Fortify identifies open-source software vulnerabilities

According to researchers at the security software company, the attacks, named cross-build injection, allow a hacker to exploit bugs in open-source software to insert malicious code into applications while they are being developed.

This in turn, could allow a malicious user to compromise the component hosting or domain name system server, and use this to take control of the build machine and other computers on the remote network, experts at Fortify said.

"This new class of vulnerabilities highlights the increasing amount of attention hackers are paying to software development as a means of entry into enterprise systems," said Brian Chess, founder and chief scientist at Fortify.

"Instead of exploiting vulnerabilities in applications that are already deployed, attackers can subvert the development process by inserting holes before the software is complete," he added.

Systems that automatically download external dependencies, such as the build tools Ant, Maven and Ivy, are particularly vulnerable, Fortify claimed.

The security company has updated its secure coding rulepacks in an attempt to tackle the flaws and has released a white paper on the attacks.

Copyright © SC Magazine, US edition

fortifyidentifiesopensourcesecuritysoftwarevulnerabilities