October 9 is the day the U.S. Supreme Court has set aside to hear arguments
in the case known as "Eldred vs. Ashcroft." The subject of the case - a 20
year extension to copyright protection - may seem obscure, but the outcome
of this case may well change the shape of copyright law (and intellectual
property law in general) in the U.S. for a long time.
The specific details of this case are as follows. Eric Eldred operates the
Eldritch Press, a collection of
books which are in the public domain. Mr. Eldred's plans to add a number
of new works, including poems by Robert Frost, were thwarted by the "Sonny
Bono Copyright Term Extension Act," which added twenty years to copyright
terms. Works that were in the public domain were suddenly brought back
under copyright protection, and thus could no longer be posted publicly.
And works that were about to enter the public domain - the famous example
(and seeming motivation for the copyright extension) being Micky Mouse -
now will not for another two decades.
The U.S.
Constitution describes the congressional power to regulate intellectual
property in typical, terse fashion:
The Congress shall have Power ... To promote the Progress of
Science and useful Arts, by securing for limited Times to Authors
and Inventors the exclusive Right to their respective Writings and
Discoveries;
The key points here are (1) the statement that promoting the progress of
science and the arts is the purpose of granting a monopoly right to
intellectual property, and (2) the phrase "limited times." The
plaintiffs in Eldred vs. Ashcroft (the case is being argued by none other
than Lawrence Lessig) are making the claim that the new, longer copyright
terms go beyond any reasonable "limited time," and that they no longer
promote the creation of new works. After all, the authors whose works
benefit from the extra 20 years of protection are dead; even the strongest
economic incentives are unlikely to motivate them to produce anything of
any interesting quality. The plaintiffs in this case are asking the court
to rule that the Congress has exceeded its constitutional authority in
making this law, and that the law should thus be void.
The Supreme Court is an unpredictable institution; it could do almost
anything in response to this case. It is also a slow institution. The
case will be argued on the 9th, but the eventual ruling will not be heard
until sometime next year.
How is all of this relevant to free software? There is an ongoing push in
the U.S. to establish absolute control over ideas in many forms. As
Mr. Lessig has argued many times, the concept of an intellectual commons,
with ideas available to all, is being pushed aside. But that commons is
the source of much that intellectual property owners want to protect.
Disney took "The Little Mermaid" from the commons, but wants to hold on to
its rather less gory version forever.
Free software benefits from a deep commons of shared ideas and code. Those
who feel threatened by free software would like to fight it by withholding
ideas from that commons. Whether the issue is file formats, network
protocols, or patented algorithms, the problem is the same: monopolies on
ideas reduce the commons from which free software developers can draw. The
expansion of intellectual property monopolies in the U.S. has gone
unchallenged for years, with results like copyright extension, the DMCA,
and future delights like the CBDTPA.
Eldred vs. Ashcroft has the potential to put limits on the expansion of
intellectual property law and the fencing off of the intellectual commons.
It could be the turning point in this battle - but it could turn in either
direction. We can only wish the best of luck to the plaintiffs in this
fight, and thank them for making the effort.
(See also: the Eldred vs. Ashcroft page).
Comments (none posted)
As of Wednesday Morning (October 2), there are almost 1200 individual
subscribers to LWN. We also have all of three confirmed (small) corporate
subscriptions, with discussions happening with others. With luck, we will
be able to announce our first large corporate subscription in the near
future. Many thanks to all of you who have shown your support for LWN.
So where does that leave us? It takes on the order of 1000 subscribers to
support one full-time LWN editor with a minimal salary (i.e. less than they
can make elsewhere) once taxes, health insurance, connectivity, and,
perhaps, an occasional trade show are thrown in. So, in other words, we
have made some real progress, but we are still some distance from being
able to operate LWN at its current level of staffing (and, thus, content).
It is, of course, early to say what the steady state subscription level
will be. Corporate subscribers, in particular, move slowly. But, it seems
reasonably clear that, unless we get a new surge in interest, LWN will
likely go forward as a smaller operation than it is now. The good news is
that (1) it looks like LWN will continue, in some form, and
(2) we have been surprised before; the situation may yet improve.
The best way to make things improve remains corporate subscriptions. We'll ask
our readers one more time to encourage their employers and universities to
look into our group subscription offerings. These subscriptions make LWN
available to large groups of people while doing a lot to help keep LWN on
the air.
The subscription system itself seems to be working reasonably well - not
bad for a big body of completely new code that had its first real stress
test when deployed on the site. A few glitches remain, and we are working
on it. In particular, there seems to be a cookie problem with Internet
Explorer that is proving hard to track down - especially since we have very
few Windows systems around here. It is not our desire to exclude IE users
- they are responsible for about 20% of our traffic. We will work this one
out somehow.
Thanks yet again for your support of LWN. We will continue to do our best
to produce a site that is worthy of that support.
Comments (49 posted)
Page editor: Jonathan Corbet
Security
Brief items
vnunet has posted
another one
of its Linux security articles with the same sort of theme:
X-Force, the US-based monitoring group of security software firm
Internet Security Systems, has been tracking the number of security
holes in software. Last year the centre found 149 bugs in
Microsoft software compared to 309 for Linux. This year the
situation was worse, with 485 Linux bugs this year compared to
Microsoft's 202.
Nobody would try to argue that Linux is free of security holes - anybody
who thinks so need only read the rest of this page to learn otherwise. But
the above comparison is absolutely meaningless for a number of reasons:
- Each distribution is counted independently. The same vulnerability in
five distributions will count as five separate vulnerabilities. This
practice, of course, inflates the number of reported Linux problems.
- Linux vulnerabilities include those in applications (i.e. PostgreSQL)
which are not part of a standard Windows system.
- Most Linux vulnerabilities are found through code audits and similar
efforts; they are patched and reported before any exploits happen.
Any Windows bugs found through similar audits are fixed silently and
do not appear in these counts.
Articles like this one try to make it appear that Linux has worse security
problems than other operating systems. If you look, however, at the amount
of actual security pain suffered by Linux administrators, the story is
different. Linux security is nowhere near as good as it really should be,
but it's not as bad as some people would like to make it out to be.
Comments (5 posted)
Red Hat and Dell have
announced
that an "open source security summit" will be held on October 29 in
Washington, DC.
"
The Security Summit will provide an open forum to discuss and
explore how open source technologies, methodologies, tools, and support
processes meet the challenges of securing networks and computer
systems."
Comments (none posted)
New vulnerabilities
Apache 2.0 cross-site scripting vulnerability
| Package(s): | apache |
CVE #(s): | CAN-2002-0840
|
| Created: | October 2, 2002 |
Updated: | October 2, 2002 |
| Description: |
Versions of Apache 2.0 prior to 2.0.43 have a
cross-site scripting vulnerability in the error page handling code. If
you are running Apache 2.0, this one is worth fixing. |
| Alerts: |
(No alerts in the database for this vulnerability)
|
Comments (none posted)
Multiple vulnerabilities in bugzilla
| Package(s): | bugzilla |
CVE #(s): | |
| Created: | October 2, 2002 |
Updated: | October 9, 2002 |
| Description: |
The Bugzilla bug tracking system (versions prior to 2.14.4 or 2.16.1)
suffers from a number of vulnerablities, including one which could result
in remote command and SQL injection. An upgrade to 2.16.1 is recommended,
since the 2.14 branch will be unmaintained after the end of the year. See
the Bugzilla advisory for details. |
| Alerts: |
|
Comments (1 posted)
Another set of fetchmail buffer overflows
| Package(s): | fetchmail fetchmail-ssl |
CVE #(s): | |
| Created: | October 1, 2002 |
Updated: | December 17, 2002 |
| Description: |
e-matters GmbH has issued an advisory
warning of a new set of buffer overflows in the fetchmail header parsing
code. The vulnerabilities have been fixed in fetchmail 6.1.0. |
| Alerts: |
|
Comments (none posted)
Buffer overflow in gv
| Package(s): | gv |
CVE #(s): | CAN-2002-0838
|
| Created: | October 1, 2002 |
Updated: | November 25, 2002 |
| Description: |
gv, a graphical front end to ghostscript, has a buffer overflow
vulnerability which can be exploited by a properly crafted PostScript or
PDF file. If a user can be tricked into viewing such a file, arbitrary
code can be executed with that user's privileges. See this iDEFENSE advisory for the details. |
| Alerts: |
|
Comments (none posted)
Buffer overflows in heimdal
| Package(s): | heimdal |
CVE #(s): | |
| Created: | October 1, 2002 |
Updated: | October 17, 2002 |
| Description: |
A SuSE security team audit of the heimdal Kerberos implementation turned up sever buffer overflow vulnerabilities. No exploits are known as of this writing, but these vulnerabilities are almost certainly possible for a remote attacker to exploit; if you are running heimdal, you should upgrade at the first opportunity. |
| Alerts: |
|
Comments (none posted)
sendmail smrsh bypass vulnerability
| Package(s): | sendmail |
CVE #(s): | CAN-2002-1165
|
| Created: | October 2, 2002 |
Updated: | November 29, 2002 |
| Description: |
iDEFENSE has posted an advisory warning of a
couple of ways of bypassing the restrictions imposed by the sendmail
"smrsh" utility. smrsh puts limits on which programs a user may run out of
a .forward file; this vulnerability could give a local user
undesired access to the mail server system. A patch has
been made available from sendmail.org which closes the vulnerability. |
| Alerts: |
|
Comments (none posted)
File overwrite vulnerability in tar and unzip
| Package(s): | tar unzip |
CVE #(s): | CAN-2001-1267
CAN-2001-1268
CAN-2001-1269
CAN-2002-0399
|
| Created: | October 1, 2002 |
Updated: | April 10, 2006 |
| Description: |
The tar utility does not properly filter file names containing
"../", meaning that a hostile archive can, if unpacked by an
unsuspecting user, overwrite any file that is writable by that user. GNU
tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42
has the same vulnerability. |
| Alerts: |
|
Comments (1 posted)
Updated vulnerabilities
Heap corruption vulnerability in at
| Package(s): | at at, sudo, xchat |
CVE #(s): | CAN-2002-0004
|
| Created: | May 21, 2002 |
Updated: | May 15, 2003 |
| Description: |
The at command has a
potentially exploitable heap corruption bug.
