- Site menu:
- Latest Discussions
- Latest Newswire
- Archives
- Submit Story
- Story HOWTO
- Syndicate
- E-mail Alerts
Fortify Identifies Vulnerabilities in Open Source Software
Fortify Software announced that Fortify’s Security Research Group has identified a new class of security vulnerabilities, known as cross–build injection. These vulnerabilities, which Fortify discovered through its work with the Java Open Review (JOR) project, allow a hacker to insert code into the target program while it is being constructed. |
|
|
Comments (2)
You cant trust anything that is build with compromised compiler. Ken Thompson wrote about this some time ago.
Thompson's compiler case is the extreme, but, yes, this is a similar concept. If I understand what they are saying, and I may not, it is different in a fundamental way. That would be the creation of a trust relationship on tools you download and never verify. it's like the C compiler problem gone mad. In this toolkit-based object-oriented world, we may grab a number of different tools from a number of different providers and never think twice about it. In the old days, chances are we used the compiler we got from the vendor.
Post a comment
A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.
Your message:Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help
Sign up and post (it is free) or Log in and post