LWN.net Weekly Edition for November 14, 2002

The FSF GPL Compliance Lab

The Free Software Foundation has sent out a press release proclaiming the receipt of a $25,000 donation from MySQL AB. The donation is intended to support the FSF's GPL Compliance Lab. The donation is a good thing, even if it can be seen as a relatively straightforward payback for the FSF's assistance in MySQL's (just settled) lawsuit against NuSphere. But the PR is also interesting in that it is the first public mention we could find of the "GPL Compliance Lab." So we contacted the FSF to learn a little more about it.

The Lab, as it turns out, has existed as an "informal activity" since 1992; it was formalized toward the end of 2001. According to FSF Executive Director Bradley Kuhn:

The Lab's staff includes, beyond a piece of Mr. Kuhn's time to run the whole thing, a "GPL Compliance Engineer" who investigates GPL issues, a half-time clerk to handle copyright assignments, and two lawyers who donate a few hours a week to the project. According to Mr. Kuhn, the demand for the lab's services could easily employ twice as many people; in particular, more lawyer time is needed. But, since the FSF lacks the funds to actually hire a lawyer, it is entirely dependent on pro bono work.

The Lab's staff works on a number of tasks, including the investigation of GPL violations, "diplomatically" working with violators to bring them back into line, helping others (like MySQL) in GPL enforcement efforts, GPL education efforts, and developing new versions of free software licenses. They currently handle about 50 violations every year; most of these are indeed handled with certain amount of diplomacy, since the world as a whole never hears about them. This is certainly the right approach, since, as Mr. Kuhn points out, almost all GPL violations are mistakes, rather than malicious misuses of GPL-licensed code. A quiet approach gets these violations taken care of without backing the violator into a defensive corner.

So why have most of us never heard of the Lab? The answer is resource constraints: the FSF is not exactly overflowing with funds, and has never been able to find the time to set up its own web site. The FSF is not the same thing as the GNU project; while the GNU folks are busy writing software and trying to get past that pesky HURD 2GB filesystem limit, the FSF is working on the broader free software picture. And it is doing so on a shoestring budget.

Bradley Kuhn is hoping that other companies will take a cue from MySQL and make donations to help the GPL compliance effort. He tells us:

He also states that companies which have violated the GPL and been brought back into line by the FSF should donate as well; that seems like a rather harder sell.

There is a serious point here, however. Companies that release code under the GPL do so in the hope that their competitors will not take unfair advantage of that code and distribute proprietary enhancements. As the free software ecosystem grows, an increasing number of companies will surely be tempted to do exactly that. Preventing this sort of behavior requires vigorous enforcement of the GPL's requirements. And that enforcement requires lawyers.

The FSF has been the champion of the GPL since the beginning, and is an obvious focal point for GPL enforcement efforts. But they need a level of funding that allows them to carry out that work. A donations page exists for individuals wanting to help out, and companies with bigger checks will certainly get their phone calls returned quickly. But the FSF may want to consider creating consulting and enforcement services that can be sold to companies that depend on respect for the terms of the GPL. Otherwise, as the market grows, somebody else will.

Comments (3 posted)

Free software in Italy and elsewhere

National governments are increasingly taking an interest in free software as a way to reduce costs, improve security, support local software development industry, and decrease reliance on Microsoft. At least, governments outside the U.S. are interested... Here we take a quick look at recent events in Italy and India which give some hints of where this trend is heading.

The Italian Ministry for Innovation and Technology has announced (in Italian) the creation of the "Commission for Open Source Software in Public Administration," which is charged with evaluating free software for governmental use. This committee is headed by Professor Raffaele Meo, former president of the Italian National Research Council (CNR), and a well-known free software advocate. The scope of its work is to look at the "efficiency, effectiveness, and cost savings" of free software. They are also supposed to evaluate technology trends across Europe and other industrialized countries. The group's final report, due in three months, should advise the government on strategies for the evaluation and choice of free software.

