Certain proprietary vendors have long liked to criticize Linux for its lack
of a "roadmap," a multi-year plan with release dates and included
features. Without such a roadmap, they say, customers have no idea where
the technology is going, cannot plan for the future, and have no assurance
that needed features and capabilities will be built into Linux.
This
Information Week article is the latest contribution to this debate; the
way the Linux kernel is developed, says the author, "
...makes it
even harder for technology professionals using Linux to plan around one
major release that's, say, 18 months down the road." The lack of a
roadmap is said to be a sign that the kernel development process has not
yet "grown up."
We contend, instead, that the lack of a PowerPoint-friendly release and
feature plan is a sign that the free software development process is
different - and better.
It would be interesting to ask the aforementioned "technology
professionals" how useful corporate roadmaps truly are - especially in the
software arena. Betting the company on another vendor's promised future
software releases seems risky at best. Relying on a vendor's claims for
software which is available now is dangerous enough; competent
"technology professionals" know that reality often fails to live up to
those claims. The only way to know whether a given software release will
work in a given situation is to try it, and trying it is difficult for
releases which exist only on a timeline in some roadmap.
Then again, Linux can be said to have a roadmap which can make reasonably
reliable predictions fairly far into the future. One need only look at the
projects which are being worked on now. With a bit of research, anybody
can see what features are contemplated, which of them work now, the amount
of development effort which is going into those features, whose priorities
are driving development, and more. So, for example,
one might make some reasonable predictions about future distributions by
looking at what the developers are doing today:
- They will almost certainly include enhanced security technologies,
including mandatory access control mechanisms and, perhaps, heavier
use of encrypted filesystems. SELinux looks likely to be the
technology deployed by many distributors, unless the ongoing
complexity issues end up forcing a shift to something else.
- The kernel will continue to scale to larger systems with more
processors, memory, and disks. Some additional scalability work will
be done for 32-bit systems, but the emphasis will be on using 64-bit
processors to the fullest extent. There will be improved support for
clustered filesystems, and, perhaps, for leading-edge, transactional
filesystems as well. Future hardware will be quickly supported as
long as the requisite information is made available to developers.
- The desktop experience will continue to improve, especially for
business users. The available applications will continue to develop
quickly, and future distributions will include advanced search
capabilities. More home-oriented applications, including personal
finance, high-end games, Feng Shui garden layout assistants, etc. will
be rather slower to develop.
And so on. Predictions of this sort are somewhat unreliable, but they are
nonetheless far more trustworthy than a corporate marketing department's
rendition of an otherwise obscure development process.
Roadmaps can also force a company to ship what it promised, rather than
what is best. Imagine if IBM were in charge of the Linux kernel, and that
IBM had promised that 2.6 would include its own EVMS volume management
software. Can you imagine IBM subsequently announcing that EVMS would be
passed over for inclusion because the developers like the device mapper
code better? If you make promises about future releases, you have to at
least try to live up to those promises. It is hard to switch to an idea
which turns out to be better in practice without losing credibility.
Without this ability to make decisions based on what actually works and is
maintainable, the free software development process would be weaker.
The final problem is that the free software development model is resistant
to central planning in general. Linus Torvalds can express his vision and
desire for future kernel developments, but he is unable (and unwilling) to
force anybody to work on those developments. The community makes its own
decisions about what it thinks is important. The results are often
surprising, but the success of Linux so far makes it clear that they are
meeting somebody's needs. Trying to impose a roadmap on this
process is unlikely to improve it.
Comments (32 posted)
With the release of
Inkscape 0.40,
we decided to take a look at the latest release and get up to speed with
the status of the project. Inkscape started as a fork of the
Sodipodi project, but has evolved into
a robust project in its own right.
Inkscape is a drawing tool that uses the Scalable Vector Graphics (SVG)
specification for its native format, and also exports to PNG, as well as
saving in Adobe Illustrator format, PostScript, Encapsulated PostScript and
PovRay formats. Inkscape will open or import graphics from Adobe
Illustrator and Dia, other programs' SVG documents and a wide array of
bitmap graphics formats. Inkscape runs on Linux, Windows and Mac OS X.
We installed the Inkscape static RPM on a SUSE 9.2 system to see what the
program is capable of, and whether Inkscape was stable and feature-complete
enough for productive use. The Inkscape download
page on SourceForge includes source packages, RPMs and Windows
binaries.
To test Inkscape we started off by creating basic shapes using
Inkscape's rectangle and ellipse tools and fiddling with color fills,
stroke styles, rotation and so forth just to get a feel for Inkscape's
tools. It took about fifteen minutes for this writer to get comfortable
with the Inkscape interface.
With an application like Inkscape, using a mouse (or tablet) is almost
unavoidable. However, Inkscape's shortcut keys allow the user to perform a
lot of actions, such as selecting different tools or raising and lowering
an object from one layer to another, from the keyboard -- rather than
having to grab the mouse to switch between tools or adjust layers. For
example, to toggle the current tool from Inkscape's path tool to the select
tool, all that's necessary is to hit the space bar or F1. To move an object
up one layer, simply hit "Page Up" or "Page Down" to move it lower.
Speaking of layers, layer management is one of the major new features in
Inkscape with the 0.40 release, according to the release
notes.
Another new feature in 0.40 is a "text-on-path" feature. This allows the
user to conform text to a path -- which is useful for creating interesting
logos and other artwork that requires text to wrap text to a shape other
than a rectangle. The feature is certainly easy to use. All that's required
is to select a path and the text object that is to conform to the
path. Rectangles, ellipses and other objects must be converted to a path
before the user can wrap text to fit that object. By manipulating that
object, the user can change the flow of the text even if the text has been
removed from the object or if the object is "invisible" because there is no
fill color or stroke color associated with the object. The only thing we
couldn't figure out was how to specify a starting point on a path for the
text.
We also enjoyed Inkscape's "Trace Bitmap" feature, which allows the user to
trace an imported bitmap. By importing a photo or other bitmap, it's
possible to create an scalable object that can then be turned into paths or
otherwise edited in Inkscape. Inkscape has incorporated the potrace utility for this. The
trace bitmap feature works best with line art, but can be used to produce
some fun effects with photos or other artwork.
Inkscape's performance and stability are excellent. We created a number of
documents using Inkscape, exported our documents and some of the Inkscape
tutorials to PNG, EPS and PS, and didn't see any glitches. The program
never crashed while we were testing, and all of the features that are
currently in Inkscape seem to work as advertised. We did notice that some
detail was lost when exporting to EPS from the tutorials, but this may not
be an Inkscape limitation.
Though Inkscape doesn't have a full user manual at this stage, it does
include several useful tutorials for basic and advanced concepts when
working with Inkscape, as well as an excellent man page. It also features
an "Elements of Design" document, which may be useful for users who lack a
background in art and design. The Inkscape interface also features context
help for most tools as well as context-sensitive tips in the bottom status
bar.
For the most part, this writer found the interface to be straightforward
and intuitive. The "Vacuum Defs" item under the File menu was a bit of a
puzzler at first, though it was finally determined that it was for removing
unused information from the defs tags in a document. We
presume this is a good thing.
Some of Inkscape's functions can be used without even needing to start the
Inkscape GUI. For example, inkscape file.svg -e file.png will
convert an SVG file to a PNG. This can be particularly useful for users who
wish to convert a number of SVG files into PNG format.
SVG experts can edit an SVG document directly, if they so choose, by using
Inkscape's built-in XML editor. Very few users will be likely to need this
tool, but it's there for those who need or want to edit a document's
elements directly.
Inkscape may not be at the same level of functionality as Adobe Illustrator
or Corel Draw, but it's certainly capable of creating some excellent
graphics -- even if this writer isn't quite up to the task of fully
exploiting its potential. With other open source applications like The Gimp and Scribus, Linux is a serious contender
for users who are looking for a desktop publishing platform.
Comments (10 posted)
Sun has
submitted a new license (the
"Common Development and Distribution License" or CDDL) to the Open Source
Initiative's license-discuss mailing list. This license, derived from the
Mozilla Public License, may (or may not) be what Sun chooses to use for its
possible open-source Solaris release, so it is worth a look.
This license is GPL-like in its intent, but (as Sun acknowledges up front)
it is not compatible with the GPL. There are certain extra terms in the
CDDL which, while not necessarily objectionable in their own right,
conflict with the GPL's "no additional restrictions" terms. This
incompatibility came as a surprise to few people; nobody has ever expected
Sun to encourage the mixing of Solaris and Linux kernel code.
The CDDL licenses the copyrights in the code for use, distribution, and
modification - the usual free software rights. It also contains a patent
grant, but here the language is a bit more constrained:
(b) under Patent Claims infringed by the making, using or
selling of Original Software, to make, have made, use,
practice, sell, and offer for sale, and/or otherwise
dispose of the Original Software (or portions thereof).
In other words, the CDDL does not license any patents for use in derived
products. Other terms in the license suggest that Sun is concerned about
patent infringements caused by modifications, but the above exclusion is
not restricted to such infringements.
The license requires that anybody distributing the code in binary form make
the associated source available under the CDDL. The license says nothing
about how the source must be made available; in theory, one could satisfy
the license by requiring people to pick up the source in person at one's
Mongolian software distribution center. Interestingly, the license
allows the binaries themselves to be distributed under any license, so long
as (1) the source is available under the CDDL, and (2) the person
distributing binaries under a different license indemnifies the copyright
holders for any liabilities.
Unlike the GPL, the CDDL allows developers to make modifications to the
license text itself (for their own code).
The CDDL contains patent defense language: if you sue a copyright holder
for patent infringement, you can lose your rights to use the code under the
license. In any patent litigation settlement talks, the value of the
patent license granted by the CDDL must be taken into account -
essentially, the party initiating the lawsuit loses any patent license
granted by the CDDL. There is one other strange term:
6.4. In the event of termination under Sections 6.1 or 6.2 above,
all end user licenses (excluding distributors and resellers) that
have been validly granted by You or any distributor hereunder prior
to termination (excluding licenses granted to You by any
distributor) shall survive termination.
So if you are a software distributor, and you got the code from somebody
who later turns around and sues Sun, you can lose your rights to the
software under the license.
The discussion has been relatively muted; there seems to be an early
consensus that the license, possibly with some small tweaks, is, indeed, a
free software license. It will probably get the stamp of approval that Sun
seeks. What Sun will then do with this license remains to be seen,
however.
Comments (7 posted)
Page editor: Jonathan Corbet
Security
One of the biggest fringe benefits of writing book reviews is that
publishers are happy to send you samples of their wares. Sometimes they
![[cover]](/images/ns/intro-comp-sec.jpg)
are a little too enthusiastic; your editor has been buried under books on
.NET programming, XML for legacy business applications, DBA certification,
and more. The pile of such books threatens to fall over and make a big
mess in the otherwise immaculate LWN.net data center. When an envelope
showed up with a book called
Introduction to Computer Security (by
Matt Bishop), it almost joined that pile. Your editor hardly needs another
book on password policies, anti-virus software, and attachment filtering.
Consigning this book to that pile would have been a mistake, however.
"Introduction" might be an accurate description of this book, but only with
a suitable understanding of the target audience: this book could serve for
an introductory, graduate-level course for security researchers. People
looking for ways to lock down their Windows boxes will not find it here;
if, instead, you want to argue about the theoretical limitations of the
type enforcement model with the SELinux folks, you're in the right place.
Chapter 1 (available online
(PDF)) starts with the real introduction, where a number of important
terms are defined: integrity, confidentiality, availability, assurance,
etc. Chapter 2 gets into protection models, access matrices, and
state transitions. Chapter 3 turns up the rigor by proving some
theorems on whether a given system can be proven to be safe or not.
The fourth chapter gets into security policies, and makes some interesting
distinctions: a "military" policy is one oriented primarily around
confidentiality, while a "commercial" policy is aimed at integrity.
Chapter 5 goes military with a more detailed look at confidentiality
policies, with more theorems and a look at mandatory access control.
Integrity policies are covered in the following chapter; a few integrity
models are introduced. Chapter 7 addresses the fact that most
organizations want both integrity and confidentiality by looking at
hybrid models: chinese walls, etc.
Then the focus shifts to cryptography. Chapter 8 is a whirlwind
introduction, starting with basic ciphers and progressing through DES,
public key encryption, and more. The crucial problem of key management is
chapter 9's topic; chapter 10 looks at ciphers in more detail.
There is some discussion there about how ciphers and network stacks can be
brought together, ending with an overview of IPSec. Chapter 11 is
about authentication; here your editor got his discussion of password
policies after all, though in a bit more depth than usual.
Chapter 12 gets into design principles for secure systems: least privilege,
fail-safe defaults, complete mediation, open design (with a discussion of
DeCSS), etc. Chapter 13 looks at identity representations,
certificates, and anonymity, and chapter 14 returns to access control
mechanisms in more detail.
The book then gets into a more serious look at information flow and how it
might be controlled in a secure system. Chapter 16 moves on to
confinement - keeping processes within their defined boundaries; it looks
at virtual machines, sandboxes, and the covert channel problem.
Chapter 17 is an introduction to assurance - how one can be reasonably
sure that a given system meets its security criteria. Then an introduction
to evaluation techniques is given: TCSEC, FIPS, Common Criteria, etc.
After those dry chapters, chapter 19 ("malicious logic") is a relatively
fun look at malware: trojan horses, viruses, worms, and how to defend
against them. Chapter 20 is on vulnerability analysis, penetration
testing, flaw models, etc. with a number of real-world examples. The next
two chapters look at auditing and intrusion detection. Then follows a
series of relatively high-level chapters on network, system, user, and
program security techniques - firewalls, user policies, programming
techniques, and more. The book finishes up with some background material
(lattices, virtual machines) and a 63-page, 968-entry bibliography.
Introduction to Computer Security is an intense reading experience.
Interestingly, this book can be seen as a watered-down version of another
book by the same author: Computer
Security: Art and Science. According to the introduction,
Introduction to Computer Security is a shorter book (a mere 750
pages) with much of the mathematical formalism left out. For most readers,
however, the shortened version is likely to be enough - and to be an
important resource for anybody who wishes to truly understand what secure
computing means.