(First LWN report: January 17th).
|
| Alerts: |
|
Comments (none posted)
bind buffer overflow vulnerability in DNS resolver libraries
| Package(s): | bind glibc |
CVE #(s): | CAN-2002-0651
CAN-2002-0684
|
| Created: | July 8, 2002 |
Updated: | October 1, 2003 |
| Description: |
The BIND 4.9.8-OW2 patch and BIND 4.9.9 release (and thus 4.9.9-OW1)
include fixes for a libc related vulnerability which does not
affect Linux. Updates from
the Internet Software Consortium (ISC)
are available from here.
No release or branch of Openwall GNU/*/Linux (Owl) is known to be
affected, due to Olaf Kirch's fixes for this problem getting into the
GNU C library more than two years ago.
Unfortunatly that does not mean that Linux systems are not vulnerable.
Similar code, without Olaf Firch's fixes,
is in the glibc getnetbyXXX functions.
These functions are described in the SuSE alert as
"
used by very few applications only, such as ifconfig and ifuser,
which makes exploits less likely."
CERT Advisory: CA-2002-19
Buffer Overflow in Multiple DNS Resolver Libraries
CAN-2002-0651
CAN-2002-0684 |
| Alerts: |
|
Comments (1 posted)
Potential unauthorized root access vulnerability in dietlibc
| Package(s): | dietlibc |
CVE #(s): | CAN-2002-0391
|
| Created: | August 14, 2002 |
Updated: | December 5, 2002 |
| Description: |
Felix von Leitner, discovered a
potential division by zero bug in
code derived from the SunRPC library with is used in
dietlibc, a libc optimized for small size.
The bug could be exploited to gain unauthorized root
access to software linking to dietlibc.
CERT/CC Vulnerability Note VU#192995 Integer
overflow in xdr_array() function when deserializing the XDR stream |
| Alerts: |
|
Comments (none posted)
Ethereal buffer overflow, infinite loop and memory management vulnerabilities
| Package(s): | ethereal |
CVE #(s): | CAN-2002-0012
CAN-2002-0013
CAN-2002-0353
CAN-2002-0401
CAN-2002-0402
CAN-2002-0403
CAN-2002-0404
|
| Created: | June 12, 2002 |
Updated: | October 27, 2002 |
| Description: |
Ethereal 0.9.4
was released
on May 19, 2002 fixing four potential security issues in Ethereal 0.9.3:
- The SMB dissector could potentially dereference a NULL pointer in two cases.
- The X11 dissector could potentially overflow a buffer while parsing keysyms.
- The DNS dissector could go into an infinite loop while reading a malformed packet.
- The GIOP dissector could potentially allocate large amounts of memory.
No known exploits exist "in the wild" at the present time for any of these issues.
Ethereal 0.9.2 has several packet handling vulnerabilities
that are best avoided by upgrading to 0.9.4.
The PROTOS test
suite found some flaws in SNMP and LDAP protocols support.
Malformed packets could also crash ethereal 0.9.2 due to a
ASN.1 zero-length g_malloc problem.
The zlib "double free" vulnerability
was addressed by the updates for that bug from many distributors. |
| Alerts: |
|
Comments (none posted)
Filename disclosure vulnerability in fam
| Package(s): | fam |
CVE #(s): | CAN-2002-0875
|
| Created: | August 19, 2002 |
Updated: | January 5, 2005 |
| Description: |
"fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible. |
| Alerts: |
|
Comments (none posted)
GNU fileutils race condition
| Package(s): | fileutils ucdsnmp |
CVE #(s): | CAN-2002-0435
|
| Created: | May 21, 2002 |
Updated: | May 16, 2003 |
| Description: |
A race
condition in rm may cause the root user to delete the whole filesystem.
The problem exists in the version of rm in
fileutils
4.1 stable and 4.1.6 development version. A patch
is available.
(First LWN
report: May 2).
|
| Alerts: |
|
Comments (none posted)
Potential remote root exploit in glibc
| Package(s): | glibc |
CVE #(s): | CAN-2002-0391
|
| Created: | August 14, 2002 |
Updated: | June 30, 2003 |
| Description: |
Felix von Leitner, discovered a
potential division by zero bug in
code derived from the SunRPC library which is used in glibc.This bug could be
exploited to gain unauthorized root access to software linking to glibc.
Updating as soon as practical is a good idea.
Because SunRPC-derived XDR libraries are used by a variety of vendors in a variety of applications, this defect may lead to a number of differing security problems. Exploiting this vulnerability will lead to denial of service, execution of arbitrary code, or the disclosure of sensitive information.
CERT/CC Vulnerability Note VU#192995 Integer
overflow in xdr_array() function when deserializing the XDR stream
|
| Alerts: |
|
Comments (none posted)
Buffer overflow in groff
| Package(s): | groff |
CVE #(s): | CAN-2002-0003
|
| Created: | May 21, 2002 |
Updated: | December 9, 2002 |
| Description: |
The groff package has a buffer overflow
vulnerability; if it is used with the print system, it is conceivably
exploitable remotely.
|
| Alerts: |
|
Comments (none posted)
HylaFAX 4.1.3 fixes multiple vulnerabilities
| Package(s): | hylafax |
CVE #(s): | CAN-2001-1034
|
| Created: | July 30, 2002 |
Updated: | October 9, 2002 |
| Description: |
The HylaFAX team has
released version 4.1.3 fixing
denial of service, elevated system privilege and possible
remote code execution vulnerabilities.
HylaFAX is a mature (est. 1991) enterprise-class open-source software
package for sending and receiving facsimiles as well as for sending
alpha-numeric pages. It runs on a wide variety of UNIX-like platforms
including Linux, BSD (including Mac OS X), SunOS and Solaris, SCO, IRIX,
AIX, and HP-UX.
|
| Alerts: |
|
Comments (none posted)
UW imapd remotely exploitable buffer overflow
| Package(s): | imap |
CVE #(s): | CAN-2002-0379
|
| Created: | June 5, 2002 |
Updated: | December 20, 2002 |
| Description: |
UW imapd versions 2000c and prior allow remote authenticated users to execute code via a buffer overflow. A malicious user can craft
a request to run commands on the server under their UID and GID.
(First LWN report: May 23). |
| Alerts: |
|
Comments (2 posted)
Cross-site scripting vulnerability in Konqueror for KDE 3.0.3
| Package(s): | kdelibs |
CVE #(s): | |
| Created: | September 17, 2002 |
Updated: | November 18, 2002 |
| Description: |
Konqueror for KDE 3.0.3, and earlier versions, is subject to
this cross-site
scripting vulnerability.
Since the problem is in kdelibs, any other application which
uses the KHTML renderer is also vulnerable.
Javascript code running in one frame can
access other frames which should be inaccessible. The problem is
fixed in kdelibs 3.0.3a. |
| Alerts: |
|
Comments (2 posted)
Kerberos 5 unauthorized root access to KDC host vulnerability
| Package(s): | krb5 |
CVE #(s): | |
| Created: | August 14, 2002 |
Updated: | October 29, 2002 |
| Description: |
A bug in the Kerberos 5 remote
administration service, "kadmind", could be
exploited to gain unauthorized root access to a KDC host.
It is believed that the attacker needs to be able to
authenticate to the kadmin daemon for this attack to be successful.
Felix von Leitner, discovered this
potential division by zero bug in
code derived from the SunRPC library which is used
in many places, including the Kerberos 5 administration system.
Updating now is recommended.
CERT/CC Vulnerability Note VU#192995 Integer
overflow in xdr_array() function when deserializing the XDR stream
|
| Alerts: |
|
Comments (none posted)
LPRng accepts jobs from any host.
| Package(s): | LPRng |
CVE #(s): | CAN-2002-0378
|
| Created: | June 12, 2002 |
Updated: | October 31, 2002 |
| Description: |
Matthew Caron pointed out that LPRng's default configuration accepts job submissions from any host.
This could be an especially annoying vulnerability for adminstrators
with systems exposed to the general public.
|
| Alerts: |
|
Comments (none posted)
Cross-site scripting vulnerability in mhonarc
| Package(s): | mhonarc |
CVE #(s): | CAN-2002-0738
CAN-2002-1307
CAN-2002-1388
|
| Created: | September 11, 2002 |
Updated: | January 3, 2003 |
| Description: |
Mhonarc is an HTML formatter for electronic mail; it can be vulnerable to cross-site scripting problems when presented with maliciously crafted messages. This problem is fixed in mhonarc version 2.5.3, but it is not clear that all possible vulnerabilities have been fixed. See the Debian advisory below for information on how to disable text/html attachment support in mhonarc, which may be a more secure solution. |
| Alerts: |
|
Comments (none posted)
PHP Remote Compromise/DOS Vulnerability
| Package(s): | mod_php4 |
CVE #(s): | |
| Created: | July 22, 2002 |
Updated: | February 18, 2003 |
| Description: |
PHP 4.2.0 and 4.2.1 have an error in the handling of POST requests which
can lead to the corruption of memory, and the usual bad consequences. According to this alert, the vulnerability can only be used for denial of service on x86 systems - there is no way to get it to run exploit code. SPARC/Solaris systems are apparently vulnerable to full remote compromise.
