Open source hardening project expands

Stephen Withers
Wednesday, 28 March 2007 08:49

Business IT - Technology

A government-backed effort to reducing the number of vulnerabilities in open source software such as Samba has expanded its scope from 50 to 150 projects.

Funded by the US Department of Homeland Security, San Franciso-based Coverity continuously and automatically scans over 35 million lines of source code for security related defects such as the use of uninitialised data, array overruns and unsafe use of signed values.

Over 6000 defects have been fixed since June 2006.

Among the newly added projects are zlib (compression software widely used in open source and commercial applications) and FreeRADIUS (a free implementation of RADIUS authentication).

Other projects being scanned include Amanda, emacs, Postfix, Python and tcl. Details of defects found by Coverity are only available to project members.

Commercial users of Coverity's tools include McAfee, NASA, Palm and Symantec.

Stanford University and Symantec share in the $US 1.24 million Department of Homeland Security open source vulnerability research contract.