December 7, 2007
The Top 5 Most Overlooked Open Source Vulnerabilities for 2007

For year-end 2007, we have compiled the Top 5 Most Overlooked Open Source Vulnerabilities encountered during 2007. We came up with this list after reviewing over 300 million lines of code and spending literally thousands of hours of analysis across a wide range of industries - including technology, financial services and government, among others.

So what do we mean by "Most Overlooked"? Well first, we mean that these are known vulnerabilities with a high-severity, Common Vulnerability and Exposure, (CVE) ranking found within open source projects that appear in code audits we perform. Secondly, and perhaps even more importantly, these vulnerabilities were found throughout 2007 in some of the most frequently used open source projects that customers did not realize they had.

It's sometimes dangerous to publish a list like this because it can so easily be taken out of context. Let me first stress that open source software is NOT any more vulnerable than commercial software - some folks even point to evidence that it's less vulnerable. The majority of open source projects provide a patched version for issues within hours of discovery.

What does put people at risk, however, is if you don't know that you're using open source components at all. When that's the case, as it so often is, then how can you retrieve the updated versions? When you don't have a system in place to to alert you to available patches or security issues, you put yourself at risk for introducing security vulnerabilities into your organization's code base

So here's our Top 5 Most Overlooked Open Source Vulnerabilities for 2007 in alphabetical order:

1. APACHE GERONIMO : CVE-2007-4548

PROJECT DESCRIPTION: A free software application server developed by the Apache Software Foundation

VULNERABILITY DESCRIPTION: The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw FailedLoginException for failed logins, which allows remote attackers to bypass authentication requirements, deploy arbitrary modules, and gain administrative access by sending a blank username and password with the command line deployer in the deployment module.

PATCH INFORMATION: https://issues.apache.org/jira/secure/attachment/12363723/GERONIMO-3404.patch

2. JBOSS APPLICATION SERVER : CVE-2006-5750

PROJECT DESCRIPTION: JBoss Application Server (or JBoss AS) is a free software / open source Java EE-based application server.

VULNERABILITY DESCRIPTION: Directory traversal vulnerability in the DeploymentFileRepository class in JBoss Application Server (jbossas) 3.2.4 through 4.0.5 allows remote authenticated users to read or modify arbitrary files, and possibly execute arbitrary code, via unspecified vectors related to the console manager.

PATCH INFORMATION:http://jira.jboss.com/jira/browse/ASPATCH-126

3. LIBTIFF : CVE-2006-3464

PROJECT DESCRIPTION: (Library for reading and writing Tagged Image File Format) (abbreviated TIFF) files. The set also contains command line tools for processing TIFF's. It is distributed in source code and can be found (on the internet) as binary builds for all kinds of platforms. LibTiff is embedded multiple Linux distributions.

VULNERABILITY INFORMATION:
TIFF library (libtiff) before 3.8.2 allows context-dependent attackers to pass numeric range checks and possibly execute code, and trigger assert errors, via large offset values in a TIFF directory that lead to an integer overflow and other unspecified vectors involving "unchecked arithmetic operations".

PATCH INFORMATION: http://security.debian.org/pool/updates/main/t/tiff/tiff_3.7.2.orig.tar.gz

4. NET-SNMP : CVE-2005-4837

PROJECT DESCRIPTION: Net-SNMP is a suite of software for using and deploying the SNMP protocol (v1, v2c and v3 and the AgentX subagent protocol).

VULNERABILITY INFORMATION: snmp_api.c in snmpd in Net-SNMP 5.2.x before 5.2.2, 5.1.x before 5.1.3, and 5.0.x before 5.0.10.2, when running in master agentx mode, allows remote attackers to cause a denial of service (crash) by causing a particular TCP disconnect, which triggers a free of an incorrect variable, a different vulnerability than CVE-2005-2177.

