According to researchers at the security software company, the attacks, named cross-build injection, allow a hacker to exploit bugs in open-source software to insert malicious code into applications while they are being developed.
This in turn, could allow a malicious user to compromise the component hosting or domain name system server, and use this to take control of the build machine and other computers on the remote network, experts at Fortify said.
"This new class of vulnerabilities highlights the increasing amount of attention hackers are paying to software development as a means of entry into enterprise systems," said Brian Chess, founder and chief scientist at Fortify.
"Instead of exploiting vulnerabilities in applications that are already deployed, attackers can subvert the development process by inserting holes before the software is complete," he added.
Systems that automatically download external dependencies, such as the build tools Ant, Maven and Ivy, are particularly vulnerable, Fortify claimed.
The security company has updated its secure coding rulepacks in an attempt to tackle the flaws and has released a white paper on the attacks.
Fortify identifies open-source software vulnerabilities
By
Fiona Raisbeck
on
Oct 10, 2007 11:29AM

Hackers using a new class of vulnerabilities are targeting organisations using open-source software to develop custom programs, Fortify Software has warned.
Got a news tip for our journalists? Share it with us anonymously here.
Sponsored Whitepapers
Planning before the breach: You can’t protect what you can’t see
Beyond FTP: Securing and Managing File Transfers
NextGen Security Operations: A Roadmap for the Future

Video: Watch Juniper talk about its Aston Martin partnership
Don’t pay the ransom: A three-step guide to ransomware protection