This charge may disappoint hard core free software supporters, since it seems to focus primarily on the economic arguments. The driving force behind the establishment of this committee, however, is a proposed law (in Italian, of course) being pushed by the (opposition) Italian Green Party. This law would require government agencies to prefer free software for their information systems needs. Agencies wanting to buy proprietary software would be required to justify that choice. In situations where "personal or sensitive data" (or data whose disclusure could impact national security) is being handled, use of free software would be mandatory. Public agencies would also be required to keep copies of the source for software they use, and would be required to keep data in open formats.

The long-term direction, thus, is toward strong support of free software as a way of improving security and access to public information - along with the usual economic reasons. Adoption of free software at this level in Italy is still a fairly distant prospect, however; for now, we have to wait to see what this committee has to say, early next year. (Thanks to Davide Barbieri for the tip).

Meanwhile, events in India are worth a look. The country's Department of Information Technology announced last month a new set of initiatives to promote the development and use of Linux there. Linux obviously has a lot to offer a country like India, but the cynical among us need not look too hard for another motivation for this effort. After all, Bill Gates has just taken a trip over there and talked about spending $400 million in the country. The two events are unlikely to be unrelated.

India is an important country for both Microsoft and the free software community. Its software market is relatively small, especially when considering the size of the country as a whole. But India is rich in highly educated software developers. If a substantial portion of those developers were to start working on free software, the results would be felt worldwide. It is an outcome that, for Microsoft, is worth $400 million to prevent.

Comments (4 posted)

LWN Status

This week's exercise in LWN writing about itself looks at European subscriptions, corporate subscribers, and a couple other aspects of how things are going.

The individual subscriber count stands at a little over 2300. New subscriptions have levelled off greatly in recent weeks. The total number of subscribers has yet to decline; if the number of new subscribers remains low, and the number of expiring short-term subscriptions remains relatively high, that could happen before too long, however.

We continue to see a slow but steady trickle of group subscriptions. Subscribers which have given us permission to drop their names include Dell, the IBM Linux Technology Center, NEC, Trustix, Carmen Systems AB, Progeny, The Linux Box Corporation, Boston University, the National Center for Atmospheric Research Library, Bibliotek-Systemer, BitMover, the SAIC Advanced Technologies and Solutions Group, Prosa, Intevation, the Debian Project (funded by HP), and SecurePipe. If your company is not on this list, perhaps it should be; please drop us a note at subs@lwn.net to set up a group subscription.

Our investigations into setting up an European bank account have led us to the conclusion that it's not a viable option for us at this point. Setting up an account requires a "presence" that we don't have, and, even then, it turns out that monetary union has not done much to reduce wire transfer fees across the European Union. Accepting European debit cards that are not part of the Visa or MasterCard networks is not an option available to us.

So it looks a little difficult, still, for European subscribers who do not have credit cards or PayPal accounts. There is, however, one other option we have found: accepting personal checks. It turns out that the costs to us for dealing with European checks (in Euros) is not that unreasonable. So we ask our European readers: how many of you would be willing to mail us a check, for something like EUR 65 to 70, for a one-year "professional hacker" level subscription? Drop us a note (at subs@lwn.net, or as a comment to this article) if you would be interested in that option.

The old "About LWN" page has been replaced with a new LWN.net FAQ with answers to a number of questions. This document is clearly under construction; drop us a note with questions you think we should have answered.

That's about it for this week. Thanks, as always, for supporting LWN.

Comments (15 posted)

Page editor: Jonathan Corbet

Security

Brief items

Another set of bind vulnerabilities

Here we go again... The Berkeley Internet Domain server (BIND) versions 4 and 8 have a new set of remotely exploitable vulnerabilities. They are well described in this ISS advisory; in short, the problems are:

• The really nasty one is a buffer overflow in the server's caching code; this one could (and probably will) be used for remote root exploits.

• The server can be made to terminate (with an assertion failure) when fed a large OPT record with certain kinds of queries.

• BIND servers can also be made to crash (with a null pointer dereference) when passed information with the right kind of bogus expiration time.

The first vulnerability leaves much of the net open to root exploits, worms, etc. There is no doubt that many servers will not be patched in time, with the result that malware writers will find no shortage of fertile ground for their unpleasant stuff. Business as usual, in other words.