PATCH INFORMATION: http://downloads.sourceforge.net/net-snmp/net-snmp-5.4.1.zip?modtime=1185535864&big_mirror=1.
This issue has been addressed in the following (and later) versions: 5.1.3, 5.2.2, 5.3

5. ZLIB : CVE-2005-2096

PROJECT DESCRIPTION: Zlib is a software library used for data compression. zlib was written by Jean-loup Gailly and Mark Adler and is an abstraction of the DEFLATE compression algorithm used in their gzip file compression program.

VULNERABILITY INFORMATION: zlib 1.2 and later versions allows remote attackers to cause a denial of service (crash) via a crafted compressed stream with an incomplete code description of a length greater than 1, which leads to a buffer overflow, as demonstrated using a crafted PNG file.

PATCH INFORMATION: Upgrade to version 1.2.3. http://www.zlib.net/zlib-1.2.3.tar.gz

Vulnerabilities do NOT mean that you should avoid using these popular projects. To the contrary, the quick response and patch availability indicates that these are active projects which consider vulnerabilities a serious issue. Take these projects up on their hard work - and make sure you're using the latest stable version.

We're interested in what your versions of the Top Most Overlooked Open Source Vulnerabilities might be!

- Theresa Bui Friday


 
 

Software is among the most valuable of all corporate assets. It is at the heart of competitive differentiation, and is often the primary value of many mergers and acquisitions. However, access to diverse code resources, combined with pressure to deliver product to market rapidly and cost-effectively, has given rise to the blending of homegrown, commercial and open source code. While using multiple resources for code speeds development and boosts innovation, it makes compliance, licensing and asset management more challenging than ever. Whether a company is going through a merger or acquisition, conducting a software compliance audit or implementing corporate governance for compliance and development accountability, transparency into application source code is essential. Yet sorting through all the components of a single application can be time-consuming and error-prone. Compliance and risk mitigation require a comprehensive framework for assessing IP assets and meeting corporate IT policies. Palamida launched in 2003 after the founders learned first-hand what happens when companies don't have full visibility into the code base of their software applications. Their experiences inspired them to create a solution for reliably preventing software asset mismanagement, and for streamlining the process of identifying, tracking and managing the mix of code that comprises today's software applications. Palamida enables organizations to manage the growing complexity of multi-source development environments by answering the question, "What's in your code?" Through detailed analysis of the code base customers gain critical insight into their code inventory a critical component of quality control, risk mitigation and vulnerability assessment. Palamida was founded in 2003, offering market leading solutions and services that allow organizations to safely and confidently leverage the power of open source in internal and external software development. In a world of mixed code, the software supply chain has been broken and enterprises are unable to secure a 360 view of their software assets: what they have, where it came from, its IP implications, its security implications and its ROI within the product lifecycle. To that end, enterprises are seeking tools and services that will assist in three primary areas of software assurance management. Mergers & Acquisitions: Gain quick, accurate insight of code during due diligence to ensure proper valuation, mitigate legal and business risks, and reduce costs of integration. Corporate Governance: Ensure proper compliance to regulatory standards and guarantee development accountability. Software Lifecycle Audit: Track third-party code to protect against potential vulnerability issues or to streamline change audit requirements. The IP Amplifier offers a groundbreaking approach to managing corporate software assets. It consists of two key modules the Compliance Library and the Detector. Drawing on the industry's largest and most comprehensive library of its type, IP Amplifier provides detailed information on over 750,000 commercial and open source projects including license and copyright information. Both the Detector and Compliance Library modules rely on CodeRank and Auto-Inventory technologies. CodeRank combats false-positive identifications with an advanced logic that identifies and prioritizes code matches from terabytes of the most commonly used components on the market. Auto-Inventory automates the process of conducting IP analysis and confirmation, enabling companies to gain results immediately. The IP Authorizer instills consistency and efficiency into the software supply chain. It simplifies the process of approving the use of