pdfreaders.org

A Screening Test for Disclosed Vulnerabilities in FOSS Components

by Stanislav Dashevskyi, Achim D. Brucker, and Fabio Massacci

Cover for dashevskyi.ea:vulnerability-screening:2018.Free and Open Source Software (FOSS) components are ubiquitous in both proprietary and open source applications. Each time a vulnerability is disclosed in a FOSS component, a software vendor using this an application must decide whether to update the FOSS component, patch the application itself, or just do nothing as the vulnerability is not applicable to the older version of the FOSS component used. This is particularly challenging for enterprise software vendors that consume thousands of FOSS components and offer more than a decade of support and security fixes for their applications. Moreover, customers expect vendors to react quickly on disclosed vulnerabilities-in case of widely discussed vulnerabilities such as Heartbleed, within hours.

To address this challenge, we propose a screening test: a novel, automatic method based on thin slicing, for estimating quickly whether a given vulnerability is present in a consumed FOSS component by looking across its entire repository. We show that our screening test scales to large open source projects (e.g., Apache Tomcat, Spring Framework, Jenkins) that are routinely used by large software vendors, scanning thousands of commits and hundred thousands lines of code in a matter of minutes.

Further, we provide insights on the empirical probability that, on the above mentioned projects, a potentially vulnerable component might not actually be vulnerable after all.

Keywords: Security maintenance; Security vulnerabilities; Free and Open Source Software
Categories: ,
Documents: (full text as PDF file)

QR Code for dashevskyi.ea:vulnerability-screening:2018.Please cite this article as follows:
Stanislav Dashevskyi, Achim D. Brucker, and Fabio Massacci. A Screening Test for Disclosed Vulnerabilities in FOSS Components. In IEEE Trans. Software Eng., 45 (10), pages 945-966, 2019.
Keywords: Security maintenance; Security vulnerabilities; Free and Open Source Software
(full text as PDF file) (BibTeX) (Endnote) (RIS) (Word) (doi:10.1109/TSE.2018.2816033) (Share article on LinkedIn. Share article on CiteULike. )

BibTeX
@Article{ dashevskyi.ea:vulnerability-screening:2018,
abstract = {Free and Open Source Software (FOSS) components are ubiquitous in both proprietary and open source applications. Each time a vulnerability is disclosed in a FOSS component, a software vendor using this an application must decide whether to update the FOSS component, patch the application itself, or just do nothing as the vulnerability is not applicable to the older version of the FOSS component used. This is particularly challenging for enterprise software vendors that consume thousands of FOSS components and offer more than a decade of support and security fixes for their applications. Moreover, customers expect vendors to react quickly on disclosed vulnerabilities---in case of widely discussed vulnerabilities such as Heartbleed, within hours.\\\\To address this challenge, we propose a screening test: a novel, automatic method based on thin slicing, for estimating quickly whether a given vulnerability is present in a consumed FOSS component by looking across its entire repository. We show that our screening test scales to large open source projects (e.g., Apache Tomcat, Spring Framework, Jenkins) that are routinely used by large software vendors, scanning thousands of commits and hundred thousands lines of code in a matter of minutes.\\\\Further, we provide insights on the empirical probability that, on the above mentioned projects, a potentially vulnerable component might not actually be vulnerable after all.},
author = {Stanislav Dashevskyi and Achim D. Brucker and Fabio Massacci},
doi = {10.1109/TSE.2018.2816033},
journal = {{IEEE} Trans. Software Eng.},
keywords = {Security maintenance; Security vulnerabilities; Free and Open Source Software},
language = {USenglish},
month = {oct},
number = {10},
pages = {945--966},
pdf = {https://www.brucker.ch/bibliography/download/2018/dashevskyi.ea-vulnerability-screening-2018.pdf},
title = {A Screening Test for Disclosed Vulnerabilities in {FOSS} Components},
url = {https://www.brucker.ch/bibliography/abstract/dashevskyi.ea-vulnerability-screening-2018},
volume = {45},
year = {2019},
}