Comments (4 posted)
New vulnerabilities
hpsockd: missing input sanitizing
| Package(s): | hpsockd |
CVE #(s): | CAN-2004-0993
|
| Created: | December 3, 2004 |
Updated: | December 8, 2004 |
| Description: |
"infamous41md" discovered a buffer overflow condition in hpsockd, the
socks server written at Hewlett-Packard. An exploit could cause the
program to crash or may have worse effect. |
| Alerts: |
|
Comments (none posted)
imlib: buffer overflows in image decoding
| Package(s): | imlib |
CVE #(s): | CAN-2004-1026
|
| Created: | December 6, 2004 |
Updated: | January 13, 2005 |
| Description: |
Pavel Kankovsky discovered that several overflows found in the libXpm
library also applied to imlib. He also fixed a number of other potential
flaws. A remote attacker could entice a user to view a carefully-crafted
image file, which would potentially lead to execution of arbitrary code
with the rights of the user viewing the image. This affects any program
that makes use of the imlib library. |
| Alerts: |
|
Comments (none posted)
mirrorselect: insecure temporary file creation
| Package(s): | mirrorselect |
CVE #(s): | |
| Created: | December 7, 2004 |
Updated: | December 8, 2004 |
| Description: |
Ervin Nemeth discovered that mirrorselect creates temporary files in
world-writable directories with predictable names. A local attacker could
create symbolic links in the temporary files directory, pointing to a valid
file somewhere on the filesystem. When mirrorselect is executed, this would
result in the file being overwritten with the rights of the user running
the utility, which could be the root user. |
| Alerts: |
|
Comments (none posted)
rssh, scponly: unrestricted command execution
| Package(s): | rssh, scponly |
CVE #(s): | |
| Created: | December 3, 2004 |
Updated: | December 8, 2004 |
| Description: |
Jason Wies discovered that when receiving an authorized command from an
authorized user, rssh and scponly do not filter command-line options
that can be used to execute any command on the target host. Using a
malicious command, it is possible for a remote authenticated user to
execute any command (or upload and execute any file) on the target machine
with user rights, effectively bypassing any restriction of scponly or
rssh. See
this Bugtraq post for more details. |
| Alerts: |
|
Comments (none posted)
viewcvs settings not honored
| Package(s): | viewcvs |
CVE #(s): | CAN-2004-0915
|
| Created: | December 6, 2004 |
Updated: | December 28, 2004 |
| Description: |
Hajvan Sehic discovered several vulnerabilities in viewcvs, a utility
for viewing CVS and Subversion repositories via HTTP. When exporting
a repository as a tar archive the hide_cvsroot and forbidden settings
were not honored. |
| Alerts: |
|
Comments (none posted)
Updated vulnerabilities
a2ps: input validation error
| Package(s): | a2ps |
CVE #(s): | CAN-2004-1170
CAN-2004-1377
|
| Created: | November 26, 2004 |
Updated: | December 19, 2005 |
| Description: |
The GNU a2ps utility fails to properly sanitize filenames, which can be
abused by a malicious user to execute arbitrary commands with the
privileges of the user running the vulnerable application. More
information at Security
Focus. |
| Alerts: |
|
Comments (none posted)
apache: arbitrary code execution
| Package(s): | apache |
CVE #(s): | CAN-2004-0940
|
| Created: | October 29, 2004 |
Updated: | December 14, 2004 |
| Description: |
According to an Apache
announcement, a vulnerability exists in the Apache HTTP server, version
1.3. The problem is a potential buffer overflow in the "get_tag" function
of Apache's SSI module "mod_include". It allows local users who can create
SSI documents to execute arbitrary code as the Apache run-time user via SSI
documents that trigger a content length calculation error. |
| Alerts: |
|
Comments (none posted)
aspell: bounds checking problem
| Package(s): | aspell |
CVE #(s): | CAN-2004-0548
|
| Created: | June 17, 2004 |
Updated: | December 20, 2004 |
| Description: |
Aspell's word-list-compress utility fails to properly check bounds
when dealing with words that are more than 256 bytes long.
This can lead to arbitrary code execution by an attacker. |
| Alerts: |
|
Comments (none posted)
BNC: Buffer overflow vulnerability
| Package(s): | bnc |
CVE #(s): | |
| Created: | November 16, 2004 |
Updated: | December 1, 2004 |
| Description: |
Leon Juranic discovered that BNC fails to do proper bounds checking
when checking server response. An attacker could exploit this to cause a
Denial of Service and potentially execute arbitrary code with the
permissions of the user running BNC. |
| Alerts: |
|
Comments (none posted)
cdrecord: failure to drop privilege
| Package(s): | cdrecord |
CVE #(s): | CAN-2004-0806
|
| Created: | September 8, 2004 |
Updated: | February 21, 2005 |
| Description: |
The cdrecord utility, which is installed setuid on some distributions, fails to drop privilege before running a user-specified program. |
| Alerts: |
|
Comments (none posted)
ncompress: Buffer overflow
| Package(s): | compress uncompress ncompress |
CVE #(s): | CAN-2001-1413
|
| Created: | October 11, 2004 |
Updated: | December 14, 2004 |
| Description: |
compress and uncompress do not properly check bounds on command line
options, including the filename. Large parameters would trigger a buffer
overflow. By supplying a carefully crafted filename or other option, an
attacker could execute arbitrary code on the system. A local attacker could
only execute code with his own rights, but since compress and uncompress
are called by various daemon programs, this might also allow a remote
attacker to execute code with the rights of the daemon making use of
ncompress. |
| Alerts: |
|
Comments (none posted)
cyrus-imap: multiple remote vulnerabilities
| Package(s): | cyrus-imap |
CVE #(s): | CAN-2004-1012
CAN-2004-1013
|
| Created: | November 23, 2004 |
Updated: | December 3, 2004 |
| Description: |
Several vulnerabilities have been found in
Cyrus IMAP Server <= 2.2.8 that could allow remote execution of arbitrary
code. |
| Alerts: |
|
Comments (none posted)
cyrus-sasl: remote buffer overflow
| Package(s): | cyrus-sasl |
CVE #(s): | CAN-2004-0884
|
| Created: | October 7, 2004 |
Updated: | March 16, 2005 |
| Description: |
cyrus-sasl has a vulnerability involving a buffer overflow
in the digestmda5.c file. A remote attacker may be able
to compromise the system. Also, a local user may be able to
exploit a vulnerability by using the SASL_PATH environment
variable. |
| Alerts: |
|
Comments (none posted)
dhcp: format string vulnerability
| Package(s): | dhcp |
CVE #(s): | CAN-2004-1006
|
| Created: | November 4, 2004 |
Updated: | July 13, 2005 |
| Description: |
Dhcp has a format string vulnerability in the log functions of dhcp 2.x
that may be exploited via a malicious DNS server. |
| Alerts: |
|
Comments (none posted)
Filename disclosure vulnerability in fam
| Package(s): | fam |
CVE #(s): | CAN-2002-0875
|
| Created: | August 19, 2002 |
Updated: | January 5, 2005 |
| Description: |
"fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible. |
| Alerts: |
|
Comments (none posted)
flim: insecure file creation
| Package(s): | flim |
CVE #(s): | CAN-2004-0422
|
| Created: | May 5, 2004 |
Updated: | December 16, 2004 |
| Description: |
The emacs "flim" mode creates temporary files in an insecure fashion, possibly allowing a local attacker to overwrite files. |
| Alerts: |
|
Comments (none posted)
Foomatic: Arbitrary command execution in foomatic-rip
| Package(s): | foomatic |
CVE #(s): | CAN-2004-0801
|
| Created: | September 20, 2004 |
Updated: | May 31, 2006 |
| Description: |
There is a vulnerability in the foomatic-filters package. This
vulnerability is due to insufficient checking of command-line parameters
and environment variables in the foomatic-rip filter. This vulnerability
may allow both local and remote attackers to execute arbitrary commands on
the print server with the permissions of the spooler. |
| Alerts: |
|
Comments (none posted)
FreeRADIUS: denial of service
| Package(s): | freeradius |
CVE #(s): | CAN-2004-0938
CAN-2004-0960
CAN-2004-0961
|
| Created: | September 22, 2004 |
Updated: | February 2, 2005 |
| Description: |
FreeRADIUS (through version 1.0.1) suffers from several denial of service vulnerabilities in its packet reception code. |
| Alerts: |
|
Comments (none posted)
gaim: buffer overflow in MSN protocol
| Package(s): | gaim |
CVE #(s): | CAN-2004-0891
|
| Created: | October 25, 2004 |
Updated: | February 11, 2005 |
| Description: |
A buffer overflow in the MSN protocol handler for gaim 0.79 to 1.0.1 allows
remote attackers to cause a denial of service (application crash) and
possibly execute arbitrary code via an "unexpected sequence of MSNSLP
messages" that results in an unbounded copy operation that writes to the
wrong buffer. |
| Alerts: |
|
Comments (none posted)
Gallery: cross-site scripting vulnerability
| Package(s): | Gallery |
CVE #(s): | CAN-2004-1106
|
| Created: | November 8, 2004 |
Updated: | January 17, 2005 |
| Description: |
Jim Paris has discovered a cross-site scripting vulnerability in
Gallery. By sending a carefully crafted URL, an attacker can inject and
execute script code in the victim's browser window, and potentially
compromise the users gallery. |
| Alerts: |
|
Comments (none posted)
gtk2, gdk-pixbuf: buffer overflows
| Package(s): | gdk-pixbuf gtk2 |
CVE #(s): | CAN-2004-0753
CAN-2004-0782
CAN-2004-0783
CAN-2004-0788
|
| Created: | September 15, 2004 |
Updated: | February 25, 2005 |
| Description: |
The gdk-pixbuf and gtk2 libraries contain vulnerabilities in their handling of BMP and XPM files which can lead to denial of service and, potentially, code execution attacks. |
| Alerts: |
|
Comments (none posted)
gettext: Insecure temporary file handling
| Package(s): | gettext |
CVE #(s): | CAN-2004-0966
|
| Created: | October 11, 2004 |
Updated: | March 1, 2006 |
| Description: |
gettext insecurely creates temporary files in world-writeable directories
with predictable names. A local attacker could create symbolic links in
the temporary files directory, pointing to a valid file somewhere on the
filesystem. When gettext is called, this would result in file access with
the rights of the user running the utility, which could be the root user. |
| Alerts: |
|
Comments (1 posted)
ghostscript: symlink vulnerabilities
| Package(s): | ghostscript |
CVE #(s): | CAN-2004-0967
|
| Created: | October 20, 2004 |
Updated: | September 28, 2005 |
| Description: |
The ghostscript package (prior to version 7.07.1-r7) contains several scripts which are vulnerable to symlink attacks. |
| Alerts: |
|
Comments (none posted)
glibc: Information leak with LD_DEBUG
| Package(s): | glibc |
CVE #(s): | CAN-2004-1453
|
| Created: | August 17, 2004 |
Updated: | May 26, 2005 |
| Description: |
Silvio Cesare discovered a potential information leak in glibc. It allows
LD_DEBUG on SUID binaries where it should not be allowed. This has various
security implications, which may be used to gain confidential information.
An attacker can gain the list of symbols a SUID application uses and their
locations and can then use a trojaned library taking precedence over those
symbols to gain information or perform further exploitation. |
| Alerts: |
|
Comments (1 posted)
glibc: tempfile vulnerability in catchsegv script
| Package(s): | glibc |
CVE #(s): | CAN-2004-0968
|
| Created: | October 21, 2004 |
Updated: | November 14, 2005 |
| Description: |
The catchsegv script in the glibc package has a symlink vulnerability
that may allow a local user to overwrite arbitrary
files with the permissions of the user that is running the script. |
| Alerts: |
|
Comments (none posted)
gnome-vfs: backend script vulnerabilities
| Package(s): | gnome-vfs |
CVE #(s): | CAN-2004-0494
|
| Created: | August 4, 2004 |
Updated: | February 21, 2005 |
| Description: |
Several scripts packaged with gnome-vfs, using its "extfs" capability, have security flaws. These scripts tend not to be used on many systems, but their presence can still be a threat. |
| Alerts: |
|
Comments (none posted)
groff: insecure temporary directory
| Package(s): | groff |
CVE #(s): | CAN-2004-0969
|
| Created: | November 1, 2004 |
Updated: | February 9, 2006 |
| Description: |
Recently, Trustix Secure Linux discovered a vulnerability in the groff
package. The utility "groffer" created a temporary directory in an
insecure way, which allowed exploitation of a race condition to create
or overwrite files with the privileges of the user invoking the
program. |
| Alerts: |
|
Comments (none posted)
gtkhtml: malformed messages cause crash
| Package(s): | gtkhtml |
CVE #(s): | CAN-2003-0133
CAN-2003-0541
|
| Created: | April 14, 2003 |
Updated: | April 18, 2005 |
| Description: |
GtkHTML is the HTML rendering widget used by the Evolution mail reader.
GtkHTML supplied with versions of Evolution prior to 1.2.4 contain a bug
when handling HTML messages. Alan Cox discovered that certain malformed
messages could cause the Evolution mail component to crash. |
| Alerts: |
|
Comments (none posted)
gzip: insecure temporary files
| Package(s): | gzip |
CVE #(s): | CAN-2004-0970
|
| Created: | November 8, 2004 |
Updated: | December 7, 2004 |
| Description: |
Trustix developers discovered insecure temporary file creation in
supplemental scripts in the gzip package which may allow local users
to overwrite files via a symlink attack. |
| Alerts: |
|
Comments (none posted)
ImageMagick: EXIF buffer overflow
| Package(s): | ImageMagick |
CVE #(s): | CAN-2004-0981
|
| Created: | November 8, 2004 |
Updated: | December 8, 2004 |
| Description: |
ImageMagick fails to do proper bounds checking when handling image
files with EXIF information. An attacker could use an image file with
specially-crafted EXIF information to cause arbitrary code execution with
the permissions of the user running ImageMagick. See this advisory for more
information. |
| Alerts: |
|
Comments (none posted)
imlib2: buffer overflows
| Package(s): | imlib2 |
CVE #(s): | CAN-2004-0802
CAN-2004-0817
|
| Created: | September 8, 2004 |
Updated: | October 26, 2005 |
| Description: |
The imlib2 library contains buffer overflows in the BMP handling code. |
| Alerts: |
|
Comments (none posted)
iproute: local denial of service
| Package(s): | iproute net-tools |
CVE #(s): | CAN-2003-0856
|
| Created: | November 25, 2003 |
Updated: | December 14, 2004 |
| Description: |
The iproute utility is susceptible to spoofed netlink messages sent by local users, with the result that denial of service attacks are possible. |
| Alerts: |
|
Comments (none posted)
iptables: missing initialization
| Package(s): | iptables |
CVE #(s): | CAN-2004-0986
|
| Created: | November 1, 2004 |
Updated: | February 11, 2005 |
| Description: |
Faheem Mitha noticed that the iptables command, an administration tool for
IPv4 packet filtering and NAT, did not always load the required modules on
its own as it was supposed to. This could lead to firewall rules not being
loaded on system startup. This caused a failure in connection with rules
provided by lokkit at least. |
| Alerts: |
|
Comments (none posted)
kernel: vulnerabilities in the smb file system
Comments (1 posted)
kernel-utils: setuid vulnerability
| Package(s): | kernel-utils |
CVE #(s): | CAN-2003-0019
|
| Created: | February 7, 2003 |
Updated: | January 21, 2005 |
| Description: |
The kernel-utils package contains several utilities that can be used to
control the kernel or machine hardware. In Red Hat Linux 8.0 this package
contains user mode linux (UML) utilities.
