The recent discovery of a potentially serious Secure Socket Layer (SSL) flaw affecting a popular Linux distribution should act as a wake up call to the open source community, experts warn.
John Pescatore, vice president and distinguished analyst at Gartner, called for open source developers and their vendor counterparts to improve communications processes to address the flaw that could lead to the exposure of encrypted data.
The Sans Institute issued a 'yellow alert' on 16 May over the SSL vulnerability in some Debian distros.
The vulnerability affects encryption key pairs used by the Debian OpenSSL package and could enable hackers to access encrypted transaction data, passwords, financial information and other sensitive data.
A Debian advisory offers recommendations for patching the software.
"This vulnerability, which was apparently introduced by Debian's developers, not open source OpenSSL developers, highlights one of the risks of using software products that incorporate open source modules," said Pescatore.
"In May 2006, the Debian developers chose to make changes to the OpenSSL package used in Debian to fix what appeared to be a memory leak, rather than wait for the OpenSSL developer community to investigate and address the issue."
Pescatore claimed that the Debian "fix" resulted in a serious weakness in the OpenSSL random number generator that made it easy for attackers to discover encryption keys.
"In general, encryption code should not be modified without a very thorough process designed to determine the impact of the modifications on the proper functioning of the code and on Federal Information Processing Standards compliance status," he said.
Pescatore noted that the OpenSSL developers' mailing list shows that Debian developers tried to communicate with the OpenSSL development community, but that the informal communication processes "were clearly inadequate in this instance" .
"We believe this experience confirms our view that open source process communications require significant improvements," he said.
"In many other cases, product vendors have made changes to open source packages without even attempting to contact the 'upstream' developers.
"This approach significantly increases the risk that new vulnerabilities will be introduced into open source code and the likelihood that upstream fixes for other vulnerabilities will cause later problems with the vendor-modified modules.
"Commercial and open source vendors frequently incorporate third-party open source modules in their code, so enterprises need to be aware of the potential issues that can result."
Debian and Ubuntu affected by 'insecure randomness' flaw 21 May 2008
IDC reports global sales revenues up 3.5 per cent 28 May 2008
Debut scheduled for Computex on 3 June 28 May 2008
But market value remains small, analysts say 22 May 2008Debian and Ubuntu affected by 'insecure randomness' flaw 21 May 2008
Secure Print Advantage uses government-grade encryption 18 Oct 2007
Vulnerability confirmed in Windows 2000, but could also be present in XP 13 Nov 2007
Leopard remains vulnerable to cache poisoning, say researchers 05 Aug 2008
Company poised to join research project designed to optimise carbon capture processes 21 Aug 2008
Call for an investment programme on a scale of the Apollo projects as party pledges to increase pressure on government to toughen up Climate Bill 21 Aug 2008
Businesses using old PCs as thin clients are struggling to achieve expected carbon savings 21 Aug 2008
More news
The impending global water crisis can only be averted if the private sector takes advantage of the water investment opportunities on offer 21 Aug 2008
As the reputational risks associated with greenwash become more apparent every day, Paul Thomas asks why some firms still find themselves overstating their environmental credentials 20 Aug 2008
Emissions trading is widely touted as one of the best mechanisms for tackling climate change, but how do these schemes work and how will your business be affected? Tom Young investigates three of the emissions trading schemes having an impact on UK firms 19 Aug 2008 More in-depth
Post your comment
Send an email to the Business Green editor at feedback@businessgreen.com