According to the CERT Advisory,
almost every Linux distributor, it seems, ships older (and thus not vulnerable) versions of PHP.
Note that, sometimes, systems thought to be safe from remote compromise turn out to be vulnerable to a modified attack, so x86 users should not relax too much. The solution, for those systems with PHP
4.2.0 or 4.2.1 installed,
is to upgrade to PHP 4.2.2.
For more information see the alert from
the discover of the vulnerability, Stefan Esser of e-matters GmbH,
or the security
advisory from the php team.
CERT Advisory: CA-2002-21 Vulnerability in PHP |
| Alerts: |
|
Comments (1 posted)
Mozilla XMLHttpRequest file disclosure vulnerability
| Package(s): | mozilla |
CVE #(s): | CAN-2002-0354
|
| Created: | May 21, 2002 |
Updated: | October 18, 2002 |
| Description: |
This XMLHttpRequest security
bug impacts all Mozilla-based browsers. "The bug is found in versions of
Mozilla from 0.9.7 to 0.9.9 on various operating
system platforms, and in Netscape versions 6.1 and
higher."
(First LWN
report: May 2).
|
| Alerts: |
|
Comments (none posted)
String format bug in pam_ldap logging
| Package(s): | nss_ldap |
CVE #(s): | CAN-2002-0374
|
| Created: | June 5, 2002 |
Updated: | October 29, 2002 |
| Description: |
The nss_ldap package includes the pam_ldap module for
authenticating a user with an LDAP database.
Pam_ldap versions prior to 144 have a string format
bug in the logging mechanism. |
| Alerts: |
|
Comments (none posted)
Safemode vulnerability in PHP
| Package(s): | PHP |
CVE #(s): | CAN-2001-1246
|
| Created: | August 20, 2002 |
Updated: | October 9, 2002 |
| Description: |
PHP versions 4.0.5 through 4.1.0 fail to properly cleanse a parameter to the mail() function, allowing arbitrary command execution by local and (possibly) remote attackers. |
| Alerts: |
|
Comments (none posted)
Remotely exploitable vulnerability in pine
| Package(s): | pine |
CVE #(s): | CAN-2002-0014
|
| Created: | May 21, 2002 |
Updated: | November 27, 2002 |
| Description: |
Pine has an
unpleasant
vulnerability in URL handling vulnerability which can lead to
command execution by remote attackers.
(First LWN report: January 17th).
This vulnerability is remotely exploitable; updating is a good idea.
Note: If an update isn't yet available for your distribution,
setting enable-msg-view-urls to "off" in pine's setup will
avoid the vulnerability. (Thanks to Greg Herlein).
|
| Alerts: |
|
Comments (none posted)
Buffer overflow vulnerabilities in PostgreSQL
| Package(s): | PostgreSQL |
CVE #(s): | |
| Created: | August 21, 2002 |
Updated: | January 27, 2003 |
| Description: |
PostgreSQL 7.2.2 has been released in response to a number of buffer
overrun vulnerabilities which have been identified recently. "...it
should be noted that these vulnerabilities are only critical on 'open' or
'shared' systems, as they require the ability to be able to connect to the
database before they can be exploited."
Buffer overflow vulnerabilities fixed include those reported by
"Sir Mordred The Traitor" in the cash_words,
repeat, and lpad
and rpad functions. |
| Alerts: |
|
Comments (none posted)
Buffer overflow vulnerabilities in purity
| Package(s): | purity |
CVE #(s): | |
| Created: | September 17, 2002 |
Updated: | September 26, 2002 |
| Description: |
It seems that the "purity" game isn't entirely pure itself - a couple of
buffer overflows have been found which could be exploited to gain access to
the "games" group on Debian systems. Rather than face the prospect of
people tampering with their nethack scores, the Debian Project released the
first upgrade closing the vulnerability. |
| Alerts: |
|
Comments (none posted)
PXE server denial of service vulnerability
| Package(s): | pxe |
CVE #(s): | CAN-2002-0835
|
| Created: | September 4, 2002 |
Updated: | November 11, 2002 |
| Description: |
The PXE server can be crashed using DHCP packets from
some Voice Over IP (VOIP) phones. Maliciously formed
DHCP packets could be used by a remote attacker to effect a
denial of service attack.
The PXE package contains the PXE (Preboot eXecution Environment)
server and code needed for Linux to boot from a boot disk image on a
Linux PXE server.
|
| Alerts: |
|
Comments (none posted)
Local arbitrary code execution vulnerability in Python
| Package(s): | python |
CVE #(s): | CAN-2002-1119
|
| Created: | August 28, 2002 |
Updated: | October 1, 2003 |
| Description: |
Zack Weinberg discovered that
os._execvpe from os.py uses a predictable name which could lead
to execution of arbitrary code. According to the Debian
advisory, the problem
was present in Python versions 1.5, 2.1 and 2.2.
CAN-2002-1119 |
| Alerts: |
|
Comments (none posted)
Sharutils potential privilege escalation using uudecode
| Package(s): | sharutils |
CVE #(s): | CAN-2002-0178
|
| Created: | May 21, 2002 |
Updated: | October 31, 2002 |
| Description: |
According to the CVE entry,
"uudecode, as available in the sharutils package before 4.2.1, does not
check whether the filename of the uudecoded file is a pipe or symbolic
link, which could allow attackers to overwrite files or execute commands."
(First LWN
report: May 16).
|
| Alerts: |
|
Comments (none posted)
Multiple vulnerabilities fixed in Squid-2.4.STABLE7
| Package(s): | squid |
CVE #(s): | |
| Created: | July 8, 2002 |
Updated: | November 15, 2002 |
| Description: |
Here is the security advisory for the Squid proxy server reporting several vulnerabilities in versions up to and including 2.4.STABLE7.
Several of the bugs are believed to allow remote code execution.
The security advisory lists the following
changes:
- Several bugfixes and cleanup of the Gopher client, both
to correct some security issues and to make Squid properly
render certain Gopher menus.
- Security fixes in how Squid parses FTP directory listings into
HTML
- FTP data channels are now sanity checked to match the address
of the requested FTP server. This to prevent theft or injection
of data. See the new ftp_sanitycheck directive if this sanity
check is not desired.
- The MSNT auth helper has been updated to v2.0.3+fixes for
buffer overflow security issues found in this helper.
- A security issue in how Squid forwards proxy authentication
credentials has been fixed
|
| Alerts: |
|
Comments (none posted)
Malformed NFS packet buffer overflow vulnerability in tcpdump
| Package(s): | tcpdump |
CVE #(s): | CAN-2002-0380
|
| Created: | June 5, 2002 |
Updated: | October 9, 2002 |
| Description: |
A buffer overflow in tcpdump can be triggered by a bad NFS packet when
tracing the network. Unmodified tcpdump versions 3.6.2 and earlier are vulnerable.
|
| Alerts: |
|
Comments (none posted)
Multiple vendor telnetd vulnerability
| Package(s): | telnet Telnet netkit-telnet-ssl kerberos telnetd netkit-telnet nkitb/nkitserv/telnetd krb5 |
CVE #(s): | |
| Created: | May 21, 2002 |
Updated: | October 5, 2004 |
| Description: |
This vulnerability,
originally thought to be confined to BSD-derived systems, was first covered
in the July 26th Security
Summary. It is now known that Linux telnet daemons are vulnerable as
well.
|
| Alerts: |
|
Comments (none posted)
Tomcat 4.x JSP source code exposure vulnerability
| Package(s): | tomcat |
CVE #(s): | |
| Created: | September 25, 2002 |
Updated: | January 29, 2003 |
| Description: |
Rossen Raykov reports that Tomcat 4.0.5 and 4.1.12 fix a JSP source code exposure vulnerability
in "Tomcat 4.0.4 and 4.1.10 (probably all other earlier versions also).".
The current version of Tomcat is available here.
|
| Alerts: |
|
Comments (none posted)
Local root vulnerability in chfn
| Package(s): | util-linux |
CVE #(s): | CAN-2002-0638
|
| Created: | July 30, 2002 |
Updated: | October 31, 2002 |
| Description: |
chfn (change finger information) is one of the utilities in
the util-linux package.
The BindView RAZOR Team has discovered a local root vulnerability
in chfn which is described in the Bindview Advisory.
Under certain conditions, "a
carefully crafted attack sequence can be performed to exploit a
complex file locking and modification race present in this utility,
and, as a result, alter /etc/passwd to escalate privileges in the
system." The conditions include a password file, /etc/passwd, over 4 kilobytes and locating the attacker's account record in any
but the last 4 kB chunk of the file.
CERT/CC Vulnerability Note VU#405955 util-linux package vulnerable to privilege escalation when "ptmptmp" file is not removed properly when using "chfn" utility |
| Alerts: |
|
Comments (none posted)
webalizer: reverse DNS buffer overflow vulnerability
| Package(s): | webalizer |
CVE #(s): | |
| Created: | May 21, 2002 |
Updated: | January 27, 2003 |
| Description: |
The cause is a buffer overflow bug.
