It seems to be a result of J-M Bony that every nonnegative function in $C^{2m}$ is a sum of squares of two $C^m$ functions, which means that every $C^\infty$ function is the sum of squares of two $C^m$ functions for any $m$ (which, I suppose, does not mean that you can do it with two $C^\infty$ functions -- the counterexamples are attributed to Paul Cohen and D.B.A. Epstein -- see references 1and 4 in the cited paper): the reference is:
For functions from $\mathbb{R}^k \rightarrow \mathbb{R}_+$ these results are extended in:
EDIT I asked J-M Bony for the scoop, and his response is that no one seems to know what the counterexample actually is, P.J. Cohen was asked about this shortly before his death, but did not remember, Bony himself says he does not even know whether a counterexample exists, and would not know which way to wager. Given that he is THE expert in the field, I would say the problem is open.