The other result of this set of vulnerabilities is likely to be to force many sites to upgrade, at last, to BIND version 9. That will reduce the diversity of BIND implementations running on the net, thus ensuring that the next vulnerability will affect even more systems. BIND 9 is said to be more secure (having been rewritten with that goal in mind), but there are, beyond doubt, more problems lurking in that body of code. Then we'll get to go through this again.

Comments (8 posted)

Another source distribution trojan

Here we go again... the source distribution of a popular application has been compromised by a trojan horse. This time around, the affected application is tcpdump, which was compromised on November 11 and remained available for download for two days. As with other trojans, this one opens up a connection to a remote host, which can then execute shell commands. The fact that tcpdump was compromised allowed an additional twist, however: tcpdump will not show traffic to and from the hostile remote system.

For more information, see this CERT advisory.

Comments (none posted)

New vulnerabilities

BIND8: Multiple vulnerabilities

Package(s):	bind	CVE #(s):	CAN-2002-1219 CAN-2002-1220 CAN-2002-1221
Created:	November 13, 2002	Updated:	March 6, 2003
Description:	Three new vulnerabilities have been found in version 8 of the Berkeley Internet Domain Server; see this ISS advisory, the CERT Advisory CA-2002-31, or the November 14 LWN Security Page for details. Red Hat has sent out an alert (not a regular advisory) suggesting that customers apply its previous BIND updates, which upgrade the system to BIND9.
Alerts:	Sorcerer SORCERER2003-03-06 2003-03-06 SCO Group CSSA-2002-059.0 2002-12-19 Trustix 2002-0076 2002-11-15 OpenPKG OpenPKG-SA-2002.011 2002-11-15 Debian DSA-196-1 2002-11-14 Conectiva CLA-2002:546 2002-11-14 Mandrake MDKSA-2002:077 2002-11-14 SuSE SuSE-SA:2002:044 2002-11-13 EnGarde ESA-20021114-029 2002-11-14

Comments (1 posted)

glibc: DNS stub resolvers contain buffer overflow vulnerability

Package(s):	glibc	CVE #(s):	CAN-2002-1146
Created:	November 7, 2002	Updated:	February 5, 2004
Description:	DNS stub resolvers from multiple vendors contain a buffer overflow vulnerability. The impact of this vulnerability appears to be limited to denial of service. (See CERT Vulnerability Note VU#738331) The BIND 4 and BIND 8.2.x stub resolver libraries, and other libraries such as glibc 2.2.5 and earlier, libc, and libresolv, uses the maximum buffer size instead of the actual size when processing a DNS response, which causes the stub resolvers to read past the actual boundary ("read buffer overflow"), allowing remote attackers to cause a denial of service (crash).
Alerts:	Mandrake MDKSA-2004:009 2004-02-04 Red Hat RHSA-2002:197-09 2002-11-06 Red Hat RHSA-2002:197-06 2002-10-03

Comments (none posted)

kdenetwork: buffer overflow

Package(s):	kdenetwork	CVE #(s):	CAN-2002-1247
Created:	November 11, 2002	Updated:	December 20, 2002
Description:	iDEFENSE reports a security vulnerability in the klisa package, that provides a LAN information service similar to "Network Neighbourhood", which was discovered by Texonet. It is possible for a local attacker to exploit a buffer overflow condition in resLISa, a restricted version of KLISa. The vulnerability exists in the parsing of the LOGNAME environment variable, an overly long value will overwrite the instruction pointer thereby allowing an attacker to seize control of the executable.
Alerts:	Debian DSA-214-1 2002-12-20 Mandrake MDKSA-2002:080 2002-11-21 SuSE SuSE-SA:2002:042 2002-11-12 Debian DSA-193-1 2002-11-11