third-party software via a web-based system that gives globally distributed developers, business managers and attorneys, a common tool for reaching IP decisions. It streamlines the review process by auto-processing new requests that have previously been approved or denied, provides system alerts for managing urgent requests, and provides an instant corporate dashboard of project activity and status. M&A Audits: Get quick, accurate assessments of potential acquisitions and the value of the IP being purchased. Or, prove the value of your IP to enhance term sheet negotiation with potential buyers. Either way, an audit performed by Palamida provides credibility, confirms the value and can accelerate deal close. Enterprise Audits: Ensure that you are complying with internal policies by discovering what you have and where you have it. You can also verify that any remediation has been completed. QuickStart Services: Benefit from best-practice knowledge and audit training that get you up and running with your Palamida products. Whether you're engaging in merger or acquisition activities, looking to meet IT governance requirements or attempting to eliminate risk during software development, Palamida's auditing services help eliminate the guesswork of software audits to deliver fast, accurate results. Our experienced professional services consultants will work closely with your technical, business and legal teams to manage, expedite and optimize your code audit. Assessment: We help acquiring teams build a business case for potential acquisitions and develop early validation of M&A objectives. A Risk Profile Report summarizes the uniqueness of the acquired code, provides an inventory of the third-party code and its licenses, and identifies potential risks. Evaluation: During evaluation, we compare the code base against your IP policies. The Evaluation phase includes a Due Diligence Forensic Report that provides details on the code pedigree and inventories third-party code. Integration: Palamida verifies whether remediation is completed and offers recommendations for redevelopment alternatives, if needed. The Integration audit helps decrease the time and cost associated with the integration plan. Enterprise Audits are an essential part of IP governance and compliance. Knowing what's in your code is critical to enforcing IP policies and avoiding business and legal risks associated with the use of third-party code. Enterprise audits provide visibility into third-party code and licenses, so you can mitigate risk and ensure compliance with corporate licensing policies. Palamida provides a three-step process that involves code scan and detection using our patent-pending code detection software, IP Amplifier. The three steps are as follows Identification: Leveraging a repository of over 750,000 commercial and open source projects, we provide technical and legal information about your code base, giving you an IP Ingredients Report that inventories the third-party code and licenses in your code base. This report allows you to make informed decisions about the third-party code inside by seeing how it fits into your overall IT, legal and purchasing requirements. Assessment: We assess your IP risks and analyze IP violations across your code base. Our compliance report identifies code vulnerabilities and details supporting evidence of code similarities. We also provide recommendations for open source and commercial alternatives for third-party code in question. Accountability: We can help you manage and verify the completion of remediation work. We provide a final Baseline IP Ingredients Report that helps ensure ongoing governance of third-party code and licenses in your software. Palamida software is built to fit easily into existing IT environments with a few simple scripting commands. Our Support team will work with you to ensure a successful implementation and an all around positive experience. 1998 act copyright digital millennium, 2.1 creativecommons.org lgpl license link, 360 ip law, 404 compliance, Academic Free License, acceptable levels of risk, acquisition, acquisition applied finance merger, acquisition applied merger, acquisition bank merger, acquisition benefit merger, acquisition best business practices, acquisition best practice, acquisition best practices, acquisition business case merger strategy, acquisition business impact, acquisition business implementation, acquisition business strategy, acquisition buy, acquisition buying future technology, acquisition case study, acquisition checklist, acquisition code, acquisition consultant, acquisition corporate merger, acquisition corporate merger strategy, acquisition critical due diligence, acquisition due diligence, acquisition due diligence checklist, acquisition intellectual property, acquisition intellectual property rights, acquisition international merger, acquisition IP rights, acquisition lawyer, acquisition m&a merger, acquisition macmillan strategy, acquisition management merger, acquisition