This one sounds nasty.
If reverse DNS lookups are enabled in webalizer,
"an attacker with control over the victims DNS may spoof responses thus
triggering a buffer overflow, potentially leading to a root compromise."
Webalizer 2.01-10 "fixes this and a few
other buglets that have been discovered in the last month or so".
(First LWN report: April 18th, 2002).
|
| Alerts: |
|
Comments (none posted)
Webmin/Usermin vulnerabilities
| Package(s): | webmin |
CVE #(s): | |
| Created: | May 21, 2002 |
Updated: | January 10, 2003 |
| Description: |
Webmin is a web-based interface for
system administration for Unix.
Webmin has cross-site scripting and
session ID spoofing vulnerabilities
which are fixed in the May 6, 2002 release of version 0.970.
(First LWN
report: May 9).
This one is scary. The session ID
spoofing vulnerability allows the "possibility that arbitrary
commands may be executed with root privileges."
Upgrading is strongly recommended. At a minimum avoid the
"preconditions for a successful exploit" by disabling
password timeouts under Webmin->Configuration->Authentication.
|
| Alerts: |
|
Comments (1 posted)
Multiple vulnerabilities in wordtrans
| Package(s): | wordtrans |
CVE #(s): | CAN-2002-0837
|
| Created: | September 11, 2002 |
Updated: | February 4, 2003 |
| Description: |
The "wordtrans" interface to multilingual dictionaries suffers from input validation and cross-site scripting vulnerabilities; versions through 1.1pre8 are vulnerable. See this Guardent advisory for details. |
| Alerts: |
|
Comments (none posted)
Problems with libgtop_daemon
| Package(s): | wuftpd libgtop |
CVE #(s): | |
| Created: | May 21, 2002 |
Updated: | May 7, 2003 |
| Description: |
The libgtop_daemon package is a GNOME
program which makes system information available remotely.
LWN reported the remotely exploitable format
string and buffer overflow vulnerabilities in that package
on December 6th.
On November 28th
disabling the libgtop_daemon on systems where it is running until
an update is available.
Many Linux systems do not run
libgtop by default, but applying the update is a good idea anyway.
|
| Alerts: |
|
Comments (1 posted)
Wwwoffle remote privilege escalation vulnerability
| Package(s): | wwwoffle |
CVE #(s): | CAN-2002-0818
|
| Created: | August 14, 2002 |
Updated: | October 1, 2003 |
| Description: |
The wwwoffle web proxy incorrectly processes HTTP PUT and POST requests
with negative Content Length values.
"It is believed
that an attacker could exploit this bug to gain remote wwwrun access
to the system wwwoffled is running on."
CAN-2002-0818 |
| Alerts: |
|
Comments (none posted)
Local privilege escalation vulnerability in XFree86
| Package(s): | xf86 xfree86 |
CVE #(s): | |
| Created: | September 18, 2002 |
Updated: | October 27, 2002 |
| Description: |
XFree86 version 4.2.1 fixes a problem in
Xlib that made it possible to execute arbitrary code in privileged clients.
Other libraries are dynamically loaded by libX11.so as needed.
When linking against a setuid program, arbitrary code
could be loaded and executed from a pathname controlled by the user.
|
| Alerts: |
|
Comments (none posted)
Denial of service vulnerability in xinetd
| Package(s): | xinetd |
CVE #(s): | |
| Created: | August 14, 2002 |
Updated: | December 3, 2002 |
| Description: |
A file descriptor leak into services started from xinetd
may be used, by programs it stats, to crash xinetd.
Xinetd is a replacement for the BSD derived inetd. |
| Alerts: |
|
Comments (none posted)
Multiple vulnerabilities in Zope 2.5.1
| Package(s): | zope |
CVE #(s): | CAN-2002-0170
CAN-2002-0687
CAN-2002-0688
|
| Created: | September 25, 2002 |
Updated: | September 26, 2002 |
| Description: |
Three security hotfixes are available to fix vulnerabilities in
Zope 2.5.1:
- (Hotfix 2002-03-01) Users defined in subfolders of a site may
have unintended access to objects at higher levels.
- (Hotfix 2002-04-15) Untrusted users can use the "through the web code" capability to shut down the Zope server.
- (Hotfix 2002-06-14) Anonymous users and untrusted code can call arbitrary methods of catalog indexes.
|
| Alerts: |
|
Comments (2 posted)
Resources
Linux Security Week for September 30 from LinuxSecurity.com is available.
Full Story (comments: none)
The Register
covers
two recent varients of the Slapper worm, Slapper.B (Cinik) and Slapper.C
(Unlock).
"
Two fresh variants of the Slapper worm, which spreads through Linux machines
by exploiting a well-known flaw in OpenSSL libraries, have been sighted this week."
Comments (none posted)
Page editor: Jonathan Corbet
Kernel development
Brief items
The current development kernel is 2.5.40,
released by Linus on October 1. Among the
usual fixes and updates, it includes high memory support for User-mode
Linux, the CPU frequency (power management) patches, more disk management
thrashups from Al Viro, the in-kernel NUMA topology API, the removal of the
task queue subsystem, an ISDN update, and an ARM update. Here's
the long-format changelog with the details.
Linus announced 2.5.39 on
September 27. The biggest change,
perhaps, was the inclusion of the deadline I/O scheduler (covered in last week's LWN Kernel Page);
this kernel also contained a bunch of XFS fixes, an SCTP update, a bunch of
memory management work by Andrew Morton, Ingo Molnar's in-kernel symbolic
oops dumper, some driver model work, and numerous other fixes and updates.
The the
long-format changelog is available.
Linus's pre-2.5.41 BitKeeper tree contains a big ALSA update (the source of
some grumbling from Linus), Ingo Molnar's
"workqueue" implementation (see below), and a relatively small number (as
of this writing) of other fixes and updates.
Dave Jones jumped back into the prepatch business with 2.5.39-dj1, which contained a number of fixes
from his tree. Dave evidently still has a substantial pile of fixes to
push on to Linus, but has been busy.
After a long absence, Alan Cox has also started putting out development
kernel prepatches again. 2.5.40-ac1
includes support for the Voyager architecture, a merge of the uClinux
distribution, and a number of fixes.
The latest 2.5 status summary from Guillaume
Boissiere is dated October 2.
The current stable kernel is 2.4.19. Marcelo released 2.4.20-pre8 seconds after last week's Kernel
Page was posted; it included an IBM hotplug driver update, a couple
of security fixes, an x86-64 update, and a number of other fixes.
The current prepatch from Alan Cox is 2.4.20-pre8-ac3. Alan's recent releases have
contained quite a few fixes, but no major new work.
Comments (none posted)
Kernel development news
As part of the 2.5.40 announcement, Linus reminded the world that the
feature freeze is coming soon:
And a small reminder that we're now officially in the last month of
features, and since I'm going to be away basically the last week of
October, so I actually personally consider Oct 20th to be the
drop-date, unless you've got a really good and scary costume.. So
don't try to leave it to the last day.
Linus also let it be known that he's "perfectly happy with the kernel" and
feels no need to deal with last-minute code submissions.
In fact, the list of outstanding features is getting smaller. A couple of
big changes that are pending, and which could be disruptive, are:
- Changing the sector_t type to 64 bits, allowing block devices
to be larger than 2TB. One would think that 2TB would last for a
while, even by the standards of modern disks, but large RAID arrays
are already pushing that boundary. A patch (by Peter Chubb) is being
prepared, but it's taking him a while; among other things, he points
out that testing is a slow process because it takes a full day just to
write 4TB to a device.
- Turning dev_t into a 32-bit value. Increasing the number of
devices has been on the list since long before the 2.5 series began,
but the change has not yet been made. This is not a trivial change,
since the major device number is still used to index into static
arrays within the kernel. Drastically increasing the number of devices
requires dealing with those arrays. Alexander Viro has a plan to that end, but a lot of work
remains to be done.
Beyond that, quite a few other developments are pending, and they won't all
get in. Some outstanding items include the completion of the Linux
Security Module and asynchronous I/O merges, ext3 indexed directory
support, Rusty Russell's new module loader, a new kernel configuration and
build system, a whole pile of memory management work, etc.
What also remains to be seen is how serious Linus is about the feature
freeze. Past kernel freezes have tended to be slushy at best. Some
substantial work will have to be integrated after the freeze; it will be
interesting to see what gets in as "stabilization" or "feature completion."
Then, there is the much-publicized debate over whether the next stable
series should be 2.6 or 3.0. Linus started by saying that there was
nothing all that revolutionary in this kernel, and that it should be called
2.6. Numerous other developers disagreed, however, and Linus appears to have relented. It seems likely that
the next major stable kernel will be called Linux 3.0.
Comments (9 posted)
Kernel code often needs to set aside a task to be performed "a little
later." The classic example is that of an interrupt handler, which must
perform its task quickly, without blocking. Typically interrupt handlers
simply acknowledge the interrupt, then arrange for the real work to be done
outside of interrupt context. That work, which can include starting new
I/O operations, delivering data to user space, or cleanup actions, gets
done when the kernel gets around to it - and, usually, when it's safe to
sleep.
