One of the basic theories behind open source and its relative security is the fact that many eyeballs are looking at code to identify potential and real trouble spots. According to application security vendor Fortify Software, many eyeballs alone aren't enough. In fact Fortify argues in a new study that open source software is insecure and is exposing enterprises to risk since secure development processes have not been properly adopted.

Fortify's study looked at 11 open source java projects and ran them through a barrage of tests to identify secure practices. In general Fortify argued that the projects had a variety of security vulnerabilities including Cross Site Scripting and SQL injection flaws and that there was an overall lack of secure development processes in place.

"We think that open source software is an area of under-explored risk that we want to help enterprises better understand it," Jacob West security research group manager at Fortify told InternetNews.com. "We found notable vulnerabilities in all of the eleven open source packages we looked at. Because of the rampant numbers we found we think that open source projects aren't leveraging security tools properly."

West added that across the projects they examined most did not make security experts readily available to their users. He also argued that there was also a lack of secure mechanisms for reporting and dealing with bugs. The eleven projects that Fortify looked at include: Derby (relational database), Geronimo (app server), Hibernate (object relational mapping tool), Hipergate (CRM web application), JBoss Application server, Jonas Application server, OFBiz E-Business solution web application, OpenCMS Content management solution, Resin Application server, Struts Web application framework and the Apache Tomcat app server.

Fortify has a degree of motivated self interest in open source Java security. Since 2006, Fortify has run the Java Open Review (JOR) project which used Fortify's static source code analysis tools to identify bugs. Fortify claims that they've worked with over a hundred open source projects to date to help them improve their code. West claimed that so far JOR has found about 389 confirmed defects and approximately 357 have been fixed as a direct result.

Surprisingly though, four of the projects included in the 11 that Fortify now includes in their new report were actually already part of JOR. Hibernate, Ofbiz, Struts and Tomcat were all part of the JOR prior to the new Fortify study.

Click here for more info