merger, acquisition merger lawyer, acquisition merger planning, acquisition merger report, acquisition merger services, acquisition merger strategy, acquisition negotiating strategy, acquisition obstacles, acquisition planning a merger, acquisition pros and cons, acquisition requirements, acquisition software, acquisition software code, acquisition software intellectual property, acquisition software IP, acquisition strategic takeovers, Adaptive Public License, Affero General Public License, Affinity Engines vs Google Orkut, affinity vs google, affinity vs. google, affinity vs orkut, aipla, Aladdin Free Public License, american association intellectual law property, American lawyer, California lawyer, analysis and valuation of software assets, analysis of software assets, analyze software assets, analyzing software assets, anatomy of a merger strategy, apache licence, apache license, apache open source, Apache Software License, apl, app dev open source, app dev oss, Apple public source licence, Apple Public Source License, application content development, application database development, application development audit trail, application development compliance, application development eclipse, application development financial services, application development healthcare, application development improve, application development internal, application development linux, application development management, application development open source, application development os, application development outsourcing, application development productivity, application development streamline, assess inbound IP assets, assessing inbound IP assets, attorney enquiries intellectual law property, attorney enquiry intellectual law property, attorney intellectual property, attorney software intellectual property, Attribution Assurance Licenses, audit and compliance software, audit binary data, audit code base, audit compliance corporate governance, audit internal software, audit it consulting, audit it process, audit it program, audit it report, audit management software, audit program inventory, audit risk, audit sarbanes oxley, audit sarbox, audit software, audit software sox, audit solutions, audit system, auditing code, auditing code base, auditing compliance inventory license management software, auditing data enterprise, audits binary, auto inventory, auto-inventory, auto-inventory libraries, auto-inventory library, automat auditing of code base, automate code audits, automate license management, automate source code analysis, automated code auditing, automated source code analysis, automating licence management, automating license management, bank merger acquisition, base code, basel II, basel II accord, being acquired, Berkeley UNIX lawsuit, best business practice code audit, best business practice intellectual property, best business practice intellectual property compliance, best business practice software audit, best valuation, binary code audit, binary code scan, binary code scanner, binary code scanning, binary code search, black duck, black duck software, black duck software program, black duck software programs, blackducksoftware, blackducksoftware.com, Boost software licence, Boost Software License, Borland, borland gauntlet, borrowed code, bsd licence, bsd license, BSD licenses, BSDi lawsuit, business ip law, business merger and acquisition, CA vs. Quest, Caldera v IBM, Caldera v. IBM, Caldera vs. IBM, California intellectual property law, canada intellectual property law, case infringement patent, catalog commercial software, cataloging commercial software, cataloging commercial software components, checklist due diligence, chicago intellectual property law, cisco acquisition, Cisco Lynksys, Cisco Lynksys, gpl, Cisco source code theft, Cisco Systems vs. Huawei Technologies, Cisco vs Huawei, classified artistic license, CNRI Python License, cobit compliance, Code Analysis/Software Analysis, Code Audit, code audit license, code audit licenses, code auditor, code base audits, code gpl, code inventory, code ip, code rank, code scanning product, code scanning products, code scanning program, code scanning programs, code snippet, code snippets, Code theft, code tracking, code vulnerability, coderank, coderank technology, collab.net, collabnet, commercial due diligence, Common Development and Distribution License, Common Public License, Common Public Licence, community open source, company merger, Compliance, compliance consultant, compliance database, compliance management service, compliance management services, compliance management software, compliance management system, compliance open source, Compliance Report, compliance solution, componentized project architecture, Computer Associates Trusted Open Source License, Computer Associates v. Quest Software, Computer Associates vs Quest Software, computer forensic investigations, computer forensics intellectual property, computer forensics intellectual property theft, computer