In the good old days, the "bottom half" mechanism was used to set aside
tasks in this manner. Linux bottom halves were quite inflexible, being
identified by globally-unique, compile-time numbers. There could be no
more than 32 of them - the number that could be tracked in a single-word
bitmask. And bottom halves were not safe places for extended processing or
tasks that needed to sleep.
More recent kernels moved much of the bottom half work to "task queues." A
task queue is a simple linked list of functions to call (and data to pass
to them). Certain predefined task queues were run at well-defined times;
one was executed whenever the scheduler was called, and another was run out
of the timer interrupt handler. Task queues cleaned things up
significantly, but they were not particularly transparent and,
fundamentally, they were still bottom halves. Their removal has been on
numerous peoples' "todo" lists for some time.
One replacement for task queues is the "tasklet" interface, which was
introduced in the 2.3 development series. Tasklets provide a
high-performance interface for quick tasks that do not sleep; they are thus
suitable for certain sorts of operations, but they do not replace task
queues in all situations.
More recently, an attempt was made to address other deferred processing
needs by wrapping a new interface (schedule_task()) around (what
was) the scheduler task queue, and creating a special kernel thread
(keventd) to run that queue. keventd provided a
well-defined process context for tasks that need it (in particular, those
which can sleep). But keventd still suffered the limitations of
task queues, plus one other: all tasks were executed by a single thread.
One very slow task could thus hold up everything else in the queue,
creating unpredictable latencies.
A couple of patches recently posted by Ingo Molnar address these problems
and clean up deferred processing substantially. The first patch removes the task
queue interface and converts its remaining users over to
schedule_task(); this patch was included in 2.5.40. The more
interesting work is contained in the workqueue
patch (since updated),
which has not yet (as of this writing) been merged by Linus.
This patch replaces the task queue mechanism (and schedule_task()
entirely with a mechanism which is simpler to use and which yields
better-defined results.
With the workqueue patch, task queues are replaced with the new "workqueue"
concept. The basic idea is the same: a workqueue is a linked list of
structures containing functions to call and data to pass to them. But the
internals of workqueues are better hidden so that users need not worry
about what is really going on. Workqueues are executed in process context,
so tasks executed from those queues may sleep. Each workqueue, however,
has its own worker threads (one per CPU), so one subsystem's workqueue
entries will
not block others from running. There is a default workqueue (analogous to
the old schedule_task() functionality) for relatively simple tasks
that do not justify their own queue.
For those who are interested, we have written up a separate article with reasonably complete
documentation of the workqueue interface.
There has been a bit of discussion over the details of this
interface. It has been through one set of modifications already, and will
likely evolve more in the near future.
The basic idea, however, appears to have been well
received; some version of this patch will probably go in before too long.
Comments (none posted)
The Linux Security Module code works by allowing security-related code to
hook into almost every access decision the kernel makes. Security modules
can only tighten restrictions by vetoing access that would have otherwise
been around. A number of security regimes - most notably the NSA's SELinux
- have been built on the LSM structure. The LSM patch has been partially
merged into the kernel; many of the LSM hooks are not yet there, however.
Recently some developers have been questioning some of the specific hooks.
In response, LSM maintainer Greg Kroah-Hartman has posted a patch removing a few LSM hooks: those for
creating, initializing, and deleting modules. Nobody seems to have an
issue with the ability to control those operations - it's just that no code
is currently using those hooks.
That is, in fact, Greg's stated policy with
LSM: any hooks that are not
actually being used by an available, open source security module will be
removed.
I am not happy with the idea that there would be hooks in the
kernel that are not being used. That's not the Linux way. If the
code isn't being used, it's removed.
The idea, of course, is that there is no point in trying to maintain code
that is not in use. By the time somebody actually tries to make use of it,
chances are it will be broken anyway. And, it is said, it is easy to
reintroduce a hook should the need develop.
Of course, given the LSM design, it's not that easy to put in a new
hook. LSM requires security modules to provide an explicit implementation
for every available hook, with the result that security modules accumulate
a lot of stub "no-op" hooks. Adding a hook will break every security
module out there until they implement a stub for that hook. Given that,
security module authors who see a use for some of the more obscure hooks
might want to document that use before too long.
Comments (3 posted)
The kernel is full of code which is not allowed to sleep. Anything which
is handling an interrupt or otherwise running out of process context, for
example, should not try to go to sleep. This particular case is easy to
catch in the scheduler, but others are not. For example, any code which is
holding a spinlock can not sleep either. Sleeping in this situation can
lead to deadlocks (some other process spinning on the lock can prevent the
holder from running again and releasing the lock), mutual exclusion
failures (on uniprocessor systems where spinlocks are optimized out), or,
at a minimum, excessive lock hold time and lock contention.
The problem is that it can be easy to sleep in the wrong places. Sleeps
are often not done directly; instead, a piece of atomic code calls a
function which calls some other function which sleeps. The "sleep
tendency" of functions is not always documented, and, in any case, kernel
hackers, being human, can make mistakes. Even if it seems, at times, that
they don't sleep.
Until recently, these mistakes have been hard to catch. There was no "I'm
running in an atomic section" flag, and thus no way for the kernel to know
that it is sleeping in a bad place - until something went badly wrong. The
preemptible kernel patch changed all that, however. Any place where the
code can not sleep is also certainly a bad place for that code to be
preempted. So the functions which mark atomic sections (such as spinlock
operations) now set a "don't preempt me" flag.
But once you have that flag, why not use it to detect sleeps in the wrong
place? Andrew Morton posted a patch which
does exactly that, and Linus merged it on the spot. The patch was titled
"increase traffic on linux-kernel," and it has done exactly that. There
are, it turns out, quite a few places where sleeping functions are called
within code that is supposed to be atomic. These mistakes are being fixed
almost as quickly as they are found. A small patch has done a lot to
eliminate a whole class of kernel programming errors.
Comments (none posted)
A new CPU frequency subsystem, written by Dominik Brodowski and others, was
integrated by Linus into the 2.5.40 release. This code provide user-space
control over the clock frequency of the CPU(s) in the system - at least,
for processors which provide that capability.
One might wonder why it would be desirable to run a processor at anything
below its rated speed. The reasons, of course, are power consumption and
thermal control. A faster CPU requires more power to run. If you're using
your laptop on an airplane, and you're not trying to crack any encryption
keys or set kernel build time records before you land, you might just want
to slow down the processor a little to avoid draining your battery.
Meanwhile, the processor may decide
to slow down on its own if it's getting too warm.
In fact, some modern processors can take a fairly smart approach to
frequency control. If the processor notices that it is spending a lot of
time idle, it can slow itself down. If it's constantly busy, it can turn
up the speed a bit. If a particular processor supports setting its
frequency in a "dumb" mode only, it might be nice for the operating system
to provide the automatic adjustment in software.
For this reason, a simple "set the frequency" interface was deemed to be
insufficient. The CPU frequency code merged into 2.5.40 reflects the new
understanding of the problem: it allows the user to set a range of
acceptable frequencies and the desired policy. If the user selects
"performance" as the policy, the processor will be instructed to run at the
upper end of its range; if it slows down, it does so gradually. With the
"powersave" policy, speeds will be kept lower even in the face of sustained
work to do. Overall, the new interface gives the user a great deal of
control over how the system operates. Of course, this interface is just a
cryptic /proc file (see Documentation/cpufreq in the 2.5.40 tree for
details); look for the KDE and GNOME
applications to show up in the near future.
For now, the code that has been merged into the kernel supports only the
i386 architecture. Code for a number of other processors exists and will
show up in the proper, architecture-specific trees.
Comments (2 posted)
Patches and updates
Kernel trees
Core kernel code
Development tools
Device drivers
Filesystems and block I/O
Janitorial
Kernel building
Memory management
Networking
Architecture-specific
Security-related
Benchmarks and bugs
Miscellaneous
Page editor: Jonathan Corbet
Distributions
News and Editorials
As you have no doubt already read on this week's Front Page, subscriptions
are going well, but not well enough (yet) to support the current LWN staff.
As a result it will no longer be possible to ferret out the distribution
information that has been presented in this page in the past. Some
feedback has indicated that tracking a pile of minor distributions has
little value in any case.
So, in the future we would like to focus on quality rather than quantity,
and we would like to get reports from people, telling us about their
distribution and its progress. Without that we will have little to report
each week.
This week's page reflects this policy. Almost every item in this page was
sent to us, either as a plain text announcement, or a URL accompanied by a
brief description of why the link might be of interest to LWN readers.
Please help the Distributions page survive during this transitional time,
by sending us the information that you want others to see about your
distribution.
Thank you.
Comments (8 posted)
Distribution News
Welcome to this year's 38th issue of DWN, the weekly newsletter for the
Debian community, which includes items by Ludovic Rousseau and Andrew
Pollock this time. After over four years of computation effort and millions
of cpu-hours of work, distributed.net has brute forced the key to RSA
Security's 64 bit encryption challenge, winning a US$ 10,000 prize.
Full Story (comments: none)
Issue #61 of the Mandrake Linux Community Newsletter is out.
"
This Week's Summary: Mandrake in the News; 9.0 Commercial Apps Now
Available to MandrakeClub Members; Business Case of the Week; This
Week's Survey; Security-related Software Updates; Headlines from
MandrakeForum."
Full Story (comments: none)
Red Hat, Inc. has released Red Hat Linux 8.0, a highly versatile operating
system designed for personal and small business computing.
Full Story (comments: 1)
There have been several minor changes to the
Slackware development tree. See the
change log
for full details.
