the risk that new vulnerabilities will be introduced into open source code and the likelihood that upstream fixes for other vulnerabilities will cause later problems with the vendor-modified modules.
"Commercial and open source vendors frequently incorporate third-party open source modules in their code, so enterprises need to be aware of the potential issues that can result."
Debian and Ubuntu affected by 'insecure randomness' flaw 21 May 2008
IDC reports global sales revenues up 3.5 per cent 28 May 2008
Debut scheduled for Computex on 3 June 28 May 2008
But market value remains small, analysts say 22 May 2008
Users still choosing easily compromised passwords 21 Jan 2010
Microsoft warns of new attack dangers 14 Jul 2009
Redmond admits it was notified about the vulnerability in September 22 Jan 2010Flaw lets hackers bypass security systems 17 Mar 2010
Researchers offered up to $1,337 for pointing out flaws 30 Jan 2010
Desert tortoise fears allayed? 19 Mar 2010
Cameron presents pre-election energy policy, promising greater investment certainty for low-carbon projects, green loans for households, and streamlining of planning system 19 Mar 2010
Joint statement from carbon exchange and Hungarian government aims to restore confidence in CER market 19 Mar 2010
More news
From climate change contrarians to the "KitKatastrophe" of Nestle's palm oil policy, we look at the best the green web has to offer this week 19 Mar 2010
"It needs the political enthusiasm that was behind the war on terror after 9/11" 19 Mar 2010
From the government's plans for a marine energy revolution to John Lewis' proposals for an off-grid supermarket 19 Mar 2010 More in-depth
Post your comment
Send an email to the Business Green editor at feedback@businessgreen.com