The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was
incorrectly shipped setuid root. This could allow local users to control
certain network interfaces, add and remove arp entries and routes, and put
interfaces in and out of promiscuous mode.
All users of the kernel-utils package should update to these packages that
contain a version of uml_net that is not setuid root.
Alternatively, as a work-around to this vulnerability issue the following
command as root:
chmod -s /usr/bin/uml_net |
| Alerts: |
|
Comments (none posted)
libgd2: buffer overflows in PNG handling
| Package(s): | libgd2 |
CVE #(s): | CAN-2004-0990
CAN-2004-0941
|
| Created: | October 29, 2004 |
Updated: | June 28, 2006 |
| Description: |
Several buffer overflows have been discovered in libgd's PNG handling
functions.
If an attacker tricked a user into loading a malicious PNG image, they
could leverage this into executing arbitrary code in the context of
the user opening image. Most importantly, this library is commonly
used in PHP. One possible target would be a PHP driven photo website
that lets users upload images. Therefore this vulnerability might lead
to privilege escalation to a web server's privileges.
Multiple buffer overflows in the gd graphics library (libgd) 2.0.21 and
earlier may allow remote attackers to execute arbitrary code via malformed
image files that trigger the overflows due to improper calls to the
gdMalloc function. |
| Alerts: |
|
Comments (none posted)
libpng: multiple vulnerabilities
Comments (1 posted)
libxml2 - arbitrary code execution
| Package(s): | libxml2 |
CVE #(s): | CAN-2004-0110
|
| Created: | February 26, 2004 |
Updated: | August 19, 2009 |
| Description: |
Yuuichi Teranishi discovered a flaw in libxml2 versions prior to 2.6.6.
When fetching a remote resource via FTP or HTTP, libxml2 uses special
parsing routines. These routines can overflow a buffer if passed a very
long URL. If an attacker is able to find an application using libxml2 that
parses remote resources and allows them to influence the URL, then this
flaw could be used to execute arbitrary code. |
| Alerts: |
|
Comments (none posted)
libxml2: multiple buffer overflows
| Package(s): | libxml2 |
CVE #(s): | CAN-2004-0989
|
| Created: | October 28, 2004 |
Updated: | August 19, 2009 |
| Description: |
libxml2 prior to version 2.6.14 has multiple buffer overflow
vulnerabilities, if a local user passes a specially crafted
FTP URL, arbitrary code may be executed. |
| Alerts: |
|
Comments (none posted)
libxpm4: stack and integer overflows
| Package(s): | libxpm4 |
CVE #(s): | CAN-2004-0687
CAN-2004-0688
|
| Created: | September 16, 2004 |
Updated: | February 14, 2005 |
| Description: |
There are several stack and integer overflow bugs in
the libXpm code of XFree86 that may be used for a denial of service. |
| Alerts: |
|
Comments (none posted)
logcheck: symlink vulnerability
| Package(s): | logcheck |
CVE #(s): | CAN-2004-0404
|
| Created: | April 21, 2004 |
Updated: | December 22, 2004 |
| Description: |
The logcheck utility handles temporary files in an unsafe way, possibly allowing local attackers to overwrite files. |
| Alerts: |
|
Comments (none posted)
lvm10: creates insecure temporary directory
| Package(s): | lvm10 |
CVE #(s): | CAN-2004-0972
|
| Created: | November 1, 2004 |
Updated: | July 25, 2005 |
| Description: |
Trustix Secure Linux discovered a vulnerability in a supplemental script of
the lvm10 package. The program "lvmcreate_initrd" created a temporary
directory in an insecure way, which could allow a symlink attack to create
or overwrite arbitrary files with the privileges of the user invoking the
program. |
| Alerts: |
|
Comments (none posted)
Midnight Commander: extfs vfs vulnerability
| Package(s): | mc |
CVE #(s): | CAN-2004-0494
|
| Created: | September 2, 2004 |
Updated: | January 5, 2005 |
| Description: |
Midnight Commander has a vfs vulnerability with shell quoting
in extfs perl scripts. |
| Alerts: |
|
Comments (none posted)
mikmod: buffer overflow
| Package(s): | mikmod |
CVE #(s): | CAN-2003-0427
|
| Created: | June 16, 2003 |
Updated: | June 16, 2005 |
| Description: |
Ingo Saitz discovered a bug in mikmod whereby a long filename inside
an archive file can overflow a buffer when the archive is being read
by mikmod. |
| Alerts: |
|
Comments (none posted)
mozilla products: arbitrary code execution and other vulnerabilities
| Package(s): | mozilla firefox thunderbird |
CVE #(s): | CAN-2004-0902
CAN-2004-0903
CAN-2004-0904
CAN-2004-0905
CAN-2004-0908
|
| Created: | September 20, 2004 |
Updated: | January 13, 2005 |
| Description: |
Several vulnerabilities exist in the Mozilla web browser and derived
products, the most serious of which could allow a remote attacker to
execute arbitrary code on an affected system. See the CERT advisory for details. |
| Alerts: |
|
Comments (none posted)
mpg123: buffer overflow bug
| Package(s): | mpg123 |
CVE #(s): | CAN-2004-0805
|
| Created: | September 16, 2004 |
Updated: | January 11, 2005 |
| Description: |
The mpg123 audio playing utility has a buffer overflow
bug that may allow arbitrary execution of code. |
| Alerts: |
|
Comments (none posted)
mpg321: format string vulnerability
| Package(s): | mpg321 |
CVE #(s): | CAN-2003-0969
|
| Created: | January 6, 2004 |
Updated: | March 28, 2005 |
| Description: |
A vulnerability was discovered in mpg321, a command-line mp3 player,
whereby user-supplied strings were passed to printf(3) unsafely. This
vulnerability could be exploited by a remote attacker to overwrite
memory, and possibly execute arbitrary code. In order for this
vulnerability to be exploited, mpg321 would need to play a malicious
mp3 file (including via HTTP streaming). |
| Alerts: |
|
Comments (none posted)
mysql: several vulnerabilities
| Package(s): | mysql |
CVE #(s): | CAN-2004-0835
CAN-2004-0836
CAN-2004-0837
|
| Created: | October 11, 2004 |
Updated: | April 6, 2005 |
| Description: |
Several problems have been discovered in MySQL. Oleksandr Byelkin noticed
that ALTER TABLE ... RENAME checks CREATE/INSERT rights of the old table
instead of the new one. (CAN-2004-0835) Lukasz Wojtow noticed a buffer
overrun in the mysql_real_connect function. (CAN-2004-0836) Dean Ellis
noticed that multiple threads ALTERing the same (or different) MERGE tables
to change the UNION can cause the server to crash or stall. (CAN-2004-0837) |
| Alerts: |
|
Comments (none posted)
netkit-telnet: invalid free pointer
| Package(s): | netkit-telnet |
CVE #(s): | CAN-2004-0911
|
| Created: | October 4, 2004 |
Updated: | March 28, 2005 |
| Description: |
Michal Zalewski discovered a bug in the netkit-telnet server (telnetd)
whereby a remote attacker could cause the telnetd process to free an
invalid pointer. This causes the telnet server process to crash, leading
to a straightforward denial of service (inetd will disable the service if
telnetd is crashed repeatedly), or possibly the execution of arbitrary code
with the privileges of the telnetd process (by default, the 'telnetd'
user). |
| Alerts: |
|
Comments (none posted)
netpbm: insecure temporary files
| Package(s): | netpbm |
CVE #(s): | CAN-2003-0924
|
| Created: | January 19, 2004 |
Updated: | December 29, 2004 |
| Description: |
netpbm is graphics conversion toolkit made up of a large number of
single-purpose programs. Many of these programs were found to create
temporary files in an insecure manner, which could allow a local
attacker to overwrite files with the privileges of the user invoking a
vulnerable netpbm tool. |
| Alerts: |
|
Comments (1 posted)
nfs-utils: denial of service
| Package(s): | nfs-utils |
CVE #(s): | CAN-2004-1014
|
| Created: | December 1, 2004 |
Updated: | May 15, 2005 |
| Description: |
The NFS statd server contains a denial of service vulnerability which is easily exploited by a remote attacker. |
| Alerts: |
|
Comments (none posted)
Open DC Hub: remote code execution
| Package(s): | opendchub |
CVE #(s): | |
| Created: | November 29, 2004 |
Updated: | December 1, 2004 |
| Description: |
Donato Ferrante discovered a buffer overflow vulnerability in the
RedirectAll command of the Open DC Hub. Upon exploitation, a remote user
with administrative privileges can execute arbitrary code on the system
running the Open DC Hub. See this
advisory. |
| Alerts: |
|
Comments (none posted)
openssl: der_chop script temp file vulnerability
| Package(s): | openssl |
CVE #(s): | CAN-2004-0975
|
| Created: | November 11, 2004 |
Updated: | July 19, 2005 |
| Description: |
The der_chop script in openssl has a temp file vulnerability that may allow
an attacker to overwrite arbitrary files with the permissions that
the script is running under. |
| Alerts: |
|
Comments (1 posted)
OpenSSL: denial of service vulnerabilities
Comments (1 posted)
perl: insecure temp file creation
| Package(s): | perl |
CVE #(s): | CAN-2004-0976
|
| Created: | November 2, 2004 |
Updated: | December 7, 2004 |
| Description: |
Trustix Secure Linux has discovered some vulnerabilities in the perl
package. The utility "instmodsh", the Perl package "PPPort.pm", and several
test scripts (which are not shipped and only used during build) created
temporary files in an insecure way, which could allow a symlink attack to
create or overwrite arbitrary files with the privileges of the user
invoking the program, or building the perl package, respectively. |
| Alerts: |
|
Comments (none posted)
php: remotely exploitable memory errors
| Package(s): | php |
CVE #(s): | CAN-2004-0594
|
| Created: | July 14, 2004 |
Updated: | February 7, 2005 |
| Description: |
Stefan Esser has issued an advisory regarding a
remotely exploitable hole in PHP (through version 4.3.7). If the
memory_limit feature is in use (as it should be, to prevent denial
of service attacks), allocation failures can be forced at highly
inopportune times, and those failures can be exploited to execute arbitrary
code. The exploit is described as "quite easy," and it can be done
regardless of whether Apache1 or Apache2 is in use. Upgrading to PHP 4.3.8 fixes the
problem; yesterday's PHP 5.0 release also contains the fix (but the
final release candidate did not). |
| Alerts: |
|
Comments (none posted)
phpbb: input sanitizing
| Package(s): | phpbb |
CVE #(s): | |
| Created: | December 1, 2004 |
Updated: | December 1, 2004 |
| Description: |
phpBB fails to sanitize input properly; this vulnerability may be exploited by a remote attacker to execute arbitrary code. Version 2.0.11 contains the fix. |
| Alerts: |
|
Comments (none posted)
phpMyAdmin: cross-site scripting
| Package(s): | phpMyAdmin |
CVE #(s): | CAN-2004-1055
|
| Created: | November 29, 2004 |
Updated: | December 1, 2004 |
| Description: |
Cedric Cochin has discovered
multiple cross-site scripting vulnerabilities in phpMyAdmin. These
vulnerabilities can be exploited through the PmaAbsoluteUri parameter, the
zero_rows parameter in read_dump.php, the confirm form, or an error message
generated by the internal phpMyAdmin parser. By sending a
specially-crafted request, an attacker can inject and execute malicious
script code, potentially compromising the victim's browser. |
| Alerts: |
|
Comments (none posted)
phpWebSite: HTTP response splitting
| Package(s): | phpWebSite |
CVE #(s): | |
| Created: | November 26, 2004 |
Updated: | December 1, 2004 |
| Description: |
phpWebSite
is vulnerable to HTTP response splitting attacks. A malicious user
could inject arbitrary response data, leading to content spoofing, web
cache poisoning and other cross-site scripting or HTTP response splitting
attacks. |
| Alerts: |
|
Comments (none posted)
PostgreSQL: Insecure temporary file use in make_oidjoins_check
| Package(s): | PostgreSQL |
CVE #(s): | CAN-2004-0977
|
| Created: | October 18, 2004 |
Updated: | December 20, 2004 |
| Description: |
The make_oidjoins_check script insecurely creates temporary files in
world-writeable directories with predictable names. A local attacker could
create symbolic links in the temporary files directory, pointing to a valid
file somewhere on the filesystem. When make_oidjoins_check is called, this
would result in file overwrite with the rights of the user running the
utility, which could be the root user. |
| Alerts: |
|
Comments (none posted)
ProZilla: Multiple vulnerabilities
| Package(s): | ProZilla |
CVE #(s): | CAN-2004-1120
|
| Created: | November 23, 2004 |
Updated: | February 1, 2005 |
| Description: |
ProZilla contains several exploitable buffer overflows in the code handling
the network protocols. A remote attacker could setup a malicious server
and entice a user to retrieve files from that server using ProZilla. This
could lead to the execution of arbitrary code with the rights of the user
running ProZilla. |
| Alerts: |
|
Comments (none posted)
qt3: BMP image parser heap overflow
| Package(s): | qt3/qt3-non-mt/qt3-32bit/qt3-static |
CVE #(s): | CAN-2004-0691
CAN-2004-0692
CAN-2004-0693
|
| Created: | August 19, 2004 |
Updated: | May 15, 2005 |
| Description: |
A heap overflow in the qt3 BMP image format parser in Qt versions prior to 3.3.3 may allow remote code execution. |
| Alerts: |
|
Comments (none posted)
rp-pppoe, pppoe: missing privilege dropping
| Package(s): | rp-pppoe, pppoe |
CVE #(s): | CAN-2004-0564
|
| Created: | October 4, 2004 |
Updated: | November 15, 2005 |
| Description: |
Max Vozeler discovered a vulnerability in pppoe, the PPP over Ethernet
driver from Roaring Penguin. When the program is running setuid root
(which is not the case in a default Debian installation), an attacker
could overwrite any file on the file system. |
| Alerts: |
|
Comments (none posted)
ruby: infinite loop
| Package(s): | ruby |
CVE #(s): | CAN-2004-0983
|
| Created: | November 8, 2004 |
Updated: | May 15, 2005 |
| Description: |
The upstream developers of Ruby have corrected a problem in the CGI
module for this language. Specially crafted requests could cause an
infinite loop and thus cause the program to eat up cpu cycles. |
| Alerts: |
|
Comments (none posted)
samba: remote DoS vulnerability
| Package(s): | samba |
CVE #(s): | CAN-2004-0930
CAN-2004-0882
|
| Created: | November 8, 2004 |
Updated: | December 1, 2004 |
| Description: |
According to this Samba advisory a remote
attacker could cause an smbd process to consume abnormal amounts of system
resources due to an input validation error when matching filenames
containing wildcard characters. Versions of Samba 3.0.x up to and
including 3.0.7 are vulnerable.