Comments (none posted)
Minor distribution updates
The Aurora SPARC Linux Project is proud to announce Build 0.4
(Titanium) to the world. This release is for sparc32 & sparc64, and it
closes a lot of the ugly bugs still present in 0.32, in addition to
having a 2.4.19 based kernel.
Full Story (comments: none)
Lunar Linux 1.0 has been released after months of hard work. With a
completely revised source package managent system, Lunar Linux is targetted
initially for the system administrator, and also includes popular desktops
like gnome2, kde3 and xfce, and office applications such as mozilla-1.1 and
openoffice-1.0.1. Besides gcc-3.2/glibc-2.2.5 and a 2.4.19 kernel with XFS
support, lunar comes with daemons like apache-2.0.42, postfix-1.1.11,
exim-3.36 and sendmail-8.12.6 as well as bind-9.2.1.
Full Story (comments: none)
McObject and Probatus Technologies have announced a bundling partnership
that pairs an in-memory database system (IMDS) with a comprehensive,
professional-grade Linux development and operating environment.
Full Story (comments: none)
TechWeb
covers the
latest released of Red Hawk Linux. Based on Red Hat Linux, Red Hawk
replaces the kernel with a real-time version. Here's a
press
release from Concurrant, the company that bundles Red Hawk Linux with
it's hardware.
Comments (none posted)
Distribution reviews
ZDNet
reviews
Mandrake Linux version 9.0.
"
Some of the most significant tweaks to Mandrake Linux 9.0 are improvements to the desktop experience. MandrakeSoft has customized all of the various graphical user environments to have a consistent look and feel, a concept it calls "more homogeneity, less futility". This means, for example, that no matter what environment users are in, they have a similar set of menus for finding and running applications."
Comments (3 posted)
Here are a couple more reviews of Mandrake Linux 9.0. German site
LinuxGear has
this
review (in German). Also a Linux Orbit user has
published his first impressions.
Comments (none posted)
Page editor: Rebecca Sobol
Development
Version 0.0.4 of
JACK Meterbridge
has been released. A meter bridge is hardware assembly that
typically involves a row of audio meters that "bridge" across the top of
an audio mixing console.
JACK Meterbridge allows a number of software audio level meters to
be displayed on screen. The meters plug into the
JACK audio connection kit,
a software package that manages multiple connections to audio devices.
Jack Meterbridge currently has a selection of three meter styles,
two of them resemble classic mechanical meters, either peak-reading
or classic VU style, and one that is a vertical bar-graph style.
Jack Meterbridge is a good example of a virtual hardware device that
can be plugged in to JACK. No doubt, many other such devices such
as oscilloscopes, spectrum analyzers, and tuners could be programmed
to work with Jack. Hopefully, JACK will prove to be a good platform for
developing a wide variety of new virtual audio devices.
Comments (none posted)
System Applications
Database Software
Version 4.0.4-beta of the MySQL database has been released.
This is a bugfix release.
Full Story (comments: none)
Printing
LinuxPrinting.org
mentions
that Kyocera has released the PPD (Postscript Printer Description)
files for its PostScript printer line.
"
Kyocera released the PPD files for all their PostScript models under a MIT license, which means that they are free software now and so thay can be included distributions of GNU/Linux, put on web sites as linuxprinting.org, they can also be freely modified, for example to fix bugs or translate them."
Comments (none posted)
Web Site Development
The second beta version of
Mod_python
version 3.0 is available for Apache 2.
Comments (none posted)
The most recent headlines on the
Zope Members News
include: Basic CMF Product Released, ZopeTestCase 0.5.3 Released,
MailBoxer 2.0 released, Torped announces Easy Publisher 1.8,
Localizer 0.9.1 released, and Silva 0.8.4 released.
Comments (none posted)
Zope version 2.6.0 Beta 1
has been released.
new features include gzip content compression, signal handling, log
rotation, a new default view setting ability, an improved daemon mode,
better text indexing and object cache control,
automatic browser ID string embedding in URLs,
improvments to the BTree and Catalog code, lots of bug fixes, and more.
Comments (none posted)
Version 1.66 of
mnoGoSearch-php-extension, the PHP extension to the mnoGoSearch
web site search engine
is available.
Comments (none posted)
Desktop Applications
Audio Applications
Version 0.3.0 of
Maaate,
the Australian audio analysis toolkit, is available.
Click below for the full announcement. The companion
Bewdy
visualization tool is also available.
Full Story (comments: none)
Version 1.4.5 of the
WaveSurfer
sound visualization and manipulation tool has been released. The
changes
include new sound mixing functionality, several new time display
formats, bug fixes, and minor improvements.
Comments (none posted)
Desktop Environments
Topics on the GNOME desktop
FootNotes site include:
GNOME Summary - 2002-09-22 - 2002-09-28,
art.gnome.org released, GTK+ 2.1.0 Released, Gst-Player 0.4.1 released,
Film Gimp 0.4 released, Dropline GNOME 1.1.1, and more.
Comments (none posted)
Interoperability
Version 3.0alpha20 of
Samba
has been released for testing. The
WHATSNEW document contains a long list of changes.
Comments (none posted)
Issue #137 of the
Wine Weekly News is out. Topics include
A Wine status update, MS write support, a proposal for a developer CVS tree,
updating developer info, CreateProcessA() and environment settings,
and programming with Wine and COM.
Comments (none posted)
Office Applications
Issue #111 of the
AbiWord Weekly News is out.
"
This has certainly been a mixed week! With the new release of 1.0.3, a new meta-bug has been put in place. One example of things most recently caught, 4046 , where something went horribly wrong, and now spelling is all just fizzley if you're using the dialogue (right clicking individual words still works). The good news, however, is that Mark has already promised that 1.0.4 will come out much sooner compared to 1.0.3; preferably within a month."
Comments (none posted)
Issue #48 of
Kernel Cousin GNUe
covers the latest Gnu Enterprise development news.
Comments (none posted)
Web Browsers
Following last week's release of version 0.1, version 0.2 of the
lightweight Phoenix browser
has been released.
New features include web forms auto-complete, the return of the sidebar,
extension management, toolbar customization, a new search bar,
prefs support, speed enhancements, mousewheel font resizing, and bug fixes.
Comments (none posted)
Miscellaneous
A new version of the GNU Privacy Guard (gpg) has been released. Here is the
list
of changes. GnuPG 1.2.0 can be downloaded from one of the
*GnuPG mirror sites*.
Comments (4 posted)
Languages and Tools
Caml
This week, the new software on
The Caml Hump includes MLGraph, Combinator Engine, and toolpage.
Comments (none posted)
FORTRAN
Progress continues on the
G95 FORTRAN compiler
project.
"
Plan:
Finish the type resolution phase. There are a few things that g95 cannot currently handle, but most of the simpler things are implemented. Conforming fortran 77 programs should be parsed and resolved without difficulty. I have uploaded a Linux x86 binary in order that non-hackers can try g95 on their favorite bits of code and can make sure that that parser doesn't choke too bad."
Comments (none posted)
Java
Todd E. Sundsted
shows how to get around network obstacles using Java.
"
In this follow-up article to
"Restoring the transparent network",
Todd Sundsted focuses on techniques that Java applications can use to restore the appearance of network transparency in the face of many common types of network obstructions. This article provides a framework that Java applications can use to hide network obstructions from the higher-level parts of the application."
Comments (none posted)
Emmanuel Proulx writes about EJB inheritance on O'Reilly's ONJava site.
The article is divided into
part 1 and
part 2.
"
Entity beans are objects that represent data coming from a persistent store, such as a database. The key word here is objects. Entity beans encapsulate the data and business logic. But what about the two other principles, inheritance and polymorphism?"
Comments (none posted)
Lisp
Version 0.7.8 of SBCL (Steel Bank Common Lisp) has been released.
"
This version features a
Beta-quality port to the MIPS architecture under Linux, cleaned up compiler
handling of TYPE-ERRORs, improved argument type checking, optimization
changes, the new extension SB-DEBUG:BACKTRACE-AS-LIST and a number of bug
fixes."
Full Story (comments: none)
Perl
The September 23-29, 2002 edition of
This week on Perl 6 is out. Topics include:
Topics include Of Variables, Values and Vtables, IMCC 0.0.9.2,
Fun with intlists, Functions in Scheme, Perl6 on HP-UX 11.00,
The status of Leopold Toetsch's patches, Of PMCs Buffers and memory management,
Add Stone Age Exception Handling, and Meanwhile, in Perl 6.
Comments (none posted)
The 23-29 September 2002 edition of the
Perl-5 Porters Digest is out.
"
This was a nice week, with lots of discussion, on various interesting
topics. Read on for strange bugs, strange fixes, strange error messages,
and as always, the ongoing efforts made to improve Perl 5."
Comments (none posted)
Teodor Zlatanov
writes about genetic algorithms with Perl on IBM's developerWorks.
"
One of the more intriguing types of algorithm is the genetic algorithm. Genetic algorithms mimic Darwinian natural selection, where "fitness" selects individuals for survival, breeding, and, hence, adaptive mutation. I covered the background on this in a previous column, and I also showed two Perl implementations, one that bred bytes and another that bred words.
In this article, I cover more advanced material on genetic algorithms in Perl."
Comments (none posted)
Barrie Slaymaker
explains
how to use AxKit to make an image gallery.
