Project checks Java code for security bugs
18022
(InfoWorld) - Fortify SoftwareÂ and the FindBugs project have launched a free service that will scan open-source Java software for bugs in the code. The Java Open Review project (JOR) lets open-source projects run audits of their source code using Fortify's source code analysis software and the University of Maryland's FindBugs tool. With developers focusing on more secure software development practices, the Java community needs more advanced bug-finding tools like JOR, said Barmak Meftah, vice president of product and services, with Fortify. "Everybody understands that the cheapest and easiest point to find and fix security bugs is at the time of implementation," he said. Open-source developers will now get the benefit of Fortify's Source Code Analysis software, which is already used by commercial vendors such as Oracle and Adobe Systems. But the free JOR analysis is not as detailed as one done by Fortify's commercial product. Fortify Source Code Analysis can find more than 120 categories of software security problems, Meftah said. The JOR analysis will detail about 40 categories, covering "the most egregious types of security vulnerabilities and the types that developers tend to understand most readily," he said. The details of the free source code analysis will be made available only to project contributors so that JOR cannot be used as a hacking tool, Meftah added. JOR has been working with a handful of open-source projects over the past six weeks and has discovered hundreds of bugs in applications like Tomcat, Zimbra and Java Pet Store. On Monday, the service will be opened up to any Java open-source projects that want to use it, Meftah said. Sun Microsystems already uses FindBugs for its GlassFish open-source application server software, said Geoff Halliwell, a manager of application server quality engineering with Sun. Though Sun has no immediate plans to audit its application server code with JOR, Halliwell said he would "certainly look at it." "In my business, we're always looking to improve," he said.ADVERTISEMENTNEW IT SERVICES FROM IBM: EASIER TO BUY AND IMPLEMENTDiscover a simpler, more cost-effective way to get the solutions your company needs to grow more flexible and efficient.
38399
Beehive Code Now Available in Apache; XMLBeans Officially Approved as Apache Project
326214
The tool is designed to inform users when their applications need patching.
262079
Some users more equal than others Sun Microsystems in the next few days plans to issue an update that plugs a serious security hole in the most recent version of its Java Runtime Environment, more than a week after providing a fix for the same vulnerability in an earlier version of the program. The lag has prompted a prominent security researcher to lambaste the effectiveness of the company's security team.â¦
534343
Exploit code for two of Tuesday's patches have been posted to mailing lists by researchers.
122246
As mentioned by the Zend Developer Zone, Ed Finkler has posted the latest version of his Inspekt security tool.   Although downloads have been on the Google Code site for a bit, I recently put up a new build of Inspekt. This could probably be described as a late alpha release, with most proposed features implemented.   Also included in this new edition are full API documentation for the application, some documentation on its basic usage and, of course, the source of this latest release.
739601
Sun puts very early versions of the source code on its Web site so Java programmers could better see and participate in its development.
641298
Reports of vulnerabilities found by some peer-to-peer file sharers prompt patch.
740862
TechWeb - A project sponsored by the Department of Homeland Security spotlights defects in popular applications such as Linux and Apache. But there's also good news.
426599
Veracode launched a new version of its binary code analysis service on Monday that focuses specifically on helping software engineers find potential backdoor vulnerabilities in their programs.While some applications security companies scour source code for flaws, such as Fortify, and others specialize in testing programs already running in production, such as Cenzic, Veracode is spinning itself as an alternative by channeling its efforts into looking for vulnerabilities in binary code and offering the capabilities as a fully-hosted service.Officials with the applications security startup -- which was originally spun out of Symantec and launched its initial analysis service in Feb. 2007 -- claim that the company's unique ability to find backdoors could be one of the differentiators that allow Veracode to grow its presence in the applications security sector.With backdoor vulnerabilities in particular, said company officials, the use of binary code analysis is ideal for finding potential flaws that are hard to predict or address in other stages of development."There are a lot of advantages to looking at binaries versus looking at source code, and it turns out that finding backdoors is one of those, and there hasn't been anything on the market that really addresses the problem in general," said Chris Wysopal, CTO at Veracode. "Some static analysis tools may look for static passwords, but if the code is even slightly obfuscated, they can't, and they don't, look for hidden keys or rootkit behavior, so this is truly something new that we're offering."Along with special credentials, which are most often embedded in applications code by developers as a means to get back into the programs, Veracode is also promising to chase down any hidden functionality, or secret sets of commands left inside many software systems by their authors.The service also promises to look for warning signs of malicious code behavior, such as evidence of any rootkits built into a program, and unusual network activity, such as functionality that causes an application to mail out data to a