There is also an advisory about possible
buffer overruns in smbd. |
| Alerts: |
|
Comments (none posted)
sharutils: arbitrary code execution
| Package(s): | sharutils |
CVE #(s): | CAN-2004-1772
|
| Created: | October 1, 2004 |
Updated: | April 26, 2005 |
| Description: |
sharutils contains two buffer overflows. Ulf Harnhammar discovered a buffer
overflow in shar.c, where the length of data returned by the wc command is
not checked. Florian Schilhabel discovered another buffer overflow in
unshar.c. An attacker could exploit these vulnerabilities to execute
arbitrary code as the user running one of the sharutils programs. |
| Alerts: |
|
Comments (none posted)
sox: buffer overflow
| Package(s): | sox |
CVE #(s): | CAN-2004-0557
|
| Created: | July 28, 2004 |
Updated: | February 21, 2005 |
| Description: |
Sox suffers from buffer overflows in its WAV file handling; these overflows could conceivably be exploited by way of a malicious sound file. |
| Alerts: |
|
Comments (none posted)
SpamAssassin: Denial of Service vulnerability
| Package(s): | spamassassin |
CVE #(s): | CAN-2004-0796
|
| Created: | August 9, 2004 |
Updated: | August 11, 2005 |
| Description: |
SpamAssassin contains an unspecified Denial of Service vulnerability. By
sending a specially crafted message an attacker could cause a Denial of
Service attack against the SpamAssassin service. |
| Alerts: |
|
Comments (none posted)
SquirrelMail: cross-site scripting
| Package(s): | squirrelmail |
CVE #(s): | CAN-2004-1036
|
| Created: | November 17, 2004 |
Updated: | December 23, 2004 |
| Description: |
Squirrelmail (through version 1.4.3a-r2) suffers from yet another cross-site scripting vulnerability. |
| Alerts: |
|
Comments (none posted)
Subversion: Remote heap overflow
| Package(s): | subversion |
CVE #(s): | CAN-2004-0413
|
| Created: | June 11, 2004 |
Updated: | March 7, 2005 |
| Description: |
Subversion has a remote Denial of Service vulnerability
that may allow a server that runs svnserve to execute
arbitrary code. See this advisory for more information. |
| Alerts: |
|
Comments (none posted)
sudo: environment variable sanitizing
| Package(s): | sudo |
CVE #(s): | CAN-2004-1051
|
| Created: | November 17, 2004 |
Updated: | May 15, 2005 |
| Description: |
Versions of sudo prior to 1.6.8p2 fail to properly sanitize the environment prior to running shell scripts; this failure can be exploited by a sudo user to subvert scripts and obtain shell access. See the 1.6.8p2 announcement for more information. |
| Alerts: |
|
Comments (none posted)
sun-jre: Java plugin vulnerability
| Package(s): | sun-jre |
CVE #(s): | CAN-2004-1029
|
| Created: | November 26, 2004 |
Updated: | December 1, 2004 |
| Description: |
Jouko Pynnonen reported
a vulnerability in the plugin mechanism which allows remote attackers to
bypass the Java sandbox through the use of javascript. |
| Alerts: |
|
Comments (none posted)
File overwrite vulnerability in tar and unzip
| Package(s): | tar unzip |
CVE #(s): | CAN-2001-1267
CAN-2001-1268
CAN-2001-1269
CAN-2002-0399
|
| Created: | October 1, 2002 |
Updated: | April 10, 2006 |
| Description: |
The tar utility does not properly filter file names containing
"../", meaning that a hostile archive can, if unpacked by an
unsuspecting user, overwrite any file that is writable by that user. GNU
tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42
has the same vulnerability. |
| Alerts: |
|
Comments (1 posted)
tiff: buffer overflows
| Package(s): | tiff |
CVE #(s): | CAN-2004-0803
|
| Created: | October 13, 2004 |
Updated: | April 12, 2005 |
| Description: |
The tiff library contains several buffer overflows which may be exploited
by way of maliciously-crafted image files. See this advisory for more information. |
| Alerts: |
|
Comments (none posted)
TWiki: input sanitizing
| Package(s): | twiki |
CVE #(s): | CAN-2004-1037
|
| Created: | December 1, 2004 |
Updated: | December 1, 2004 |
| Description: |
The TWiki search function does not properly sanitize input, enabling a remote attacker to execute arbitrary commands. |
| Alerts: |
|
Comments (1 posted)
unarj: buffer overflow vulnerability
| Package(s): | unarj |
CVE #(s): | CAN-2004-0947
|
| Created: | November 11, 2004 |
Updated: | February 2, 2005 |
| Description: |
The unarj uncompression utility has a buffer overflow vulnerability
from handling long file names in an archive. An attacker can
cause unarj to crash or execute arbitrary code. |
| Alerts: |
|
Comments (none posted)
WordPress: HTTP response splitting and XSS vulnerabilities
| Package(s): | wordpress |
CVE #(s): | |
| Created: | October 14, 2004 |
Updated: | December 20, 2004 |
| Description: |
WordPress is vulnerable to HTTP response splitting and cross-site scripting
attacks, due to the lack of input validation in the administration panel
scripts. A malicious user could inject arbitrary response data, leading to
content spoofing, web cache poisoning and other cross-site scripting or
HTTP response splitting attacks. This could result in compromising the
victim's data or browser. |
| Alerts: |
|
Comments (none posted)
wv: buffer overflow
| Package(s): | wv |
CVE #(s): | CAN-2004-0645
|
| Created: | July 14, 2004 |
Updated: | February 10, 2005 |
| Description: |
wv, a viewer for MS Word files, contains a buffer overflow which may be exploited by a suitably-crafted file. Version 1.0.0-r1 fixes the problem. |
| Alerts: |
|
Comments (none posted)
XChat 2.0.x SOCKS5 Vulnerability
| Package(s): | xchat |
CVE #(s): | CAN-2004-0409
|
| Created: | April 19, 2004 |
Updated: | November 15, 2005 |
| Description: |
XChat is vulnerable to a stack overflow that may allow a remote attacker to
run arbitrary code. The SOCKS 5 proxy code in XChat is vulnerable to a
remote exploit. Users would have to be using XChat through a SOCKS 5
server, enable SOCKS 5 traversal which is disabled by default and also
connect to an attacker's custom proxy server. This vulnerability may allow
an attacker to run arbitrary code within the context of the user ID of the
XChat client. |
| Alerts: |
|
Comments (none posted)
xine-lib: buffer overflows
| Package(s): | xine-lib |
CVE #(s): | CAN-2004-1379
|
| Created: | September 22, 2004 |
Updated: | April 10, 2006 |
| Description: |
xine-lib (through version 1_rc6) contains buffer overflows in the subtitle parsing and DVD sub-picture decoder code. |
| Alerts: |
|
Comments (none posted)
xine-ui - insecure temporary file creation
| Package(s): | xine-ui |
CVE #(s): | CAN-2004-0372
|
| Created: | April 6, 2004 |
Updated: | April 27, 2006 |
| Description: |
Shaun Colley discovered a problem in xine-ui, the xine video player
user interface. A script contained in the package to possibly remedy
a problem or report a bug does not create temporary files in a secure
fashion. This could allow a local attacker to overwrite files with
the privileges of the user invoking xine. |
| Alerts: |
|
Comments (none posted)
xorg-x11: integer overflows
| Package(s): | xorg-x11 |
CVE #(s): | CAN-2004-0914
|
| Created: | November 18, 2004 |
Updated: | September 12, 2005 |
| Description: |
The X.Org libXpm library has several integer overflow vulnerabilities
An attacker can modify XPM images to execute malicious code. |
| Alerts: |
|
Comments (none posted)
xpdf: integer overflows
| Package(s): | xpdf kpdf cupsys |
CVE #(s): | CAN-2004-0888
CAN-2004-0889
|
| Created: | October 21, 2004 |
Updated: | February 18, 2005 |
| Description: |
Several xpdf integer overflow vulnerabilities can be exploited via a
mal-formed PDF document. Similar vulnerabilities can be found in kpdf and
in cupsys which share code. Additional information can be found in this KDE security advisory. |
| Alerts: |
|
Comments (none posted)
yardradius: buffer overflow
| Package(s): | yardradius |
CVE #(s): | CAN-2004-0987
|
| Created: | November 26, 2004 |
Updated: | December 1, 2004 |
| Description: |
Max Vozeler noticed that yardradius, the YARD radius authentication
and accounting server, contained a stack overflow similar to the one
from radiusd which is referenced as
CAN-2001-0534. This could lead to the execution of arbitrary code as
root. |
| Alerts: |
|
Comments (none posted)
zgv: multiple buffer overflows
| Package(s): | zgv |
CVE #(s): | |
| Created: | November 8, 2004 |
Updated: | December 14, 2004 |
| Description: |
Multiple arithmetic overflows have been detected in the image
processing code of zgv. An attacker could entice a user to open a
specially-crafted image file, potentially resulting in execution of
arbitrary code with the rights of the user running zgv. See this BugTraq advisory
for more information. |
| Alerts: |
|
Comments (none posted)
zip: arbitrary code execution
| Package(s): | zip |
CVE #(s): | CAN-2004-1010
|
| Created: | November 5, 2004 |
Updated: | February 2, 2005 |
| Description: |
HexView discovered a buffer overflow in the zip package. The overflow is
triggered by creating a ZIP archive of files with very long path
names. This vulnerability might result in execution of arbitrary code with
the privileges of the user who calls zip. This flaw may lead to privilege
escalation on systems which automatically create ZIP archives of user
supplied files, like backup systems or web applications. |
| Alerts: |
|
Comments (1 posted)
zlib: denial of service
| Package(s): | zlib |
CVE #(s): | CAN-2004-0797
|
| Created: | August 25, 2004 |
Updated: | June 10, 2005 |
| Description: |
Versions 1.2.x of the zlib library contain an error handling vulnerability which can enable denial of service attacks. |
| Alerts: |
|
Comments (none posted)
Resources
OpenPMF/M3 (a framework which allows for site-wide
management of security policies) has been released under the GPL; click
below for the details.
Full Story (comments: none)
Page editor: Jonathan Corbet
Kernel development
Brief items
The current 2.6 prepatch is 2.6.10-rc3,
announced by Linus on December 3.
Changes since -rc2 include the un-deprecation of
MODULE_PARM() (it
is generating too many warnings, and the fixes will not be merged before
2.6.10), a new major number (180) for the "ub" USB storage driver, some x86
single-stepping fixes, a large number of "sparse" annotations, the
token-based memory management fix, a memory
technology device (and JFFS2) update, a frame buffer device update, some
user-mode Linux patches, some page allocator tuning, and a few architecture
updates. See
the long-format changelog for
the details.
Linus's BitKeeper repository currently holds a DVB update and a set of bug
fixes. Very few patches are being accepted currently as the kernel hackers
try to stabilize things for the final 2.6.10 release.
Andrew Morton has released no -mm patches over the last week.
The current bugfix patch from Alan Cox is 2.6.9-ac13.
The current 2.4 prepatch remains 2.4.29-pre1; Marcelo has released
no prepatches since November 25.
Comments (2 posted)
Kernel development news
That's the problem with C++; it is far too easy to misuse. And with a
project as big as the Linux Kernel, and with as many contributors as
the Linux Kernel, at the end of the day, it's all about damage
control. If we depend on peer review to understand whether or not a
patch is busted, it is rather important that something as simple as
a = b + c;
does what we think it does, and not something else because someone has
overloaded the '+' operator. Or God help us, as I have mentioned
earlier, the comma operator.
-- Ted Ts'o
Comments (27 posted)
James Morris has
posted an
article on recent SELinux performance improvements. "
The use of
RCU solved a serious scalability problem with the AVC, thanks to the work
of Kaigai and the RCU developers. It seems likely to be a useful approach
for dealing with similar problems, and specifically with some of the
SELinux networking code as mentioned."
Comments (none posted)
Beyond doubt, many LWN readers have been concerned with how page fault
performance might be improved on their 512-processor desktop systems.
Christoph Lameter has been working on the answer for some months now;
his
page fault scalability patches are reaching a point where they will likely
be considered for inclusion after 2.6.10 comes out. This patch is an
interesting example of the kind of changes which must be made to support
large numbers of processors.
One of the virtual memory subsystem's core data structures is struct
mm_struct. This structure tracks the virtual address space used by
one or more processes. It contains pointers to the page tables, to the
virtual memory area (VMA) structures, and more. Processes typically have
their own struct mm_struct, but threads which share memory also
share the same mm_struct.
Access to this structure is serialized by two mechanisms. A semaphore
(mmap_sem) controls access to the mm_struct structure
itself, and a spinlock (page_table_lock) guards the page tables.
When the status of a page must be changed in the page tables, the kernel
must first take the page_table_lock to avoid creating confusion
with the other processors on the system. When he looked at the scalability
of the kernel's page fault handling code, Christoph identified this lock as
a problem. When many processors are trying to simultaneously make changes
to a single set of page tables, they end up spending a lot of time
busy-waiting for the page table lock. Improving the performance of this
code thus requires reducing the use of that lock.
The first step in this process is a patch which causes the VM
subsystem to hold page_table_lock for shorter periods of time.
The lock is dropped for portions of the code which have no need of it, and
later reacquired if needed. It is a fairly straightforward exercise in
lock breaking which helps scalability, but does not solve the whole
problem.
The core of the patch is a set of atomic page
table entry functions which can modify individual PTEs with no locking
required. Rather than acquiring page_table_lock, making a PTE
change, then dropping the lock, the kernel can simply make a call to:
int ptep_cmpxchg(struct vm_area_struct *vma, unsigned long address,
pte_t *ptep, pte_t oldval, pte_t newval);
This function uses the cmpxchg instruction (or whatever variant or
emulation may be available, depending on the architecture) to compare the
page table entry pointed to by ptep with oldval; if the
two match, the entry is set to newval and oldval is
returned. If the two do not match, the current thread lost a race with
another processor which changed the PTE first; in that case, the PTE is
not modified further and the function returns zero. Kernel code which uses
cmpxchg typically will retry a modification when this sort of race
occurs; Christoph's code, instead, is able to assume that the competing
thread did the same thing as the one it raced against: marked the page as
being present in memory. So no retries are needed.