investigations code, computer investigations intellectual property theft, computer investigations open source, Construx, Copyright infringement, Copyright infringement code, Copyright infringement software, copyright software, corporate acquisition techniques, corporate compliance software, corporate counsel open source software, corporate governance, corporate governance and compliance, Corporate Governance/IT Governance, corporate legal open source, corporate m&a, corporate merger acquisition, corporate strategy for mergers and acquisition, Coverity, Cryptix General License, Cryptix licence, Cryptix License, CUA Office Public License, customer due diligence, CVW License, Cyberkorp, data audit, data security, data vulnerability, Day one report, decrease legal exposure, decreased legal exposure, define due diligence, definition of due diligence, derivative work, derivative work program, derivative work programs, derivative work software, development open source software , development oss, digital copyright protecting intellectual property , digital management right technology, digital millennium, digital millennium copyright act, digital millennium copyright act of 1998, digital millennium notice, digital rights management, Diligence Done, disclose software, distribute open source software, distribution of open source software, distribution of oss, DLA Piper, dmca millennium, Doug Levin, drm, drm license, drm protection software, drm requirements, drm software, due diligence, due diligence audit, due diligence checklist, due diligence checklists, due diligence corporate governance, due diligence investigation, due diligence merger and acquisition, due diligence process, due diligence report, due diligence requirements code, due diligence requirements intellectual property, due diligence requirements IP, due diligence requirements software intellectual property, due diligence services, due diligence software, eclipsecon, eclipse framework, eclipse healthcare initiative, Eclipse Public licence, Eclipse Public License, eclipse subversion, eclipse.org, eclipsehealthcare.org, eCos license, eCos Public License, Educational Community License, Eiffel Forum License, emanuel law intellectual property, encryption audit, encryption open source, end user license agreement, engineering build process, engineering open source, engineering open source software, engineering open source software development, enterprise audit, enterprise audits, enterprise open source, Entessa Public License, EU DataGrid Software License, eula, Eula licence, Eula license, evaluate software assets, evaluating software assets, export audit, export open source software, factors influencing mergers and acquisition, Fair License, Fenwick, Fenwick & West, Fenwick and West, File digest matching, forensic analysis of code, Frameworx License, Free beer licence, Free beer license, free software foundation, free sw foundation, gartner it expo, general public licence, general public license, gnu, gnu gpl, gnu gpl licence, gnu gpl license, gnu gpl license mail module web, gnu lesser general public license, gnu license, Google Code Search, Google Orkut lawsuit, Google OSS search service, goscon, governance, governance in it, government compliance open source software, government open source, GPL, GPL 3.0, gpl 30, gpl code, gpl instalatii, gpl installateur, gpl installation, gpl licence, gpl license, gpl voiture, Gracenote vs Roxio, Gracenote vs. Roxio, Hacktivismo Enhanced-Source Software License Agreement, healthcare open source software, HPL7, hummer winblad, ibm acquisition, ibm lawsuit sco, IBM Public License, ibm vs sco, ibm vs. sco, IChessU vs Jin, IChessU vs. Jin, identify IP risk, identify IP risks, identifying IP risk, identifying IP risks, infringement law, infringement lawsuit, initiative open source, innoopract, integrate into development workflows, Intel Open Source License, intellectual law patent property, intellectual law property, intellectual law property rights, intellectual property asset management, intellectual property cases, Intellectual Property Compliance Management, intellectual property copyright law, intellectual property due diligence, Intellectual property infringement, intellectual property law, intellectual property law Canada, intellectual property lawsuit, intellectual property management, intellectual property management software, intellectual property protection, intellectual property protection for software, intellectual property protection software, intellectual property right law, intellectual property rights, intellectual property software, intellectual property source code lawsuit, intellectual property theft code, intellectual property theft software, intellectual property valuation, Interbase Public License, internal audit report, internal code audit, internal software audit , international intellectual property law, IP amplifier, IP authorizer, IP code management, ip due diligence, ip ingredients, IP ingredients reports, ip law, ip law and