The open source SDN organization has formed a dedicated team following disclosure of a serious security flaw that remained unaddressed for four months.

Mitch Wagner, Executive Editor, Light Reading

December 19, 2014

3 Min Read
OpenDaylight Establishes Security Team

The OpenDaylight Project Technical Steering Committee has set up an official security response team following disclosure of a serious vulnerability in the open source SDN controller that went unaddressed four months after it was initially disclosed.

The committee also approved Helium-SR1.1 (Service Release 1.1), which incorporates previously released patches for the security problem, according to an email from Colin Dixon, chair of the OpenDaylight Technical Steering Committee, who posted to the group's mailing list.

The organization "established an official security response team charged with developing more formal internal processes for dealing with security," Dixon stated in his email.

The "Netdump" security flaw was discovered in August by Gregory Pickett, part of the managed security services group for Hellfire Security. The vulnerability allows remote attackers to take control of an OpenDaylight SDN network. Pickett says he tried unsuccessfully for months to get the OpenDaylight Project to pay attention. They finally did, and patched it, this week. (See OpenDaylight Patches 'Serious Vulnerability' – After Four Months.)

Despite the delay, Pickett credits the OpenDaylight project for behaving responsibly. "It was just a break-down in communication," he says in an email to Light Reading. "As soon as they became aware of the issue, they [the developers] moved on it. And they are working on a process to make sure that it doesn't happen again. So, yes, I would say very responsible."

Two of the companies who use OpenDaylight code in their software say it's not a problem for their customers.

"Brocade Vyatta Controller customers have been alerted to the vulnerability and an emergency patch is being delivered shortly," stated Brocade Communications Systems Inc. (Nasdaq: BRCD) distinguished engineer Tom Nadeau in an email to Light Reading. (See Brocade Debuts OpenDaylight SDN Controller.)

Want to know more about SDN? Visit Light Reading's SDN Technology content channel.

ConteXtream audits its software and closes security holes "before they are closed in the open source distribution. This is where a carrier-grade vendor comes in," says co-founder Sharon Barkai in an email to Light Reading. Also, ConteXtream federates OpenDaylight, "which means if the customer wants to use more experimentally controlled code for specific entities, it does not jeopardize the entire distributed system." (See ConteXtream Launches OpenDaylight-Based SDN Fabric for NFV.)

Pickett also discovered separate security vulnerabilities in the Big Switch Networks -sponsored Floodlight open source controller. But Floodlight has no security by design, says a Big Switch spokeswoman. The security is added when the open source project gets converted to product.

"Floodlight is not meant to be used outside of a testbed, which is one reason why no security features are implemented. [Big Switch] is very transparent about this, why it is set up this way, and how it's a differentiation around its commercial product," the spokeswoman said. "Floodlight was built to do what it does -- security was always something that users could choose to add on as part of their configuration. By contrast, Big Switch Network's commercial products have authenticated REST APIs and in-depth Role-Based Access Control (RBAC) features to provide enterprise-level security." (See Big Switch Intros Flagship Big Cloud Fabric – At Last.)

For a directory of SDN controllers, including those based on OpenDaylight code, see Who Does What: SDN Controllers.

— Mitch Wagner, Circle me on Google+ Follow me on TwitterVisit my LinkedIn profileFollow me on Facebook, West Coast Bureau Chief, Light Reading. Got a tip about SDN or NFV? Send it to [email protected].

About the Author(s)

Mitch Wagner

Executive Editor, Light Reading

San Diego-based Mitch Wagner is many things. As well as being "our guy" on the West Coast (of the US, not Scotland, or anywhere else with indifferent meteorological conditions), he's a husband (to his wife), dissatisfied Democrat, American (so he could be President some day), nonobservant Jew, and science fiction fan. Not necessarily in that order.

He's also one half of a special duo, along with Minnie, who is the co-habitor of the West Coast Bureau and Light Reading's primary chewer of sticks, though she is not the only one on the team who regularly munches on bark.

Wagner, whose previous positions include Editor-in-Chief at Internet Evolution and Executive Editor at InformationWeek, will be responsible for tracking and reporting on developments in Silicon Valley and other US West Coast hotspots of communications technology innovation.

Beats: Software-defined networking (SDN), network functions virtualization (NFV), IP networking, and colored foods (such as 'green rice').

Subscribe and receive the latest news from the industry.
Join 62,000+ members. Yes it's completely free.

You May Also Like