Comments (none posted)

kgpg: keys generated in wizard have an empty passphrase

Package(s):	kgpg	CVE #(s):
Created:	November 11, 2002	Updated:	November 13, 2002
Description:	A bug in Kgpg's key generation affects all secret keys generated through Kgpg's wizard. (Bug does not affect keys created in console/expert mode). All keys created through the wizard have an empty passphrase, which means that if someone has access to your computer and can read your secret key, he/she can decrypt your files whitout the need of a passphrase. See the full report for details.
Alerts:	Gentoo 200211-002 2002-11-10

Comments (none posted)

html2ps: arbitrary code execution

Package(s):	html2ps	CVE #(s):
Created:	November 8, 2002	Updated:	December 6, 2002
Description:	The SuSE Security Team found a vulnerability in html2ps, a HTML to PostScript converter, that opened files based on unsanitized input insecurely. This problem can be exploited when html2ps is installed as filter within lrpng and the attacker has previously gained access to the lp account.
Alerts:	Debian DSA-192-2 2002-12-06 Debian DSA-192-1 2002-11-08

Comments (none posted)

masqmail: buffer overflow

Package(s):	masqmail	CVE #(s):	CAN-2002-1279
Created:	November 12, 2002	Updated:	November 13, 2002
Description:	A set of buffer overflows have been discovered in masqmail, a mail transport agent for hosts without a permanent Internet connection. In addition to this privileges were dropped only after reading a user supplied configuration file. Together this could be exploited to gain unauthorized root access to the machine on which masqmail is installed.
Alerts:	Debian DSA-194-1 2002-11-12

Comments (none posted)

PHP: vulnerability in mail function

Package(s):	php	CVE #(s):	CAN-2002-0985 CAN-2002-0986
Created:	November 13, 2002	Updated:	October 1, 2003
Description:	Two vulnerabilities exists in the mail() PHP function. The first one allows the execution of any program/script bypassing safe_mode restriction, the second one may give an open-relay script if the mail() function is not carefully used in PHP scripts. See this Bugtraq report for more details. Note that this is a different vulnerability than the previous PHP mail() problem, which affected versions through 4.1.0. CAN-2002-0985 CAN-2002-0986
Alerts:	SCO Group CSSA-2003-008.0 2003-03-04 Gentoo 200211-005 2002-11-20 EnGarde ESA-20021122-031 2002-11-22 Conectiva CLA-2002:545 2002-11-13 Red Hat RHSA-2002:213-06 2002-11-11

Comments (none posted)

traceroute-nanog: buffer overflow and root exploit

Package(s):	traceroute-nanog/nkitb	CVE #(s):
Created:	November 12, 2002	Updated:	February 27, 2003
Description:	Traceroute is a tool that can be used to track packets in a TCP/IP network to determine it's route or to find out about not working routers. Traceroute-nanog requires root privilege to open a raw socket. It does not relinquish these privileges after doing so. This allows a malicious user to gain root access by exploiting a buffer overflow at a later point.
Alerts:	Debian DSA-254-1 2003-02-27 SuSE SuSE-SA:2002:043 2002-11-12

Comments (none posted)

wmaker: buffer overflow in Window Maker image handling code

Package(s):	wmaker windowmaker	CVE #(s):	CAN-2002-1277
Created:	November 7, 2002	Updated:	February 6, 2003
Description:	Al Viro found a problem in the image handling code used in Window Maker, a popular NEXTSTEP like window manager. When creating an image it would allocate a buffer by multiplying the image width and height, but did not check for an overflow. This makes it possible to overflow the buffer. This could be exploited by using specially crafted image files (for example when previewing themes).
Alerts:	Red Hat RHSA-2003:043-12 2003-02-05 Mandrake MDKSA-2002:085 2002-12-02 Conectiva CLA-2002:548 2002-11-18 Debian DSA-190-1 2002-11-07

Comments (none posted)