business, ip law firm, ip lawsuit, IP management platform, ip management solution, ip management solutions, IP policy, IP report, IP reports, ip rights, IP Source code lawsuit, ip theft code, ip theft software, IP transparency, ip valuation, ipingredients.org, it audit report, it audit software, it compliance, IT governance, Jabber Open Source License, Jahia Community Source License, java open source, java script , java script snippets, Jboss license, Jboss licenses, jboss patent, jboss protect, jeff Luszcz, JLI, jones day, jones day llp, kpmg, krugle, LaTeX Project Public License, law firm intellectual property , law firm intellectual property law, law firm ip law, lawsuit intellectual property, lawsuit ip, lawsuit sco, legal due diligence, legal intellectual property, legal merger acquisition , legal software intellectual property, legal software ip, lesser general public license, Leonard street, Leonard street and leinard, lgpl, Lha license, licence compliance, licence open source, license compliance, license conflicts, License of ksh93, License of Perl, License of Python, License of Qmail, License of Vim, License of xinetd, license open source, licensing, intellectual property, life cycle IP management, lifecycle IP management, link creativecommons.org license lgpl 2.1, linux license, linux licenses, linux open source, linux open source software, linuxworld, Lucent Public License, Lucent Public License (Plan9), m&a due diligence, m&a influencers, macmillan strategy, manage IP code, manage software assets, managing intellectual property, mark toliver, mark tolliver, merant PVCS version manager, merger acquisition buy out, merger acquisition planning, merger and acquisition case study, merger and acquisition checklist, merger and acquisition company, merger and acquisition firm, merger and acquisition report, merger and acquisition services, merger and acquisition strategy, merger and acquisition techniques, merger and acquisitions, merlin international, Micosoft v.Viodentia, Micosoft vs Viodentia, Micosoft vs.Viodentia, microsoft acquisition, microsoft acquisitions, microsoft digital rights management, microsoft mergers and acquisition, Microsoft novell, microsoft partners, Microsoft v. Viodentia: FairUse4WM Lawsuit, MIT Licenses, Mitchell Kertzman, mitigate business and legal risk, mitigate business and legal risks, mitigate business risk, mitigate business risks, mitigate legal exposure, mitigate legal risk, mitigate legal risks, mitigating legal exposure, MITRE Collaborat ive, Virtual Workspace License, Mitsui Venture Partners, mixed code, MontaVista Lineo, Motosoto License, multi-pattern search technology, MySQL NuSphere, MySQL Progress Software, Namespace matching,NASA Open Source Agreement, Naumen Public License,NCSA Open Source License, negotiating mergers and acquisitions, Nethack General Public License, Netizen Open Source License,Netscape Public License, New BSD license, Nokia Open Source License, nokia patent infringement, nokia vs qualcomm, NOSL, novell, novell sco, OCLC Research Public License, Old OpenLDAP License, Old Plan 9 License, Olliance, olliance group, online due diligence, open gl source code, Open Group Test Suite License, Open LDAP license, open program source, Open Software License, open source, open source application, open source cms, open source collaboration , open source collaboration software, open source community, open source content management, open source corporate counsel, open source corporate legal, open source crm, open source database, open source dev elopment, open source document management, open source encryption, open source for the enterprise, open source government, open source healthcare, open source healthcare initiative, open source initiative, o pen source intellectual property management software, open source lawsuit, open source licence, open source licence management, open source license, open source license management, open source patents, open source product, open source programs, open source project, open source project management, open source project management software, open source report, open source search engine, open source security, Open Source Software Adoption, open source software asset management, open source software corporate legal, open source software development,open source software development tool, open source software engineering, open source software for business, open source software project, open source standardization, open source stealing, open source technology alliance, open source voip, open-source audit, operational due diligence, osa, osi licence, osi licenses, osi open source, osrm, oss, oss software, oss solutions, ostg, outsourcing application development, pal mida, pal mido, palameda, palameeda, palamida code audit, palamida code review, Palamida Consulting, palamida IP Amplifier, palamida IP Authorizer, palamida m&a audit service, palamida m&a services, Palamida Professional Services, palamida software, palamida software program, palamida