predestined recipient.As more companies outsource elements development of their applications, it will be vital for them to run such scans against their programs to look for the potential weak points, the CTO said.Leaving backdoors in code is one of the oldest tricks on the book for developers looking for easy ways to get back into their programs to either fix them or carry out malicious schemes, Wysopal contends."Sometimes it's just something that is meant to be left in for debugging purposes, other times its code that was meant to be removed but simply slipped through the cracks, either way these are vulnerabilities that need to be addressed," said Wysopal. "Most customers want a third-party review in this day, and we can offer that as a hosted service, so we think there's a lot of potential for how much interest backdoor scans can drive uptake of our services."Veracode targets financial services, commercial software markets Financial services firms in particular are very concerned that outsourced code developers may be leaving backdoors in place to sell to malware code writers or use to break into applications on their own for the purpose of stealing data, said the expert.While some industry watchers have questioned how many firms will be willing to hand over their proprietary code to Veracode for testing, the CTO said that with businesses outsourcing more software development than ever, most large companies are already conditioned to working with third parties on that level -- and willing to give someone a chance to examine their software for security purposes.Commercial software vendors represent another significant opportunity for Veracode, and it has already run scans for three or four of the largest ISVs in the world, Wysopal said. The executive claims that the company is also currently serving four of the world's top ten financial services companies with its vulnerability discovery services.The increasing popularity of open-source software in the business setting is another reason why Veracode's services make sense, he said. However, the problem is even more acute for proprietary programs."When we did our research, we found that if a backdoor was placed in an open-source project, the lifetime was typically weeks, but for commercial products, the backdoors lived for years," said Wysopal. "Maybe you could find these problems if you did manual code reviews, but we know that is becoming harder than ever with shared libraries and outsourcing; we think that by becoming the leading experts in backdoors, we can grow our business even faster."Industry analysts downplayed the notion that binary analysis is the best way to look for backdoors, pointing out that source code scanning specialists like Ounce Labs and Fortify have just as good an opportunity to find the flaws.However, the industry watchers said that Veracode might have an advantage in the process of finding the backdoor bugs compared to so-called "black box" vendors, including Cenzic."I don't think it is as large of an advantage as they might claim, but it does help them differentiate over the black box crowd," said Dr. Chenxi Wang, analyst with Forrester Research. "But with the issue of people being afraid to hand over their code to Veracode, I don't think that's as big of a deal as some have made it out to be either."The analyst said that Veracode is winning interesting deals with banks like Barclay's -- which is using the company's scanning services to test the applications of its business partners that want to link to its own software systems.Binary analysis and the ability to utilize Veracode's hosted model in such a fashion may in fact help the company grow the applications security space in general, she said."Their approach so far has been pretty smart, you can see how the model being used with the banks may drive great interest in applications scanning, it's not that the market is flat but there's a lot of room for growth," Wang said. "We'll have to wait to see if Veracode can draw more customers, and see the size of those deals, but they do have an opportunity to shake things up."
486470
After being blasted by security researchers, Sun is changing the way it updates Java.
543022
Code that exploits a serious, yet-to-be-patched hole in Microsoft's Web browser has been posted on the Net.
617759
After criticism, Sun has patched a critical bug in its Java SE software.
228837
Stefan Esser takes a look back at the first week (or so) of the Month of PHP Bugs he's doing for the month of March:   We are on day 5 of the Month of PHP Bugs, meanwhile details for 11 Vulnerabilities were disclosed, including 2 Bonus vulnerabilities covering local root vulnerabilities in the Zend Platform.   He mentions that, on the whole, the reaction has been positive, with those few out there that have their own thoughts on the bugs (such as one issues causing two bugs or that other bugs aren't viable because they're not included in a released version of PHP).
51437
eEye Digital Security has alerted Microsoft's bug team about a remote code vulnerabilityin Office 2007. Microsoft confirmed that  it's looking into the report.
473908
Security restrictions could be compromised in earlier versions of JDK and JRE 6, says vendor Sun.
763575
Ilia Alshanetsky posts today about the proposed "Month of PHP bugs" that Stefan Esser is proposing:   It would be interesting to see what issues he discovers, hopefully most of them have already been reported to the PHP Security Team, in which case the upcoming 5.2.1 release will provide a resolution path for affected users.   Hopefully, as Ilia states, the bugs will not turn out to be zero-day vulnerabilities and will instead be smaller issues. Either way, a bug-fix patch will probably soon follow.   Either way, I have to look at this as a free security audit of PHP by someone with a clue about security and ultimately, in the long run it will only make PHP better, even if March is going to be rather busy.