With that change, pages can be brought into the working set and made
available without having to take the page_table_lock - except for
one last place. The mm_struct structure contains two fields
(rss and anon_rss) which track the total number of
in-memory pages referenced
by this address space (the "resident set size"). When a page is brought in
(or forced out), these fields must be incremented or decremented
accordingly. Access to rss and anon_rss is controlled by
page_table_lock. Getting rid of that last use of the lock has
required a surprising amount of work on Christoph's part.
The first implementation turned the RSS fields into atomic_t
variables, so that they could be operated on without locking. This solution
worked, but it had some shortcomings: (1) they could only be
32-bit variables, since not all architectures support 64-bit atomic types,
(2) the atomic operations are still relatively expensive,
and (3) having all processors on the system updating a single pair of
variables caused a great deal of cache line bouncing, which hurt
performance.
The next attempt was called "sloppy_rss." Essentially, the sloppy approach
retains the old unsigned long type for rss and
anon_rss, and simply
updates them without the lock. The result is incorrect RSS
values, but Christoph noted that the errors tended not to exceed 1%. This
approach is faster than using atomic operations. The incorrect values
bugged some developers, however, and the cache bouncing problem remained.
Another approach which was to do away with the RSS counters entirely, on the
theory that these values were not actually needed very often. When an attempt
to query the resident set size was made (generally by reading files in
/proc from user space), the kernel would scan through the
process's page tables and count the number of resident pages. This idea
did not get very far, however; the cost of querying RSS values was simply
too high.
The current approach was suggested by Linus
last month. A new set of counters is added to the task structure;
when a thread brings a page into memory, that thread's counters are
incremented accordingly. When a real RSS value is needed, the per-thread
values are summed to yield the answer. So querying the RSS still requires
a loop, but iterating through a list of tasks is much faster than walking
an entire set of page tables. This algorithm avoids locking issues (since
each thread takes care of its own page fault accounting and does not
contend with others); it also minimizes
the cache line problems. The "split RSS" approach still requires
rss and anon_rss counters in the mm_struct
itself; they are used to track
pages brought in by threads which have since exited, and they are decremented
when pages are forced out. This change also requires that RCU be used when
freeing the mm_struct structure to ensure that no other processor
is still trying to calculate an RSS value.
The current version of the patch has convinced
Linus, so expect it to go in at some point. The biggest roadblock, at
this point, may be that the four-level page table patch is at the front of
the queue for 2.6.11. That patch currently conflicts with Christoph's
work, and, in general, has made it hard for other VM work to get done.
Once the four-level patch goes into the mainline, however, things should
stabilize somewhat - at least, from the point of view of hackers working on
other VM-related patches.
Comments (1 posted)
It was asked recently: is the 2.6.10 release coming sometime soon? Andrew
Morton
replied that the
latter part of December looked like when it might happen. He also noted
that he is trying to produce a higher-quality release this time around:
We need to be be achieving higher-quality major releases than we
did in 2.6.8 and 2.6.9. Really the only tool we have to ensure
this is longer stabilisation periods.
Andrew also noted that getting people to test anything other than the final
releases is hard, with the result that many bugs are only reported after a
new "stable" kernel is out. If things don't get better, says Andrew, it
may be necessary to start doing point releases (e.g. 2.6.10.1) for the
final stabilization steps. Alternatively, the kernel developers could
switch to a new sort of even/odd scheme, so that 2.6.11 would be a new
features release, and 2.6.12 would be bug fixes only.
Much of the discussion, however, centered around regression testing. If
only there were more automated testing, the reasoning goes, fewer bugs
would make it into final kernel releases. This wish may eventually come
true, but, for now, it appears that regression testing is not as helpful as
many would like.
OSDL has pointed out that it
runs a whole set of tests every day. The problem, they say, is getting
people to actually look at the results. It may be that not enough people
know about OSDL's work, and, for that reason, the output is not being
used. But it also may be that the testing results are simply not that
useful.
Consider this posting from Andrew Morton on
regression testing:
However I have my doubts about how useful it will end up being.
These test suites don't seem to pick up many regressions.... We
simply get far better coverage testing by releasing code, because
of all the wild, whacky and weird things which people do with their
computers. Bless them.
The test suites, it seems, are not testing for the right things. One could
argue that the test suites simply have not, yet, been developed to the
point where they are performing comprehensive testing of the kernel. This
gap could be slowly filled in by having kernel bug fixes be accompanied by
new tests which verify that the bug remains fixed. Much of the code in the
kernel, however, is hardware-specific, and that code is where a lot of bugs
tend to be found. Hardware-specific code can only be tested in the
presence of the hardware in question. Outfitting a testing lab with even a
fraction of the hardware supported by Linux would be a massively expensive
undertaking.
So the wider Linux community is likely to remain the testing lab of last
resort for the kernel; the community as a whole, after all, does have all
that hardware. And the truth of the matter is that helping with testing is
part of the cost of free software (and of the proprietary variety as
well). So the best results might be had by trying to get more widespread
testing earlier in the process. Getting Linus to distinguish between
intermediate and release candidate kernels might help in that regard. If
that can't be done, then, perhaps, going with point releases may be
required.
Comments (8 posted)
Certain parts of the kernel, it seems, can be tweaked forever; I/O
schedulers would count as one of those parts. Linux has three of them
currently (plus a no-op scheduler), and its block I/O performance is
generally quite good. But that doesn't mean it can't be improved.
Jens Axboe recently decided to do some more hacking on his "completely fair
queueing" (CFQ) scheduler; the result is the new time-sliced CFQ scheduler, which has since
seen a second third fourth revision. The CFQ scheduler has always
tried to divide the bandwidth of each block device fairly among the
processes performing I/O to that device; the time-sliced version goes
further by giving each process exclusive access to the device for a period
of time.
In particular, the time-sliced scheduler picks a process, and dispatches
only that process's requests to the device for some tens of milliseconds.
The device is allowed to go idle for a few milliseconds if all of the
selected process's requests have been satisfied, with the idea that
the process may generate more requests within that window. If those
requests don't come, that process's time slice ends. Later revisions of
the patch check to see whether the given process is actually likely to run
within the idle window, and preempt the slice immediately if the answer is
"no."
Jens claims some very good results for the
new scheduler. The bandwidth numbers are nearly as good as those obtained
with the anticipatory scheduler (AS), while the maximum latency is much
less. These results may not be surprising; Jens has borrowed code from AS, and the idle window
has a similar effect to the brief I/O stalls used by AS to improve read
bandwidth.
As the I/O schedulers poach the best ideas from each other,
they may well become more alike.
The use of time slices may also improve the locality of
accesses to the drive, reducing the amount of time lost to seeks.
The new CFQ scheduler has spawned a low-key debate over which scheduler
should be used by default. The default scheduler currently is AS, but some
people (Andrea Arcangeli in particular) are
saying that it should be CFQ instead. SUSE apparently already makes CFQ
the default scheduler for its enterprise kernel. Andrew Morton is unsure;
AS still seems to be better for desktop systems and IDE disks. Even so, he
is ready to consider a change in the
default scheduler:
That being said, yeah, once we get the time-sliced-CFQ happening,
it should probably be made the default, at least until AS gets
fixed up. We need to run the numbers and settle on that.
The AS scheduler has already seen one improvement: a fix for a bug that
caused horrible performance for processes doing direct writes. Expect
other changes as AS hacker Nick Piggin works at improving its performance.
However this friendly competition turns out, better disk I/O performance
for Linux users will be part of it.
Comments (4 posted)
Patches and updates
Kernel trees
Core kernel code
Development tools
Device drivers
Documentation
Filesystems and block I/O
Janitorial
Memory management
Architecture-specific
Security-related
Miscellaneous
Page editor: Jonathan Corbet
Distributions
News and Editorials
We continue our series of articles on AMD64 ports of various distributions
with a brief look at
Fedora Core 3.
Based on product reviews and user experiences as expressed on various
mailing lists and forums, version 3 is probably the best Fedora release to
date. The distribution comes with the very latest kernel, X.Org, GNOME and
KDE, the developers seem to have resolved most of the reported issues with
SELinux, and the distribution feels polished and generally well-designed.
Although not without its flaws, of course, but still a solid and innovative
product worthy of an install, even if you prefer another distribution.
After downloading the 2.5 GB x86_64 ISO image, we burned it onto a DVD, and
proceeded with installation. For the record, here are the system
specifications: AMD64 3500+ processor (2.2GHz), K8N Neo2 (Socket939)
mainboard from Micro-Star International, 1 GB of DDR SDRAM, 2 x 120 GB
Maxtor hard disks, Plextor PX-712A DVD/CD Rewritable Drive, and NVIDIA
GeForce4 Ti 4600 graphics card. Although we chose to install a complete
workstation with both GNOME and KDE, as well as all server applications,
the installation completed in under 15 minutes. There are no obvious
differences between installing Fedora's x86_64 port and its i386
counterpart and once you reboot into your new system, you might be
wondering whether this operating system has really been optimized for your
64-bit processor.
We were wondering too, so we decided to take a look at how many of the
available Fedora RPMs were compiled for x86_64 systems. Looking through the
RPM directories, we found that the x86_64 branch contains a total of 1,619
"x86_64" and "noarch" RPM packages, while the i386 branch lists a total of
1,652 RPM packages. This means that over 98% of Fedora packages have been
ported to the AMD64 architecture. By comparison, the Debian unstable branch
for AMD64 currently holds 14,911 DEB packages, which represent nearly 96%
of all DEB packages found in the i386 architecture.
The remaining packages in Fedora Core were compiled for i386 and are
available for installation alongside the x86_64 packages - the most
noteworthy among them are Helix Player and OpenOffice.org. Because of this
likely mix of 64-bit 32-bit applications on most users' systems, many
libraries come in two variants. In fact, looking through the install log,
we found no fewer than 52 packages, of which both i386 and x86_64 flavors
were installed; this included libgcc, glibc, perl, xorg-x11-libs, gtk2 and
many others. On a Fedora system, these two sets of libraries are placed
into two separate directories - /lib and /lib64. This is somewhat different
from the Debian approach where /lib is just a symbolic link to /lib64,
while the ia32 libraries are stored in the /emul/ia32-linux directory.
Unlike Debian, Fedora doesn't offer a possibility to install the 32-bit
part of the system into a separate, "chroot-ed" environment and the 32-bit
and 64-bit libraries and applications coexist on the same system, only
separated by the layout of system directories.
The 64-bit Fedora Core 3 has been running rather smoothly on this system. We
were impressed by the hardware auto-detection and setup, as well as the
overall look and feel of the GNOME 2.8 desktop. But as Fedora Core 3 is
really just a base for the upcoming Red Hat Enterprise Linux 4 and
therefore lacks many popular desktop applications, we were curious about
the availability of third-party RPMs to enhance the multimedia capabilities
of the distribution. These are generally made for i386, but what about
x86_64? We headed over to freshrpms.net
to find out. This turned out to be a mixed-bag experience - there is plenty
of good software compiled for i386, but not that much for x86_64. As an
example, we tried to install the xmms-mp3 package, but since it was only
available for i386, it wouldn't install until we "downgraded" our 64-bit
xmms to 32-bit xmms. Other applications fared better and we located
pre-compiled 64-bit RPMs of MPlayer, xine, Audacity, Ogle, libdvdcss and
other software. Disappointingly, using "apt" to install them proved
impossible as each 'apt-get install' command was immediately followed by an
enormous list of unmet dependencies. We had better luck with "yum", which
worked like magic, even correctly detecting the architecture and
automatically downloading and installing 64-bit packages, whenever
available.
Given the extra overhead in terms of disk space and memory usage while
running two "editions" of the same libraries, as well as the limited number
of third-party RPMs, is there a case for running a 64-bit Fedora Core? In
other words, are there any advantages of running a 64-bit system on a
64-bit processor, as opposed to running a 32-bit system on a 64-bit
processor? As always, it depends. Unfortunately, it seems that right now,
and for the majority of users, the disadvantages outweigh the benefits.
While we haven't done any speed benchmarks, from what we know about the
64-bit CPUs, most users are unlikely to notice much difference. There might
be cases where the 64-bit processors clearly outperform the 32-bit ones,
especially in tasks which involve encoding large media files, heavy web
serving with scripts and output compression, or running massive databases
that require substantial amounts of memory. But users performing everyday
office tasks will benefit little from the 64-bit technology.
So why run it at all? Maybe just for that feeling of satisfaction of riding
on the cutting edge of consumer technology, not too dissimilar from the
feeling of a mountain climber who just conquered Mt. Everest, although he
could have chosen to climb a smaller mountain. But there is a second, much
more legitimate reason - to avoid the upcoming Year 2038 Bug. That's
because on January 19, 2038, at 03:14:07 GMT, exactly 231
seconds will have passed since the beginning of the UNIX epoch on January
1st, 1970. One second later, all 32-bit UNIX systems will revert back to
the year 1970. We'll leave it to your imagination as to what will happen
unless you migrate your data and applications to a 64-bit system before
then.
Comments (27 posted)
Distribution News
Xandros has announced the availability of version 3 of its desktop Linux
distribution; click below for the details. "
Xandros Desktop 3 provides
the ultimate Linux desktop experience for laptops and PCs with enhanced
wireless support, drag-and-drop DVD burning, and automatic alerts to
Xandros Networks updates. Employing a Xandros-enhanced KDE 3.3 and an
underlying 2.6.9 Linux kernel, the new version also provides enhanced
security with a Personal Firewall wizard, simple access to virtual
private networks, and automatic encryption of user home folders."
Full Story (comments: none)
Mandrakelinux 10.1 Official is
now available
for download. There are three ISO CD images, a DVD ISO image and a
mini-CD ISO image.
Here's the Cooker Weekly News, issue 14
with a look at what's been cooking at Mandrakesoft from November 15 to
December 5, 2004.
Mandrakelinux updates: drakxtools
(updated to point users of stable releases to Bugzilla - 10.1) and dietlibc (provides proper support for the
AMD64 architecture - 10.0).
Comments (1 posted)
Concurrent has
announced
the availability of version 2.2 of its RedHawk Linux real-time operating
system. "
RedHawk 2.2 is one of the most deterministic Linux
operating systems available today supporting both 32-bit Intel(R) Xeon(TM)
and the 64-bit AMD(R) Opteron(TM) platforms in the same release. RedHawk
2.2 adds support of Intel's latest Xeon EM64T (Nocona) based
systems."
Comments (none posted)
Fedora Core 3 updates:
boost (upgrade to
current release, 1.32.0),
selinux-policy-targeted (update policy to fix
problems with htdig, mysql, and ntpd),
selinux-policy-strict (update to latest
version in rawhide),
cyrus-imapd (fixes a
package installation problem),
netatalk
(patch temp file vulnerability with etc2ps),
gaim (upgrade 1.1.0 - bugfixes),
rhpl (remove synaptics requires),
ttfonts-ja (plays nice with ghostscript),
mc (security fixes, better UTF-8),
udev (039-10.FC3.4),
udev (039-10.FC3.5 - fixed udev.rules for
cdrom symlinks),
gnome-bluetooth (fixed
gnome-bluetooth-manager script for 64 bit),
rsh (fixed rexec fails with "Invalid
Argument"), and
Omni (upgrade to 0.9.2).
Fedora Core 2 updates: cyrus-imapd (fixes a
package installation problem), netatalk
(patch temp file vulnerability with etc2ps), and gaim (upgrade 1.1.0 - bugfixes).
JPackage 1.6 has been released. JPackage
serves as the upstream of numerous FC Java packages.
Comments (none posted)
SUSE Linux has fixed a bunch of minor security issues in the kernel,
cyrus-imapd, imlib, unarj and zip. Click below for more information.
Full Story (comments: none)
New Distributions
An iso image of the Linux Audio Live CD, published by German
Keyboards, is available for download.
Full Story (comments: none)
The
first release of the
Games Knoppix (St. Nicholas Day Release) is ready for download. This
is a Knoppix 3.7 based CD with Castle-Combat, Globulation 2, Hatman,
Kobodeluxe, Miniracer, Pingus, Rafkill, and lots of other games.
Comments (none posted)
Distribution Newsletters
The Debian Weekly News for December 7, 2004 is out. In this issue: Frank
Ronneburg has updated his book about Debian and will present it on December
14th in Berlin, Germany. Europcar has switched 1,500 computers in branch
offices to Debian based thin clients, and is now moving 3,500 more machines
in headquarters to GNU/Linux, also Hot Babe and non-US?, Sarge Release
Update, and more.
Full Story (comments: none)
The Gentoo Weekly Newsletter for the week of December 6, 2004 is out.
Topics this week include the Gentoo Developer Meeting at the 21st Chaos
Communication Congress (21C3) in Berlin, Germany on December 28, the
release of Gentoo Linux 2004.3-r1, and more.
Full Story (comments: none)
The
DistroWatch
Weekly for December 6, 2004 is out. "
Welcome to this year's 48th
edition of DistroWatch Weekly. This week we'll talk about the Knoppix live
CD, feature the Damn Small Linux mini distribution, and present several
upcoming distribution releases, including Mandrakelinux 10.2 and NetBSD
2.0. Happy reading!"
Comments (none posted)
Minor distribution updates
GnomeDesktop
reports the
release of Flash Linux 0.3.2. "
Hopefully this release fixes
"everything" and adds some nice new
features."
Comments (none posted)
Quantian 0.6.9.2 is out, with over 475 new packages from CRAN and
BioConductor for statistical computing, data analysis and graphical methods
via the R environment and language.
Full Story (comments: none)
Newsletters and articles of interest
O'ReillyNet has some
tales
of Knoppix rescues. "
As a battle-hardened sysadmin, I've seen a
lot of broken systems (some I broke, and some were broken for me). I've
carried a number of rescue disks, including tomsrtbt and the LinuxCare
Bootable Business Card, but over the past year or two, I've started to rely
completely on Knoppix as an all-in-one rescue disk. Below are some
real-life accounts of how I've saved some broken systems with just my
Knoppix CD."
Comments (none posted)
NewsForge
presents a user's view of Xandros. "
I've been using Xandros
Desktop 2.0 for about a year now. It has all the features I need in a
desktop to keep my business, my family, and myself happy. Xandros 2.0 has
made administering my home computer easier and allowed me to move away from
a dual-boot configuration."
Comments (none posted)
LinuxTimes.net
interviews Greg M. Kurtzer, the head of the Caos Foundation.
"
The cAos Foundation now hosts 2 major distribution projects. Today,
the most popular is Centos, which is a rebuild of the freely distributable
sources in Enterprise Linux. The second project is cAos Linux which is a
new distribution which offers a nice cross between bleeding edge,
stability, and longevity. cAos Linux was the first project of the
Foundation, thus it shares the name."
Comments (none posted)
Addict3d.com
takes a
quick look at
BeatrIX Linux.
"
BeatrIX Linux is a live-CD containing kernel 2.6.7, Gnome 2.6, Open
Office 1.1.2, Firefox, Evolution, GAIM and more. It doesn't touch your hard
drive or in any way mess up your current O.S. It was designed primarily for
the new breed of Via mini-ITX motherboards that are fanless, low-powered
and tiny, but will run on just about any Pentium-class computer with at
least 64 megs of RAM."
Comments (none posted)
Click below for a a tribute to Ubuntu (warty warthog) as posted to
linux-elitists by Greg Folkert.
Full Story (comments: none)
Distribution reviews
NewsForge
looks
at Fedora Core 3. "
If I were a movie reviewer, I would give FC3
a thumbs-up. It is a solid release with few problems, and most of those are
specific to certain hardware. Its ease of installation and package
management system make it an excellent choice for newbies who want to learn
Linux without the horrendous learning curve associated with having to
compile everything yourself. Its functional SELinux component is a powerful
incentive to install it just to learn what will certainly become a standard
in the near future. Indeed, SELinux alone probably takes FC3 to a whole new
level."
Comments (none posted)
Page editor: Rebecca Sobol
Development
Hewlett Packard
has launched a new open-source Linux project that
supports its printing, scanning, and digital camera products, HPLIP.
HPLIP has been released under version 2 of the GNU General Public License.
Hewlett-Packard is proud to announce the initial release of HP Linux Imaging and Printing System (HPLIP). HPLIP is a complete single and multi-function printing device connectivity solution for users of Linux OS. The goal of this project is to provide "radically simple" printing, scanning, photo card access, and device management to the consumer and business Linux user.
HPLIP is part of the
HP Linux Printing Project:
"The HP driver project provides printing support for more than 300 printer models, including, DeskJet, OfficeJet, Photosmart, Business Inkjet and some LaserJet."
The HPLIP feature list includes:
- Inkjet printer cartridge cleaning and alignment functions.
- Status display for printer supplies.
- Scanning capabilities via SANE.
- A CUPS print spooler backend with bidirectional connectivity.
- A photo card slot image downloading application.
- Support for more than 300 HP printers.
- Support for parallel port, USB, and network printer interfaces.
Instead of reinventing existing functions with a proprietary system, HPLIP
works with existing open-source software.
The list includes the Foomatic printer database from
LinuxPrinting.org, the
CUPS print spooler, and the
SANE (Scanner Access Now Easy)
project, all of which are commonly used Linux components.
This strategy should insure better cooperation with the
open-source developer world, and will allow for faster bug fixing
and security updates.
The HP
Inkjet Driver Project Readme document goes into more information
on the project.
One interesting detail of the project is the smorgasbord of
licenses used:
"In general all applications are covered by the GNU General Public License (GPL) and the backend is covered by a MIT license. The printer driver HPIJS uses a BSD license."
Dependencies include a Linux kernel at or above 2.4.19, GNU Ghostscript,
Foomatic, Qt, PyQt, Python, CUPS, net-snmp, and most major Linux distributions. The initial (version 0.8.1) release was superseded
by version 0.8.2, which fixes a number of newly discovered bugs.
See the end of the
Readme document for change details.
The software configured and built with no problems on a (crusty old)
Red Hat 9 system, the documentation on installation is up to date,
but the usage information is still forthcoming,
according to the README.
HP should be commended for coming up with a genuine open-source
solution for connecting their products to Linux, we hope the model
encourages other companies to do the same.
Comments (12 posted)
System Applications
Backup Software
Version 1.3.1 of KDar, a GUI-based backup utility, is out
with bug fixes.
Full Story (comments: none)
Database Software
The
Firebird relational database
project has announced version 1.5.2 Release Candidate 4 of Firebird,
version 1.7 Beta 2 of the Firebird ADO.NET Data Provider, and
version 1.5.5 of the Jaybird JDBC/JCA Driver.
Comments (none posted)
Version 0.8.10 of GLOM, a database table definition GUI, is out
with bug fixes, a new example document, and more.
Full Story (comments: none)
The first release candidate for PostgreSQL 8.0.0 is available for download
on all
mirrors.
You can find the complete list of changes/improvement since Beta 5 was
released
here.
Full Story (comments: 13)
Version 1.2.0 of pgAdmin III, a cross-platform GUI PostgreSQL
administration and management tool, is out.
Changes include support for PostgreSQL 8.0.0, GUI improvements,
query tool output to file, a new permissions grant tool, and much more.
Full Story (comments: none)
Filesystem Utilities
Version 0.0.7 of GParted, the Gnome Partition Editor, has been released.
Changes include official support of extfs 2/3, and reiserfs, ntfs support,
detection of drives without labels, support for creation of unformatted
partitions, and more.
Full Story (comments: none)
Libraries
Unstable release 1.7.0 of Pango, a library for layout and rendering of
text, is available.
"
The major change in this release is PangoRenderer, a base object
holding the logic for rendering PangoLayout which was previously
duplicated in many places. Also in this release, support has
been added for the Lao and Syriac scripts."
Full Story (comments: 1)
Web Site Development
Version 0.4.6 of
BBClone, a
PHP-based web counter, is out.
Changes include a new look and feel, optional column display of
last visited page and search engine queries, and a large translation
update.
Comments (none posted)
Alexander Prohorenko
introduces GOsa in an O'Reilly article.
"
GOsa (GOnicus System Administrator) is a web administration tool for managing accounts and systems in LDAP databases, written in PHP and licensed under the GNU GPL. The author of GOsa is GONICUS GmbH, a German company. GOsa can manage users, groups, mail distribution lists, thin clients, and faxes. Users can retrieve information about themselves, use LDAP contact and telephone lists, change their passwords, and view fax statistics. Users can also configure their own mail accounts, but their configuration possibilities are limited."
Comments (none posted)
Version 3.2.26 of mnoGoSearch, a web site search engine,
has been released.
See the
Change History
document for details.
Comments (none posted)
The December 2, 2004 edition of the
ZopeMag Weekly News
is online with the latest Zope web development platform information.
Comments (none posted)
Miscellaneous
Version 0.4 of Logfmon, a log file monitoring utility,
is available.
"
This version adds the ability to apply rules to several files rather than just one or all, support for testing entries against a regexp to not match as well as a regexp to match and a number of bug fixes."
Comments (none posted)
Desktop Applications
Calendar Software
Version 0.2 beta of
Mozilla Sunbird, a redesigned Mozilla Calendar component,
is available.
"
These builds have been dubbed as Sunbird 0.2beta. This means that these builds will be the basis for an upcoming Sunbird 0.2 release if we do not find any major regressions."
Comments (none posted)
Desktop Environments
Version 2.9.2 of the GNOME Development Release is out.
"
Of special note in this release is the new 'gnome-menus' module, which you
will need if you would like to have your... GNOME... menus. :-) It is a new
XDG spec compliant menu system, brought to us by panel co-maintainer, Mark
McLoughlin!"
Full Story (comments: none)
KDE 3.3.2 has been released. This release concentrates on bug fixes and
translations; there's not much in the way of new applications or features.
The
release
announcement has the details.
Comments (none posted)
George Staikos gives
a preview
of KDE 3.4.
"
KDE 3.3.2 was tagged today, so we should see a new bug fix release of KDE in the first or second week of December. Earlier this past week, the plans for a KDE 3.4 release were also finalized. This will be the last major KDE 3 release before KDE 4. KDE 4 will make use of the Qt 4 library which promises to be quite a revolution for KDE and all Qt applications, but will break binary compatibility with previous releases.
The release schedule for KDE 3.4 plans for an alpha release December 3, a beta release January 7, and a final release March 16 2005."
Thanks to Steve Mallett.
Comments (none posted)
The December 3, 2004 edition of the
KDE CVS-Digest
is online. Here's the content summary:
"
KTTSD adds support for SSML /Sable. Kipi-Plugins implements remote gallery export of images. Kpdf adds watch file option. KOffice adds import support for PocketWord's PWD files. Speedups in KTTSD , kwin and khtml."
Comments (none posted)
KDE.News
covers the launch of
KDevelop TechNotes. The first article in the series,
Browsing
documentation with KDevAssistant and the second article
RAD with KDevelop
using C++/Qt/KDE are currently available.
Comments (none posted)
Version 2.9.2 of GARNOME, the bleeding edge GNOME distribution,
is out.
"
This release incorporates the GNOME 2.9.2 Desktop & Developer
Platform, as well the usual assortment of third-party updates to keep even
the most seasoned developer frustrated beyond belief."
Full Story (comments: none)
Stable version 2.8.8 of Metacity, a simple window manager for GNOME 2,
has been released with bug fixes.
Full Story (comments: none)
Version 2.9.1 of Metacity, a simple window manager for GNOME 2, is out.
"
This is an unstable release heading towards Gnome 2.10, released a
little late for Gnome 2.9.2 but there weren't many changes anyway this
time..."
Full Story (comments: none)
Electronics
The
Open Collector Database site has an announcement for FreePCB
version 0.936, a printed circuit CAD application.
Here is the change note:
"
This fixes a few bugs, and adds the following new features:
The "Generate CAM files" dialog now allows metric or English units
Pins in footprints can now be given alphanumeric identifiers
The layer list in the main window now shows an indicator for the active routing layer.
The User Guide has been updated."
Comments (1 posted)
Version 3.3.3 of
XCircuit, an electronic schematic drawing application, is out.
Here is the change notice:
"
Corrected a problem in which drawn subcircuits and
subcircuits declared with an "X.." in the info label
will share index numbers, by forcing SPICE output to
generate a devname of "X" for each drawn subcircuit
object.
Also: Changed the behavior so that device numbering
starts at zero, not one. Otherwise, if a device is
numbered zero on the drawing (e.g., by having the index
number entered by hand), xcircuit will generate a spurious
"duplicate part" warning."
Comments (none posted)
Financial Applications
Version 2.4.6 of
SQL-Ledger,
a web-based double entry accounting system, is out.
Changes include
updated translations, a new window menu link, and bug fixes.
Comments (none posted)
Games
Version 2.8.2 of gnome-games, a collection of games for the GNOME desktop,
is out.
"
This is the third stable release of gnome-games in the 2.8
series. There are no new feature, only bug fixes and translation
updates. Unless you are experiencing problems there is no need to
upgrade."
Full Story (comments: none)
Version 0.3.3 of skstream, a C++ iostream based network library for the
WorldForge game project,
has been released.
Changes include new methods for shutting down sockets, bug fixes,
and code cleanup.
Comments (none posted)
Geoff Broadwell
begins a series on 3d Gaming with Perl on O'Reilly.
"
This article is the first in a series aimed at building a full 3D engine. It could be the underlying technology for a video game, the visualization system for a scientific application, the walkthrough program for an architectural design suite, or whatever.
"
Comments (none posted)
GUI Packages
Stable version 2.4.8 of GLib, the low-level core library that forms the
basis for projects such as GTK+ and GNOME, is out.
"
This is a bug fix release and is source and binary
compatible with 2.4.0."
Full Story (comments: none)
Version 2.4.14 of GTK+, a multi-platform toolkit for creating graphical
user interfaces, has been released.
"
This is a bug fix release and is source and binary compatible
with 2.4.0."
Full Story (comments: none)
Version 2.5.2 of gtkmm, the wrapper for the GTK+ API, is out
with lots of API changes and improved documentation.
Full Story (comments: none)
Stable version 2.8.2 of Gtk2-Perl is out.
"
Gtk2-Perl is the collective name for a set of Perl bindings for GTK+
2.x and various related libraries. These modules make it easy to write
GTK+ and GNOME applications using a natural, Perlish, object-oriented
syntax."
Full Story (comments: none)
Imaging Applications
Bugfix release 2.8.2 of Eye of Gnome, an image viewer for the
GNOME desktop, is available.
"
Recently a lot of crashes have been reported for Eye of Gnome
into bugzilla. James Henstridge was so kind to fix some of these issues.
f you noticed frequently crashes with Eye of Gnome please try out
this release and see if it works for you."
Full Story (comments: none)
Instant Messaging
Version 1.1.0 of Gaim, an instant messaging client,
has been announced.
"
finaly they have removed the "switchboard" error :D."
Other changes include fallback IRC encodings, a new MSN protocol icon,
bug fixes, and more.
Comments (none posted)
Version 0.15 of Konversation
has been announced.
"
Konversation is a simple and easy to use IRC client. New features include a brand-new Kontact integration, better KDE HIG compliance, DCC rewritten with KIO, support for SSL IRC servers and much more!"
Comments (none posted)
Interoperability
Release 20041201 of Wine
has been announced.
Changes include implementation of the RSAENH dll, work on the Direct3D
9 architecture, built-in debugger improvements, reorganization of
the Developer's Guide, and bug fixes.
Comments (none posted)
Mail Clients
Stable version 2.0.3 of Evolution, the GNOME mail client, is out with
a bunch of bug fixes.
Full Story (comments: none)
Thunderbird 1.0 is out; see
the release
notes for details and download links.
Comments (none posted)
Office Suites
OpenOffice.org 1.1.4rc is available.
"
It is the first
release candidate for OpenOffice.org 1.1.4. The build includes bug
fixes but no new features."
Full Story (comments: none)
PDA Software
Development version 1.5 of Guikachu, the GNOME Resource editor for
PalmOS projects, is out.
"
This release is part of the 1.5 development branch, so it's all about
crazy experimentations and not about providing a polished, well-tested
product -- so don't quite replace your 1.4 Guikachu just yet.
New in this release:
Due to popular request, the ImageMagick dependancy has been
dropped. All image handling is now done by either GdkPixbuf, or
Guikachu's own internal functions."
Full Story (comments: none)
Web Browsers
MozillaZine
reports on the new Firefox Aviary branch.
"
Last week, the Aviary branch landed on the trunk, bringing the trunk builds
of Mozilla Firefox into line with Firefox 1.0. The Aviary branch was cut from
the 1.7 branch earlier this year, allowing Mozilla 1.8 development to
continue on the trunk without the worry that radical changes (such as those
made to Gecko) would adversely affect the stability of Firefox 1.0 and
Thunderbird 1.0.
Changes to core Mozilla components like Gecko were only checked into trunk
and not the Aviary branch, while late-breaking Firefox 1.0 features (like the
Find bar and the Plugin Finder Service) were only checked into the Aviary
branch and not the trunk. Both Firefox 0.9 and 1.0 were released from the
Aviary branch."
Comments (1 posted)
Word Processors
Version 2.2 of the AbiWord word processor
has been announced.
Here is an overview of new features:
- A MacOSX port
- Tables of contents
- Document history/revisions
- Better support for international scripts and locales
- List folding
- Text wrapping around images
- Faster rendering
- Dashboard integration
- Visual drag and drop
Comments (none posted)
Miscellaneous
Version 0.1.3 of Coaster, a CD burning application for GNOME, is out.
Changes include code cleanup, a help skeleton, support for exporting
to and burning from ISO images, bug fixes, and more.
Full Story (comments: none)
Version 2.8.2 of gnome-panel, the applet bar on the edge of the GNOME
desktop, is out.
"
This is the "Enfin un tableau de bord traduit" release: since the last
stable release, a lot of translations were updated, thanks to the
wonderful translator teams."
Full Story (comments: none)
Languages and Tools
Caml
The December 7, 2004 edition of the Caml Weekly News
is available. Topics include Functional Reactive Programming in OCaml?,
Developing Applications with Objective CAML reviewed on Slashdot, and
Tools module for the Standard Lib.
Full Story (comments: none)
HTML
Version 0.60 of Nvu, an html editor,
is available.
"
On the change list: a complete rewriting of the site manager and the rulers that solves many issues, and a lot of bug fixes".
Comments (none posted)
Lisp
Version 0.9.1 of CL-PPCRE is available.
"
Version
0.9.1 adds shortcuts for group registration.
CL-PPCRE is a Perl-compatible, fast, portable regular expression
library written in Common Lisp. The library also supports a
sexp-based syntax for specifying regular expressions."
Full Story (comments: none)
A new Lisp comic book is out.
"
Conrad Barski has written the comic book "Casting SPELs in Lisp". The
book, which is intended for novices, is a Lisp tutorial with the goal
of taking the reader to appreciate the most advanced features of the
language, particularly macros."
Full Story (comments: none)
Perl
The November 16-30, 2004 edition of
This Fortnight in Perl 6 is out with the latest Perl 6 developments.
Comments (none posted)
PostScript
Version 2.8.1 of GGV, GNOME GhostView, is available:
"
the first bug-fix release in the 2.8 series, which is - besides being
destined to update your wonderful 2.8 release of the fabulous Gnome
desktop environment - also appropriate for the possible 2.9 development
release that you might use to give you that feeling of living on the
bleeding edge, never sure of what comes next."
Full Story (comments: none)
Python
A new tutorial
is available for
SPE
(Stani's Python Editor).
"
Spe is a stable, full-featured python IDE with auto-indentation, auto completion, call tips, syntax coloring, syntax highlighting, class explorer, source index, auto todo list, sticky notes, integrated pycrust shell, python file browser, recent file browser, drag&drop, context help, ..."
Comments (none posted)
The December 2, 2004 edition of Dr. Dobb's Python-URL is online
with the latest Python article links.
Full Story (comments: none)
Issue #7 of
Py Magazine is under construction.
"
We have just published the the third article and are busy working on more. Current articles are: "Taking advantage of COM with Python" (free), "Python on .NET", and "Python at both ends of the Web". Future articles will include "Click here: A GUI testing approach", "Docutils", "Using Python to create a mobile data collection system", and a review of the book "Dive into Python"."
Comments (none posted)
Jason Diamond
discusses test-driven Python development on O'Reilly.
"
Test-driven development is not about testing. Test-driven development is about development (and design), specifically improving the quality and design of code. The resulting unit tests are just an extremely useful by-product.
That's all I'm going to tell you about test-driven development. The rest of this article will show you how it works. Come work on a project with me; we'll build a very simple tool together. I'll make mistakes, fix them, and change designs in response to what the tests tell me."
Comments (none posted)
Tcl/Tk
The December 1, 2004 edition of Dr. Dobb's Tcl-URL is
online with another week's worth of Tcl/Tk articles and resources.
Full Story (comments: none)
XML
Joe Gregorio
introduces the REST architectural style on O'Reilly.
"
If you follow web services, then you may have heard of REST. REST is an architectural style that can be used to guide the construction of web services. Recently, there have been attempts to create such services that have met with mixed success. This article outlines a series of steps you can follow in creating your protocol--guidance that will help you get all the benefits that REST has to offer, while avoiding common pitfalls."
Comments (none posted)
Uche Ogbuji
discusses XML Canonicalization in an IBM developerWorks article.
"
XML is careful to separate details of a file or other data source, bit-by-bit, from the abstract model of an XML document. This can be an inconvenience when comparing two XML documents for equality -- either directly (for instance, as part of a test suite) or by comparing digital signatures for security purposes -- to determine whether an XML document has been tampered with in some way. The W3C addresses this problem with the XML Canonicalization spec (c14n), which defines a standard form for an XML document that is guaranteed to provide proper bit-wise comparisons and thus consistent digital signatures. In this article, Uche Ogbuji introduces XML Canonicalization."
Comments (none posted)
Editors
Version 2.8.2 of gedit, a text editor for GNOME, is out
with bug fixes and translation improvements.
Full Story (comments: none)
IDEs
KDE.News
summarizes
the contents of issue 3 of the
KDevelop TechNotes:
"
Improved Ruby programming
language support with Qt Designer integration and Ruby debugger is considered
as the "killer" feature of upcoming KDevelop 3.2. Therefore this issue
describes new "hot" features, discusses RAD using Ruby language and Qt/KDE
libraries and lays stress on integrated GUI design with KDevelop Designer."
Comments (none posted)
Profilers
Reg. Charney
demonstrates
a Valgrind profiling session in a Linux Journal article.
"
Memory and performance problems plague most of us, but tools are available that can help. One of the best, most powerful and easiest to use is Valgrind. One thing stands out when you use Valgrind--you do not need to recompile, relink or modify your source code."
Comments (10 posted)
Page editor: Forrest Cook
Linux in the news
Recommended Reading
In the November To Evil! Danny O'Brien
vents his self-righteous
indignation on script kiddies and spammers. "
Thinking about it,
I'm actually rather glad that SCO gets hacked so often. It gives me and
many others a perfect opportunity to highlight how evil crackers are, with
the not unpleasant side-effect of establishing ourselves as the moral
paragons."
Comments (1 posted)
The
Decatur
Jones Open Source Wall Street newsletter for December 6 (PDF) is
available, with looks at SCO, Red Hat, Novell, Mandrakesoft, Sun, and more.
"
We believe that SUNW had little choice other than to make its
license incompatible with the GPL, otherwise the best parts of Solaris
would have simply been usurped and added to Linux. Thus we are skeptical
that a robust development community will form around SUNW's code, thereby
defeating the benefits of Open Source. As we have stated in the past, we
believe that SUNW is wasting critical resources by competing with broadly
supported, and rapidly evolving, Open Source projects versus taking a more
agnostic approach that caters to customer's desires."
Comments (10 posted)
Trade Shows and Conferences
NewsForge
covers the fourth Italian National Day of Linux and Free Software
conference.
"
During the whole day, the reception desk made it easy even for the casual passer-by to try GNU/Linux software safely. The LUG members had organized a no-stop, a-la-carte CD burning service for all visitors. The catalog offered a lot of LiveCD distributions, including specialized ones like So.Di.Linux's direct ancestor EduKnoppix (Live GNU/Linux for schools), the multimedia-oriented dyne:bolic, and BristolMorphix, which includes the video-editing suite Cinelerra."
Comments (none posted)
The SCO Problem
Groklaw has
a new set of filings in SCO v. IBM, including SCO's memo opposing IBM's copyright (GPL) infringement summary judgment attempt. "
One thing is now clear -- the validity of the GPL is not going to be tested in this case. SCO's incompetence has shut the door to them being able to do that. Now, they are wrapping themselves in the GPL flag."
Comments (9 posted)
Companies
Netcraft
is reporting some initial success by a controversial Lycos
MakeLoveNotSpam screensaver, which attacks spammer sites.
"
A distributed denial of service (DDoS) attack launched by users of Lycos Europe's MakeLoveNotSpam.com screensaver has succeeded in crippling several spammer sites, but some of the targeted sites remain available.
While Internet users debate the ethics of the initiative, Lycos Europe is denying reports that the MakeLoveNotSpam site was hacked and defaced last night. An intrusion by hackers would be a serious concern for an operation that controls an army of computers with DDoS capabilities. The site has been unreachable today, which could be related to traffic from Slashdot rather than a counterattack."
Comments (14 posted)
News.com
looks at compatibility issues between the GPL and Sun's CDDL, which
may be used on the Solaris operating system.
"
"The CDDL is not expected to be compatible with the GPL, since it contains requirements that are not in the GPL," Claire Giordano of Sun's CDDL team said in its submission. "Thus, it is likely that files released under the CDDL will not be able to be combined with files released under the GPL to create a larger program.""
Comments (41 posted)
Legal
Tom Adelstein
writes
about the Government Open Code Collaborative or GOCC.gov, on Linux
Journal. "
As so many people have said, "Nothing is as powerful as an
idea whose time has come." And GOCC.gov is an idea whose time is long
overdue. Open-source advocates attempting to initiate legislation and fight
the battles on the floors of the various Houses, only to discover the
political might and opposition of Microsoft, now have an alternative. State
agencies now can download software for free and use it to create a cohesive
and standard government infrastructure."
Comments (3 posted)
Interviews
OSnews.com
interviews the core AmaroK developers. "
The automatic album cover retrieval is a very popular feature with our users. It fetches album images from the Net or from your harddisk and displays the right image along with the music you play. Not only does this look extremely cool, but also it helps to associate the music with your memory - one image says more than 1000 words."
Comments (none posted)
Resources
This Linux Journal article
shows how to use Ruby and
SQLite to create Linux clusters. "
Linux clusters have become the
new supercomputers. The economics of teraflop performance built on
commodity hardware is impossible to ignore in the current climate of
dwindling research funding. However, one critical aspect of
cluster-building, namely orchestration, frequently is overlooked by the
people doing the buying. The problem facing a developer with clustered
systems is analogous to the one facing a home buyer who can afford only a
lot and some bricks--he's got a lot of building to do."
Comments (none posted)
Reviews
LinuxDevices
takes a look
at embedded Gentoo. "
A project to create embedded versions of Gentoo
Linux has achieved preliminary releases on x86, MIPS, PPC, and ARM. The
releases include native core system binaries, cross-platform toolchains,
and, for x86, an optional hardened toolchain. The year-old project needs
developers to help add cross-compile awareness to source packages."
Comments (3 posted)
This NewsForge article
covers
a range of choices available for Linux network file systems.
"
Our current model of the network file system is defined by the
paradigm of the enterprise workstation. In this model, a large enterprise
has a number of knowledge workers based at a single campus, all using
individual work stations that are tied together on a single local area
network (LAN)."
Comments (45 posted)
Linux Journal
reviews Open Source
Software: Implementation and Management, a book by Paul Kavanagh.
"
Have you ever had a friend ask you how to introduce open source
within an organization? Although some may have outstanding answers for this
question, few of those answers carry the credibility that top management
might require. If, as projected, half of IT professionals in 2005 will
consider open source, this might be a question we all will be hearing more
often. It would be nice to suggest a credible resource where those posing
the question might be able to find some useful answers."
Comments (none posted)
Miscellaneous
News.com
predicts
the upcoming release of the Thunderbird 1.0 mail client may offer
competition to Microsoft's Outlook Express.
"
If Thunderbird is to make any market inroads, analysts say, it will have to do what Mozilla's Firefox browser has succeeded in doing: capitalize on frustration with Microsoft's product.
"I don't know if the same dissatisfaction is there with Outlook, but we're looking at Outlook Express and we're seeing a lot of parallels with IE," MacGregor said. "There are the nuisances of the Web, spyware slowing down your experience, spammers clogging your inbox, viruses in attachments...We think Thunderbird can help.""
Comments (none posted)
Information Week
takes
the kernel developers to task for not having published a
Microsoft-style, three-year kernel development road map. "
IBM's Frye
sees no reason for the Linux camp to produce its own road map, arguing it's
better to keep customers focused on 'what's there today.' Besides, he says,
CIOs can get closed-door briefings from Linux distributors if
necessary. Yet, his explanation seems a bit like a rationalization for a
community-oriented development process that simply hasn't gotten around to
centralized, long-term planning."
Comments (40 posted)
Page editor: Forrest Cook
Announcements
Non-Commercial announcements
According to GnomeDesktop.org, the winners of the 2004 GNOME Foundation director election are Owen Taylor, Luis Villa, Jody Goldberg, Daniel Veillard, Jonathan
Blandford, Federico Mena-Quintero, Tim Ney, Miguel de Icaza, Murray
Cumming, Christian Schaller, and David Neary
Comments (none posted)
Open Source Development Labs, Inc. has
announced cooperation with Bull on the Open POSIX Test
Suite (OPTS).
"
OPTS is an open source community project designed to make it easier to
port applications from other POSIX platforms to Linux. POSIX is a widely-used
standard of the Institute of Electrical and Electronics Engineers (IEEE) that
promotes portability among operating systems, primarily UNIX operating systems
such as AIX, HP-UX and Solaris. In addition to making significant test
contributions to the OPTS project, Bull led the effort to integrate the tests
into STP to enable POSIX-compliance feedback in a manner that is timely to
Linux/OSS developers."
Comments (none posted)
The FSFE has sent an open letter to Austria's Joerg Haider
concerning software patents and power grid blackouts.
"
The dependence of reliable power supplies on reliable software has
steadily increased over the years and ever since the US-East Coast
blackout of 2003 it has become a topic of public interest. Huge
problems are often caused by small mistakes and thanks to networking
effects, they can spread like wildfire, affecting huge areas."
Full Story (comments: 1)
The NoSoftwarePatents site is
carrying
the news that the EU Council will not proceed with software patents in
2004. "
According to the Belgian minister of economic affairs, the
past qualified majority for software patents no longer exists, and no
decision will be taken under the current Dutch presidency. The latest
development is that members of the European Parliament are looking at the
possibility to restart the entire legislative process." (Thanks to
James Heald).
Comments (14 posted)
The Samba project has issued a
Call for Story Submissions.
"
news.samba.org is looking for stories, especially those about successful Samba installations. It doesn't matter if yours is a recent install/migration or an existing setup that just works when you need it. We want to hear from our community about how Samba is being put to good use."
Comments (none posted)
Commercial announcements
PalmSource has put out
a press release
announcing its acquisition of China MobileSoft. One of the reasons for
this acquisition is to use China MobileSoft's Linux work as the base for a
new version of PalmOS. There is
an open letter to
the Linux community (PDF) with more information on what the company has
in mind. "
We think the Linux platform will become a leading operating
system for mobile devices, and we believe the endorsement and support of PalmSource
for that platform will greatly accelerate that process. We think the combination of Palm
OS and Linux can attract more mobile licensees and developers, create more new
devices, and bring in more users than either could on its own."
(Thanks to Bruce Perens).
Comments (16 posted)
Evermore Software LLC has
announced the new advanced edition of its cross-platform
Evermore Integrated Office package.
"
Available in four international languages -- English, Traditional and
Simplified Chinese, and Japanese -- Evermore Integrated Office 2004 Advanced
(EIOffice 2004A) enhances performances, operates faster and includes new
features requested by enterprise and small business.
"EIOffice 2004 Advanced is the next step on the long march to liberate
computer users from the Microsoft Office monoculture," said Gus Tsao,
president and chief executive officer of Evermore Software LLC".
Comments (none posted)
Fluendo has announced that it is funding Xiph.org to enable Vorbis and
Theora codecs for use with the standardized RTP protocol. "
Phil Kerr
of Xiph.org will be in charge of the development of the specifications,
including the creation of reference implementations and working with the
Internet Engineering Task Force and other stakeholders. The development
will be conducted in an open fashion in the long-standing tradition of the
Open Source community."
Full Story (comments: 1)
IBM's AlphaWorks has an announcement for
FairUCE,
a Java-based commercial mail filtering system.
"
FairUCE (which stands for "Fair use of Unsolicited Commercial Email") is a spam filter that stops spam by verifying sender identity instead of filtering content. It can stop the vast majority of spam without the use of a content filter and without requiring a probable spam or bulk folder that needs to be checked periodically. As one of the first spam filters that uses sender identity rather than email content to determine if it is legitimate, all this can be accomplished quickly using simple, inexpensive tests."
Comments (none posted)
KBC Securities has released
a
new analysis of Mandrakesoft (PDF). "
Overall, the 2003/04
results are very satisfying and should encourage management on the eve of
the group's capital increase, which will open the door to accelerated
growth and the transfer to a regulated market."
Comments (none posted)
Linspire, Inc. has
announced the availability of Nvu, an open-source html editor.
"
Nvu gives non-technical computer users
the power to create, edit and publish professional, attractive Web sites, much
like Microsoft FrontPage or Macromedia Dreamweaver. Based on Mozilla Internet
technology and Netscape Composer, the tool allows users to easily author and
manage rich Web documents without programming or HTML coding."
Comments (none posted)
Scalix Corporation has
announced the results of a survey on corporate Linux adoption.
"
Linux continues to gain traction in the enterprise, with 55% of IT executives interviewed in a recent study saying they'd consider switching to Linux messaging over the next two years, if there were no disruption to end users. The independent study, undertaken by Osterman Research in October 2004, also showed that over 80% would consider switching to a web-based email client if it had the same functionality as current desktop clients."
Comments (none posted)
TimeSys Corporation has
announced the availability of TimeStorm(R) Linux Development Kits
(LDKs) for IBM PowerPC 750FX and 750GX microprocessors. "
TimeStorm
LDKs include a ready-to-run, hardware-optimized 2.6-based Linux
distribution with advanced real-time capabilities such as schedulable hard
and soft interrupt handlers and a fully preemptible kernel. 750FX and 750GX
LDKs also include the Eclipse 3.0-based TimeStorm(R) Linux Development
Suite (LDS)..."
Comments (none posted)
VA Linux has announced the release of their commercial
VA FlexMessaging Solution.
"
VA FlexMessaging Solution is an
integrated mail system solution based on carefully tuned Open Source
software including MTA, POP, IMAP, SPAM filter and so forth. It is an
ideally flexible mail system for both small-to-medium setups and
large-scale enterprises."
Full Story (comments: none)
Voltaire has
announced a new scalable database platform solution.
"
Now available and tuned for Oracle Database 10g, the joint
solution, called DBScale, provides a scalable high performance data
management infrastructure using high performance, low cost storage and
InfiniBand interconnect. This is the industry's only solution to solve
file I/O problems for database clusters using industry standard
platforms and technologies such as InfiniBand, iSER (iSCSI RDMA),
Serial ATA (SATA) and Linux."
Comments (none posted)
New Books
Signate has
announced the free availability of an online version of the book
VoIP Telephony with Asterisk, which covers Asterisk, an
open source Linux PBX application. A print version of the book
is also for sale.
Comments (1 posted)
Resources
The December 5, 2004 edition of the FSF Europe Newsletter is online
with the latest news from the Free Software Foundation Europe
organization.
Full Story (comments: none)
The
December Linux
Gazette is out. Articles include: Virtual Filesystem: Building A Linux
Filesystem From An Ordinary File, SQLite Tutorial: Common Commands and
Triggers, SuSE Linux 9.2 - An Early Evaluation, Discover the hidden 8 bit
Sound card in your PC, and more.
Comments (none posted)
The December 8, 2004 edition of the Linux Documentation Project Weekly News
is online with the latest new documentation resources.
Full Story (comments: none)
LinuxUser & Developer magazine has published an article
(in PDF format) on the Ardour multi-track audio application.
Full Story (comments: none)
Florian Cramer has announced a downloadable version of the
Guide to Open Content Licenses by Lawrence Liang,
the guide provides information on 19 open content licenses.
Full Story (comments: 1)
Upcoming Events
The OMG has
announced a Call for Participation for the first annual
Open Source Modeling and
Integrated Development Environments Workshop.
The event will take place in Orlando, Florida on March 21-24, 2005.
Comments (none posted)
GnomeDesktop
reports that
the call for papers is out for
GUADEC
2005. The conference will be held in Stuttgart, Germany on May 29 -
31, 2005.
Comments (none posted)
A
Call for Proposals
has gone out for the PyCon DC 2005 conference. The event will take place
in Washington, DC on March 23-25, 2005.
Comments (none posted)
The Open Source Development Labs (OSDL) has announced that it will host a
forum at the Enterprise Linux Summit, January 31 - February 2, 2005 in
Burlingame, CA. The "OSDL Meet the Experts" forum will be located on the
exhibition floor during the conference and will be staffed by OSDL Linux
kernel developers, test engineers and other technical staff.
Full Story (comments: 1)
Registration has been opened for the
2005 O'Reilly Emerging Technology Conference.
The event will take place in San Diego, California on
March 14-17, 2005.
Full Story (comments: none)
PHP West
has announced
a conference on Web Services.
"
PHP West is holding a conference on Web Services on January 14th, 2005 hosted in the beautiful Vancouver, British Columbia, Canada. This is the first of many conferences to come on a four month orbit - each focusing on a unique genre. The conference will be a jam packed one day event with leading speakers in the industry talking about the most important topics PHP developers are faced with."
Comments (none posted)
| Date | Event | Location |
| December 9 - 18, 2004 | Ubuntu
Conference | Mataró, Spain |
| December 9 - 22, 2004 | UMeet Virtual
Conference | On the Net |
| December 13 - 17, 2004 | JavaPolis
2004 | (MetroPolis Antwerp)Antwerp, Belgium |
| December 27 - 29, 2004 | Chaos
Communication Congress(21C3) | (Berliner Congress Center)Berlin,
Germany |
| January 14, 2005 | PHP West Web Services
conference | (HR MacMillan Space Centre)Vancouver, BC,
Canada |
| January 28 - February 4, 2005 | Asia
Source | (Visthar training venue)Bangalore, India |
| January 31 - February 2, 2005 | OSDL
Enterprise Linux Summit | (Hyatt Hotel)Burlingame,
California |
| February 2 - 3, 2005 | Solutions
Linux 2004 | (CNIT, Paris la Défense)Paris, France |
Comments (none posted)
Web sites
MozillaZine
reports on the return of the Netscape DevEdge site.
"
This follows the sudden disappearance of DevEdge in October.
The last we heard, the Mozilla Foundation was trying to get the rights to the
DevEdge material, so we suspect the reemergence of the Netscape DevEdge site
is a temporary measure until the Mozilla Foundation can begin hosting the
content itself."
Comments (none posted)
LinuxMedNews
mentions the
OpenRAD site.
"
For those who are interested in getting under the hood of medical imaging
applications, we have put together a virtual community of practice. OpenRAD
has a repository tracking about 40 projects in the PACS space with an RSS
news aggregator engine that automatically captures project updates. We are
also compiling a tutorial series to demystify DICOM, the medical imaging
standard."
Comments (none posted)
Page editor: Forrest Cook
Letters to the editor
The LWN.net Letters to the Editor page has suffered in recent years; the
delay between when a letter is sent and when it is published is too long,
especially for non-subscribers. We have recently hacked up a new
letters page which displays letters as soon as we get
them into our system; the first new letter to appear there is a note on
"intellectual property" we just received from Richard Stallman.
Enhancements (such as an RSS feed) will come soon. Have a look; we're
curious to hear what you think.
Comments (10 posted)
| From: |
| Richard Stallman <rms-AT-gnu.org> |
| To: |
| lwn-AT-lwn.net |
| Subject: |
| Response to Collins' article |
| Date: |
| Mon, 06 Dec 2004 23:24:22 -0500 |
Dear Editors,
People who use the term "intellectual property rights" (*) are
generally either trying to confuse you, or already confused
themselves. Since Dr Collins is a trained specialist, I think he
knows what our point really is, and that he only feigns to
misunderstand.
I have been campaigning against software idea patents for 14 years,
and I welcome the support of Linus Torvalds. Both he and I are well
aware that copyright covers the details of expression of a program and
does not monopolize ideas--whereas every patent is an explicit
monopoly on use of some idea (**). This is precisely why we are
campaigning against software patents and not against software
copyrights. Both of us are noted for developing powerful, successful
software packages (which, taken together, form the basis of the
GNU/Linux operating system), and both of us are aware that such
projects entail combining thousands of different computational ideas.
If a country allows computational ideas to be patented, developing a
large useful program means running a gantlet of patent threats--which
only the megacorporations think they can do.
Offering us the opportunity (at great expense) to use patents to take
shots at other software developers would hardly assuage the damage
that others would do when they point their patents at us. The
European Parliament understood that the "patent protection" software
developers need is protection from patents.
Fortunately, Dr. Collins is mistaken in believing that the GATT
agreement (***) requires software patents. Several other countries
that adhere to the WTO reject software patents, and the European Union
would be wise to join them. In the past few years, the European
Patent Office has issued over 30,000 software patents, in blatant
defiance of the treaty which set it up. The Parliament's version of
the directive will reaffirm that these patents never had validity, and
will keep European software developers and users safe. Now the
question is whether the Council of Ministers will support developers
and users generally, or the megacorporations only.
Sincerely,
Richard Stallman
MacArthur Fellow
President, Free Software Foundation (www.fsf.org)
* See http://www.gnu.org/philosophy/not-ipr.xhtml for more explanation
of why the term "intellectual property" is harmful and should be
shunned.
** My dictionary defines an idea as "a product of thought". Every
patent covers some idea, in this everyday meaning of the word; a
software patent is therefore a patent covering an idea that can be
used in software, and idea for computation.
*** To avoid using the prejudiced term "intellectual property rights",
I refer to the part of GATT that deals with copyrights, patents and
trademarks as TRIPES rather than TRIPS. TRIPES stands for
Trade-Restricting Impediments to Production, Education and Science.
Comments (30 posted)
Page editor: Jonathan Corbet