software programs, palamida solution, palamida solutions, palamida.com, palamida's quick start service, palamida's quick start services, palamido, palamina, palemida, palemina, patent infringement, patent infringement attorney, patent infringement cases, patent infringement lawsuit, patent infringement lawyer, patent intellectual property law, patent law and infringement, peer code review, procurement software, product management open source, product management software, proprietary code, proprietary software, protect intellectual property, protect software assets, protect source code, protecting intellectual property, protex IP, protex IP suite, protex IP system, protex/IP, protex/IP development, protexIP, protexIP suite, protexIP system, publicly available software, qualcomm intellectual property, qualcomm vs nokia, qualcomm vs. nokia, quality assurance and compliance, quality assurance management, ray Waldin, Reciprocal Public License, record compliance management, red hat, RedHat SCO, RedHat v SCO, RedHat vs SCO, RedHat vs. SCO, regulatory compliance, regulatory compliance software, reuse open source software, Ricoh Source Code Public License, riseforth, risk and compliance management, risk and mitigation, risk profile, sarbanes oxley audit, sarbanes oxley compliance, sarbanes oxley compliance software, sarbanes oxley sox compliance, sarbox audit, sarbox compliance, scan binary code, scan binary codes, scan non-code resources, scan source code, scan source codes, scanning binary code, scanning binary codes, scanning non-code resources, scanning software, scanning source code, scanning source codes, Scilab license, SCO AutoZone, SCO DaimlerChrysler, sco ibm lawsuit, sco lawsuit,SCO v Autozone, SCO v IBM, SCO vs Autozone, SCO vs DaimlerChrysler, SCO vs Novell, SCO vs. Autozone, SCO vs. DaimlerChrysler, SCO vs. Novell, screening third-party code, screening third-party codes, securing code script, Security, security and quality assurance, security code, security code base, security financial services applications, security of open source software, SGI Free Software License, sitecom netfilter, Sleepycat License, software assurance, software assurance compliance, software auditor, software compliance management, software component, software copyright, software copyright infringement, software copyright law, software copyright protection, software development, software development financial services, software development workflow, software development workflows, software digital right management, software disclosure, software disclosure, software freedom law center, software internal use policy, Software IT Assets, software licence compliance, software licencing, software license compliance, software license compliance management, software license management, software licence management, software licensing, software patent infringement, software procurement , Software Risk Mitigation, software security, Software transparency, source code audit, source code auditing, source code control, source code copyright, Source code fingerprinting, source code licence, source code license, source code licenses, source code scanner, source code scanners, sourceforge, sox 404, spatial v autodesk, spatial v. autodesk, spatial vs autodesk, Spatial vs. Autodesk, SSISSL, SSLeay, Starforce class action lawsuit, starforce lawsuit, stealing open source, stealing source code, strategic IP management platform, subversion, Sun Community Source License, Sun Industry Standards Source License, Sun Public License, Sun Solaris Source Code (Foundation Release) License, suse linux, Sybase Open Watcom Public License, symantec acquisition, system audit, technical due diligence, technique for negotiating corporate acquisition, technology due diligence, The Condor Public License, the end user license agreement eula, The license of Ruby, The Squeak license, Theft of ip, theresa bui Friday, third party intellectual property, third party IP, third-party intellectual property,TOS license, tracking IP code, ubisoft for starforce lawsuit, understanding open source, united states intellectual property law, University of Illinois Open Source License, University of Illinois/NCSA Open Source License, University of Utah Public License,UNIX lawsuit,user code libraries, user code library, USL v BSDi, USL v. BSDi, USL vs BSDi, USL vs. BSDi, vasoftware, valuation of software assets, valuing intellectual property, venture capital due diligence, verify code pedigree, verify code pedigrees, verify external regulatory compliance, verify internal regulatory compliance, verifying code pedigree, verifying code pedigrees, Vovida Software License v. 1.0,Vulnerability Assessment, vulnerability database, vulnerability scan, vulnerability scanning, W3C License, WaldenVC, what's in your code, Windows source code theft, wxWindows Library License,X.Net License,X11 License, X11 Licenses,XFree86 1.1 License, YaST License, Zend License, zLib License, zlib/libpng license, Zogix, Zope Public License.