“What do I do about the vulnerable open source components installed in my commercial products?”
I have been asked that question many times, and I wish the reply I had to deliver was one with a better message. Unfortunately we often find vulnerable components embedded in commercial products. Vulnerabilities that can lead to the compromise of the system they are installed in. We have seen this in both software products that companies are actively shipping, as well as in software and appliances other clients have purchased and installed. When we request that the vulnerable components be upgraded, the change request very rarely makes it very far up the chain. The reasoning (when one is actually given) is other “feature enhancements” and new functionality for customers and sales are a higher priority.
While performing security audits against organizations this is an issue that comes up frequently. What we have seen is that unless the client represents a significant source of revenue or other opportunities for the company shipping vulnerable products, getting them to change can be a very difficult and time consuming process that may not yield major results in any workable time frame. Baring being a significant revenue source, being a potentially good or bad publicity source could also be a way to get them to be a little more helpful. For instance having a large scale outage caused by an exploit of one of the vulnerably pieces of software they are using. However I do not really recommend waiting to be exploited as a viable option.
I am not suggesting that you do not open a support ticket with the company when you do find an issue; however receiving an unworried/unconcerned response is something you should expect. Having a proof of concept attack against their software that you can show them would be one way to help get their attention, but that can be time consuming and costly.
Instead most organizations are forced to mitigate the issue themselves. While waiting for the software companies to upgrade or fix the issues you have found, you need to mitigate and create controls around all of the known issues. In general this can be accomplished through a six step process.
- Segment your network into different zones based upon function, confidentiality and importance of data, etc.
- Deploy host based and network based firewalls to restrict access to specific ports, sources, and/or destinations. The firewalls should restrict both what connections can be made in an attempt to exploit a vulnerability, as well as to limit what damage or access a compromised computer can create. You do not want a compromised server downloading tools or initiating more attacks if you can help it.
- Deploy and USE an operational Alerting and Monitoring system, configured to detect outages, error conditions, and anomalies, . This includes traffic flows, service and device uptime, and SLA measurements, as well as the gathering of syslog data and appropriate snmp-traps.
- Deploy a network and/or host based IDS to watch for any attempts at exploiting known vulnerabilities or traffic anomalies.
- Deployment of an event correlation system (such as Cisco’s MARS, RSA’s enVision, or Splunk) to help manage the massive amounts of server, firewall, and IDS logs.
- Continually monitor, maintain, and manage your environment. There are no easy “place it and forget it” solutions to security issues.