Vulnerability events make OpenDaylight more secure

Vulnerability events make OpenDaylight more secure

The original intention of open-source projects is always good, and there are bright future expectations, but security is never the most important...

The Linux Foundation launched the OpenDaylight Collaboration Project in April 2013 to create an open-source software defined network (SDN) platform. Subsequently, the project received the attention and support of many industry vendors and is now growing rapidly. However, OpenDaylight did not pay much attention to a security vulnerability last year, which caused a lot of concerns.

OpenDaylight

Back in August 2014, the researchers discovered the OpenDaylight security vulnerability and named it "Netdump ". With Netdump, remote attackers can access any files on the OpenDaylight controller system through network configuration services. Files that are vulnerable to attacks include hash Network Authentication Files. Attackers can obtain authentication by using common attack tools to control the entire network.

Although the vulnerability has a major security threat, OpenDaylight did not respond positively to the vulnerability, and even released the Helium version containing the vulnerability after the vulnerability was announced. The vulnerability was not fixed until last December, because the related personnel thought that OpenDaylight was still in the early stage and was not used in the actual environment, so the security response speed was slow.

But David Jorm, a security expert (IIX's product security engineer) and a member of the OpenDaylight community, does not think so, he said: "Because the fact is that a serious vulnerability has been ignored for more than four months, it is clear that we have a problem in some aspects. Once this vulnerability is exploited by attackers, it will bring a devastating blow to the entire SDN."

Jorm also pointed out that suppliers need to learn the latest security information in a timely manner, rather than hand over these vulnerabilities in private, which will seriously affect the release speed of related patches.

Fortunately, since the incident, more and more OpenDaylight members have begun to use actions to support Jorm. The OpenDaylight technical Steering Committee recently approved a detailed security response process guide. "We take security seriously in the ODL community," said the chairman of the technical Steering Committee. "We are working to better establish and publicize our security response process, so that anyone can report the problem and make sure that we can respond immediately."

Now, Jorm has made a high comments on OpenDaylight's security response. We are delighted to see that OpenDaylight attaches more importance to security.

OpenDaylight Helium (Helium) version installation

This article permanently updates the link address: