Red Hat heads security initiative

Government-backed

By Gavin Clarke in San Francisco • Get more from this author

Posted in Operating Systems, 8th September 2006 08:12 GMT

Tune into our application security webcast, click here

Red Hat is leading an initiative allowing software companies to brief users of a US government-backed security database on how far vulnerabilities affect their products.

The Linux vendor has asked that companies can now comment on security holes listed by the National Vulnerability Database (NVD), in order to provide deeper analysis and explanation of the impact problems might have on their products.

The NVD houses data on 19,200 vulnerabilities going back eight years, and is sponsored by the Department of Homeland Security's National Cyber Security Division. The database is managed by the National Institute of Standards and Technology.

Red Hat is understood to have approached Novell, Hewlett-Packard, IBM and Mandriva to support its initiative, but only Mandriva has so far taken advantage of the service.

Red Hat is reported to have acted in the wake of a recently reported error in Apache that allowed unauthorised access to memory. Unlike other Linux companies, Red Hat did not release a patch because its Linux distribution was not affected. However, that did not stop customers from contacting Red Hat for advice.

Red Hat said the new NVD service would allow for timely dissemination of security information, so customers could quickly take action if necessary.

Red Hat security response director Mark Cox said in a statement: "We can now provide official statements about vulnerabilities and their potential impact via a widely recognised mechanism, as well as enable the entire software industry to contribute." ®

Understand how application security is evolving