"
AxKit is not limited to working with pure XML data. Starting with this article, we'll work with and around non-XML data by developing an image browser that works with two types of non-XML data: a directory listing built from operating system calls (file names and statistics) and image files. Furthermore, it will be built from small modules that you can adapt to your needs or use elsewhere, like the thumbnail generator or the HTML table wrapper."
Comments (none posted)
PHP
Week 105 of the
PHP Weekly Summary
is out:
"
Two years already! The 4.3.0 Release Cycle due to begin,
64 bit compatible PHP, and more."
Comments (none posted)
Python
This week the Python-URL looks at Puffin; Permutations, Combinations on
SourceForge; Python's XML and XML-RPC capabilities; Blog with Python; and
much more.
Full Story (comments: none)
This week's
Daily Python-URL
topics include epydoc, Probability And Statistics Utils for Python,
Kaa, Automation with Puffin, CAMFR 1.0, PyANT 0.26, and more.
Comments (none posted)
Ruby
Topics on this week's
Ruby Garden include
method ancestors for class Method, Things That Newcomers to Ruby
Should Know, and more.
Comments (none posted)
Topics on this week's
Ruby Weekly News
include
REXML 2.4.2 and 2.5.2, Ruby/CorporateTime 0.1.0, a Russian Ruby mailing list,
dbdbd 0.2, SuperHash, Net::GeoIP 0.01, XMLscan 0.1.0 RC1, ZenWeb 1.14.0,
ZenTest 1.0.1, Blogtari 0.0.2, "and" and "or" vs. && and ||,
Ruby - common pitfalls?, and a Ruby announcement list.
Comments (none posted)
Scheme
The September 30, 2002 edition of the Scheme Weekly News is out,
with the latest Scheme language development news.
Full Story (comments: none)
XML
Doug Tidwell
shows how to perform case-sensitive enumeration with XML on IBM's
developerWorks.
"
IBM's own XML ace Doug Tidwell offers one curious reader an automated solution for defining a case-insensitive enumeration that's straightforward, standards-compliant, and requires little work on the developer's part. Several code samples are included."
Comments (none posted)
Kendall Grant Clark
explains HLink on O'Reilly's XML.com.
"
On its face HLink is a very simple specification, even if, as Joe English and Tim Bray have noted, it amounts to a kind of rehabilitation of SGML's (infamously complex, as I recall) architectural forms extensions. The point of HLink is to provide a way of saying one or more of the following things: that (1) some elements or attributes within an XHTML markup language (or, better: within a namespace) are or can be treated as a hypertextual link; that (2) the functional semantics -- how the link behaves under various conditions -- are such and such; (3) that an attribute of some element which is a link has such and such an effect on its semantics."
Comments (none posted)
Uche Ogbuji
writes about
PyXML 0.8.1 on O'Reilly's XML.com site.
"
One of the things I'm going to do in these columns is provide brief information on significant new happenings relevant to Python-XML development, including significant software releases.
PyXML 0.8.1 has been released. Major changes include updated DOM support and the disabling of the bundled XSLT library from the default install."
Comments (none posted)
Miscellaneous
New versions of the omniORB and omniORBpy CORBA ORBs
have been released.
Comments (none posted)
Version 20020923 of
MLton has been released.
"
MLton is a whole-program optimizing compiler for the Standard ML programming language. MLton runs on X86 machines with Linux, FreeBSD, or Cygwin/Windows." The new version features major runtime
system improvements, support for FreeBSD, and bug fixes.
Comments (none posted)
Page editor: Forrest Cook
Linux in Business
Business News
The Board of Directors of the Open Source Initiative (OSI) approved two
licenses. These licenses, written by Larry Rosen, attorney for OSI, are
intended to be encapsulations of the best of their class of open source
licenses.
Full Story (comments: 13)
Here is
Red
Hat's press release announcing the availability of Red Hat
Linux 8.0. There's lots of new stuff in this release, of course,
including the controversial "Bluecurve" desktop, OpenOffice,
Apache 2.0, and more.
Comments (1 posted)
A large Italian tour operator is the first business to deploy
this
solution, which integrates the IBM X-Series server with Red Hat's Linux
operating system and Tarantella Enterprise 3 software.
Comments (none posted)
CMP Media's TechWeb Network
launched
The Open Enterprise, a news-and-analysis Web site devoted entirely to
open-source and standards-based software in a corporate setting.
"
The Open Enterprise's inaugural feature is "The Promise of the Open
Enterprise." The piece focuses on what it means to use open-source and
standards-based software in enterprise IT systems, how they change IT
practices and policies, how enterprise business technologists acquire
open-source software, and issues of deployment, architecture, cost-benefits
and risks."
Comments (none posted)
Press Releases
Open Source Announcements
Distributions and Bundled Products
Software for Linux
Products and Services Using Linux
Hardware with Linux support
Linux at Work
Java Products
Books and Documentation
Training and Certification
Trade Shows and Conferences
Partnerships
Investments and Acquisitions
Personnel and New Offices
Miscellaneous
Page editor: Rebecca Sobol
Linux in the news
Recommended Reading
LinuxDevices.com
covers
Project Blinkenlights' transformation of Tower T2 of the Bibliothèque
nationale de France into what is claimed to be the world's largest computer
screen. "
Arcade is the second (and largest) building-sized computer
screen created and installed by Project Blinkenlights. The first, unveiled
last year in honor of the 20th anniversary of the Chaos Computer Club, was
located at the famous Haus des Lehrers office building in Berlin. One
change since the earlier version is the ability to control the brightness
of each pixel, which results in a grayscale display that allows for
sophisticated, large-scale animations glowing into the Paris night
life."
Comments (8 posted)
News.com
reports on
professor Ed Felten's list of products that may be affected by Senator
Fritz Hollings' CBDTPA bill.
"
So far, Fritz's Hit List features a catalog of unlikely devices Felten said would be regulated under the law. They include common objects such as baby monitors and automobile navigation systems as well as seemingly innocuous toys such as the Shop With Me Barbie toy cash register, the Sony Aibo robot dog and Big Mouth Billy Bass."
Comments (none posted)
Linux Journal
writes about the California Community Colocation Project.
"
The California Community
Colocation Project, or CCCP, was launched in February 2002 as the
world's first formal non-profit to focus exclusively on the needs of
the not-for-profit colocation community. The CCCP is a project of the
Online Policy Group of San Francisco."
Comments (4 posted)
Trade Shows and Conferences
Wired
reports from the Lulu Tech Circus.
"
The OpenSaurus project's exhibit was also packed throughout the weekend. The OpenSaurus folks used Linux software and salvaged hardware to build bots that smashed up other old computers and assorted hardware."
Comments (none posted)
Companies
Will AOL be powered by Linux? According to this
TechWeb
article evaluations are under way. "
AOL Services has installed
56 IBM BladeCenter servers -- 14 "server-on-a-board" systems per chassis --
running Red Hat Linux 7.3 to route a portion of the Web traffic that's now
handled by its Unix-based back-end routing servers. If they deliver the
advantages in cost, scalability, and performance that Norman Koo expects,
AOL will replace all 800 Unix systems with blade servers during the next
five years. "Blades do more work, take up less space, and use less power,"
says Koo, executive director of corporate technology at AOL Time
Warner."
Comments (none posted)
TechWeb
covers HP's
entry into the Eclipse open-source consortium. "
The Eclipse project
is aiming to create an open-source "framework" that lets third-party
vendors "plug in" specialty development tools. The idea is to let
developers work within a single framework -- including things like user
interface and shared services like source-code management or debugging --
for all their development."
Comments (1 posted)
The Register
reports on Hewlett Packard's clusters, which run
Oracle's 9I Real Application Clusters (RACs) clustering software.
"
To prove that Linux is an option in the data center using
clusters, HP tested
an eight-node cluster of ProLiant DL580 servers, which use the Profusion
chipset co-developed by Compaq and Intel and which can scale to eight Pentium
III Xeon processors in a single system. The DL580s that HP tested used the
900MHz versions of the Pentium III Xeon processors, each equipped with 2MB of
L2 cache memory. Each node had 4GB of main memory, yielding a cluster with 64
processors and 128GB of main memory."
Comments (1 posted)
News.com
takes a quick
look at the latest release from MandrakeSoft. "
The new version
includes a "supermount" feature that lets programmers skip traditional
commands to access removable media such as CD-ROMs. It also has integrated
intrusion-detection tools and utilities, encrypted communications support,
encrypted file systems and secured authentication features."
Comments (none posted)
ZDNet
comments on Sun's latest Linux offering.
"
Sun's plan is to offer x86-based Linux machines built using off-the-shelf parts (put together in somebody else's garage, not Sun's) which will be sold in lots of 100. The generic hardware is complemented by a mostly generic array of Linux desktop software. The catch--besides having to buy these boxes in bunches of 100--is that you have to buy a server to go with them. So, essentially, Sun is ready to sell you 100 low-cost razors if you buy one of their blades."
Comments (none posted)
Business
The Economist
writes about Linux gains in the retailer market.
"
If IBM likes it, then it must be all right. That, at least, is what supporters of Linux, an operating system for computers, are hoping. Unlike Microsoft Windows, Linux holds no secrets for programmers. Its source codes can be read like an open book, which makes them easy to adapt to individual needs and cheaper to buy. After years in the doldrums as Microsoft forged ahead in market after market, Linux is making a comeback—and in an unexpected market.
Thanks to its stability as an operating system and the fact that it can be made secure, Linux is fast catching on among retailers."
Thanks to Thomas Blankenhorn.
Comments (1 posted)
ZDNet Australia
looks at the increasing use of Linux in the business world.
"
In recent years, Linux has proven itself a credible alternative server operating system, and application support has also improved greatly. These days, the question is not whether you can use Linux, but where you can best use it. Is there more to Linux than Apache and file and print serving?"
Comments (none posted)
iTnews
reports on
plans by the Australian government to investigate Linux.
"
Growing demand from government CIO's for critical Linux information has prompted Australia's peak IT advisory body to step in with plans to conduct a government sector Linux seminar by the end of the year.
The National Office of the Information Economy (NOIE) will invite departmental CIO's and chief technology officers to attend an in-depth enterprise Linux briefing."
Thanks to Con Zymaris.
Comments (none posted)
IBM's most
recent Linux
customers are covered by eWeek. "
[Regal Cinemas] is also testing
a new, in-theater, Linux-based kiosk that will enable movie patrons to
purchase tickets or retrieve tickets purchased from an online
service."
Comments (none posted)
Interviews
IBM's developerWorks features
an interview of David Mosberger on the future of Linux on IA-64.
"
David Mosberger has been a 64-bit Linux guy since day one. While pursuing a graduate degree at the University of Arizona in the early '90s, Mosberger led the Linux port to the Alpha processor and soon found that his Linux hobby was taking up as much time as his graduate work. He joined an Internet research group within Hewlett Packard in 1997, and a few years later the Swiss-born Mosberger jumped at the chance to contribute to the Itanium port (see Resources for a links to Mosberger's personal page and the IA-64 Linux project), where he is now lead kernel architect. Since 1988, he has written the first IA-64 back end for the GNU Compiler Collection (GCC), wrote much of the IA-64 toolchain support, and implemented much of the IA-64-specific parts of the Linux kernel."
Comments (none posted)
NewsForge
talks
with Guardian Digital's Dave Wreski. "
We are earning a living. A
lot is due to the Open Source model -- the services we're able to provide
are in conjunction with the software we've developed in association with
the work of thousands of programmers across the world."
Comments (none posted)
Resources
The September 26, 2002 edition of the LinuxDevices Embedded Linux
Newsletter is out, with the latest Embedded Linux news.
Full Story (comments: none)
Mugdha Vairagade
explains how to set up IP filtering with Linux 2.4.
"
The netfilter/iptables is the IP packet filtering system that is integrated with the latest 2.4.x versions of the Linux kernel. This system facilitates greater control over IP packet filtering and firewall configuration on Linux systems, be they systems connected to the Internet or a LAN, servers, or proxy servers interfacing between a LAN and the Internet. Mugdha Vairagade provides an introduction to the netfilter/iptables system, how it works, its advantages, installing and configuring, and how to use it to configure firewalls on Linux systems to filter IP packets."
Comments (none posted)
Gordon Miller
discusses sound
cards and the xspect power spectrum analyzer in this Linux Journal
article. "
Linux, however, has proven to be stable and well appointed
with program and documentation development packages. In particular, the OSS
sound driver for the Linux kernel (2.4.6 on my system) works well with SB16
type sound cards."
Comments (none posted)
In this Linux Journal article, Bruce Johnson
explains how
real-time data monitors differ from traditional debugging tools.
"
Historically, real-time data monitors were associated with
proprietary, real-time operating systems (RTOSes) and sometimes required
the use of special-purpose compilers. Today, however, real-time data
monitors are available for applications running under Linux and compiled
with standard GNU compilers. Consequently, many developers are beginning to
recognize the benefits of real-time data monitors not only in traditional
real-time applications but also in a wide variety of embedded and
general-purpose applications."
Comments (none posted)
Linux Journal
discusses CDRW
drives in Linux. "
I told the tech that I knew the drive wasn't
supported in Linux, but would it work? Immediately, I was told no. I
thanked him and tried again with a different technician, three times to be
exact, and each time I was told by a different person that the drive
wouldn't work. I figured I was being told it wouldn't work because they
didn't know the real answer and couldn't be bothered to check. Armed with
an educated guess and a sense of adventure, I purchased the drive."
Comments (none posted)
Reviews
News.com
covers the
release of Red Hat 8.0 and the Bluecurve desktop. "
Red Hat's
Bluecurve airbrushes out some differences between KDE and Gnome, altering
icons and menu selections KDE or Gnome users would otherwise see and making
them look the same."
Comments (none posted)
ZDNet
reviews some of the software that works with the Apache web server.
"
When most people hear the phrase "Apache," they think of the Apache Web server, also commonly referred to as "Apache HTTPD."
However, the Apache Software Foundation has a number of projects that are just as interesting as its flagship Web server."
Comments (1 posted)
Miscellaneous
Linux Journal has
an article that looks at one school's switch from the
proprietary VxWorks embedded operating system to Linux.
"
The recent introduction of Linux into the embedded sector has been one of
the most exciting changes in the last few years. Based on the open-source
model,
it offers new possibilities to embedded engineers traditionally used to
commercial
operating systems. At our university, EUSS, we train students
to develop embedded products. Until last year, our lectures and lab sessions
were based on a commercial real-time operating system. Now we use Linux, and
this fact has opened our minds and given us possibilities for a future
evolution."
Comments (none posted)
Here's
a Wired article
looking at where various people from the Linux Bubble Days have ended up. "
Another Red Hat founder who's recently landed a 'real job' is former CTO Marc Ewing, who is now founder and publisher of a glossy $12.50-per-issue climbing magazine called Alpinist, set to launch in November."
Comments (none posted)
Page editor: Forrest Cook
Announcements
Resources
Dan Kegel has written up
a
lengthy document on why universities should be teaching Linux to their
students. It's a very good start, but he's seeking feedback on ways to
make it more complete and convincing.
Comments (8 posted)
The Linux Professional Institute's LPI News-Letter
for September, 2002 is available.
Full Story (comments: none)
Linux Gazette Issue #83 (October, 2002) is now
available. It
includes articles on replicating Linux systems, "Qubism," DVD authoring,
and many other topics.
Comments (none posted)
The September 2002 Netcraft Web Server Survey has been released.
"
When counting by ip address, the supposed volatility of the past few
months disappears, with Apache showing a three percentage point
increase from 51% to 54% since the start of 2001, and Microsoft
unchanged at 35%."
Full Story (comments: none)
Upcoming Events
A Linux and software event will be held
in Luxemburg from October 1-3, 2002. Click below for the
full announcement (In French).
Full Story (comments: none)
The Raleigh, N.C. News and Observer
covers Robert Young's Lulu Technology Circus.
"
There will also be experts from all over the country who bring their
expertise about everything from personal digital assistants to building a
supercomputer using clusters of Linux PCs. Circus attendees can play advance
copies of interactive video games from local companies, build a robot out of
Legos, help edit a movie, listen to electronic music, learn how to burn a CD
and, for those with disc-jockey talent, win the latest professional digital
CD-player from Pioneer."
Comments (none posted)
The Open Group Conference in Cannes, France
will feature speeches by Jon "Maddog" Hall, Bruce Perens,
and Larry Rosen among others. The conference will be held on October 14.
Thanks to Andrew Josey.
Comments (none posted)
Registration for
Linux.conf.au
(Perth, January 22 to 25) is now
open.
Full Story (comments: none)
Four additional
MySQL Compact Seminars have been scheduled for late october in Germany.
Comments (none posted)
| Date | Event | Location |
| October 9 - 10, 2002 | Linux EXPO-UK 2002 | (Olympia 2)London, England |
| October 11 - 13, 2002 | V Congreso Hispalinux | San Sebastian-Donostia, Spain |
| October 14 - 16, 2002 | The Singapore Linux Conference 2002 | (Le Meridien Singapore)Singapore |
| October 14 - 15, 2002 | The Open Group Conference | (Hotel Martinez Palace)Cannes, France |
| October 17 - 18, 2002 | Open Source for E-Government | Washington, DC |
| October 24 - 25, 2002 | PHPCon 2002 | (The Clarion Hotel SFO)Millbrae, California |
| October 28 - 31, 2002 | International Lisp Conference 2002 - The Art of Lisp | San Francisco, CA |
| October 30 - 31, 2002 | Think-Linux, The Solutions Show | (The Pinnacle)Toledo OH |
| November 1 - 3, 2002 | 2nd Annual Ruby Conference(RubyConf 2002) | (Washington State Trade and Convention Center)Seattle, Washington |
| November 2, 2002 | Southern CaliforniA Linux Expo 2002(SCALE) | (Davidson Conference Center, University of Southern California)Los Angeles, CA |
| November 3 - 6, 2002 | International PHP 2002 conference | Frankfurt, Germany |
| November 3 - 8, 2002 | 16th System Administration Conference(Lisa '02) | Philadelphia, PA |
| November 14 - 15, 2002 | The Open Source Health Care Alliance(OSHCA) | (UCLA Medical Center)Los Angeles, CA |
| November 18 - 21, 2002 | Embedded Systems Conference, Boston | (Hynes Convention Center)Boston, Mass |
Comments (none posted)
Web sites
The
Gimp User Group has announced
the return of its online forum system.
Comments (none posted)
Software announcements
Here are the software announcements, courtesy of
Freshmeat.net. They are available in
two formats:
Comments (none posted)
Miscellaneous
Long time Linux proponent Jon "Maddog" Hall is now working for SGI,
click below for the announcement.
Full Story (comments: 6)
Page editor: Forrest Cook