Updated vulnerabilities

Apache shared memory scoreboard vulnerabilities

Package(s):	apache	CVE #(s):	CAN-2002-0839
Created:	October 9, 2002	Updated:	December 18, 2002
Description:	Versions of Apache prior to 1.3.27 contain a couple of scoreboard-related vulnerabilities which can be exploited by local users running under the Apache user ID. In-server scripting languages, such as PHP, are the most likely means of carrying out the attacks. One vulnerability causes the server to fork off new processes, leading to denial of service scenarios; the other allows an attacker to send SIGUSR1 to any process as root, probably killing that process. See this iDEFENSE advisory for the details.
Alerts:	Mandrake MDKSA-2002:068-1 2002-12-18 SCO Group CSSA-2002-056.0 2002-12-05 Debian DSA-195-1 2002-11-13 Debian DSA-188-1 2002-11-05 Debian DSA-187-1 2002-11-04 Trustix 2002-0069 2002-10-17 Mandrake MDKSA-2002:067 2002-10-15 Gentoo apache-20021015 2002-10-15 EnGarde ESA-20021007-024 2002-10-07 Conectiva CLA-2002:530 2002-10-07 OpenPKG OpenPKG-SA-2002.009 2002-10-04

Comments (3 posted)

Heap corruption vulnerability in at

Package(s):	at at, sudo, xchat	CVE #(s):	CAN-2002-0004
Created:	May 21, 2002	Updated:	May 15, 2003
Description:	The at command has a potentially exploitable heap corruption bug. (First LWN report:  January 17th).
Alerts:	EnGarde ESA-20030515-015 2003-05-15 Yellow Dog YDU-20020127-9 2002-01-27 SuSE SuSE-SA:2002:003 2001-01-16 Slackware sl-1011706104 2002-01-22 Red Hat RHSA-2002:015-15 2002-02-07 Red Hat RHSA-2002:015-13 2002-01-22 Mandrake MDKSA-2002:007 2002-01-18 Debian DSA-102-2 2002-01-18 Debian DSA-102-1 2002-01-16

Comments (none posted)

bind buffer overflow vulnerability in DNS resolver libraries

Package(s):	bind glibc	CVE #(s):	CAN-2002-0651 CAN-2002-0684
Created:	July 8, 2002	Updated:	October 1, 2003
Description:	The BIND 4.9.8-OW2 patch and BIND 4.9.9 release (and thus 4.9.9-OW1) include fixes for a libc related vulnerability which does not affect Linux. Updates from the Internet Software Consortium (ISC) are available from here. No release or branch of Openwall GNU/*/Linux (Owl) is known to be affected, due to Olaf Kirch's fixes for this problem getting into the GNU C library more than two years ago. Unfortunatly that does not mean that Linux systems are not vulnerable. Similar code, without Olaf Firch's fixes, is in the glibc getnetbyXXX functions. These functions are described in the SuSE alert as " used by very few applications only, such as ifconfig and ifuser, which makes exploits less likely." CERT Advisory: CA-2002-19 Buffer Overflow in Multiple DNS Resolver Libraries CAN-2002-0651 CAN-2002-0684
Alerts:	Mandrake MDKSA-2002:050 2002-08-13 Yellow Dog YDU-20020810-3 2002-08-10 Eridani ERISA-2002:035 2002-08-09 Red Hat RHSA-2002:133-13 2002-08-08 SCO Group CSSA-2002-034.0 2002-08-05 Yellow Dog YDU-20020801-2 2002-08-01 Eridani ERISA-2002:028 2002-07-25 Red Hat RHSA-2002:139-10 2002-07-22 EnGarde ESA-20020724-018 2002-07-24 Mandrake MDKSA-2002:043 2002-07-16 Trustix 2002-0061 2002-07-15 Gentoo glibc-20020713 2002-07-13 Conectiva CLA-2002:507 2002-07-11 SuSE SuSE-SA:2002:026 2002-07-09 OpenPKG OpenPKG-SA-2002.006 2002-07-04

Comments (1 posted)

Potential unauthorized root access vulnerability in dietlibc

Package(s):	dietlibc	CVE #(s):	CAN-2002-0391
Created:	August 14, 2002	Updated:	December 5, 2002
Description:	Felix von Leitner, discovered a potential division by zero bug in code derived from the SunRPC library with is used in dietlibc, a libc optimized for small size. The bug could be exploited to gain unauthorized root access to software linking to dietlibc. CERT/CC Vulnerability Note VU#192995 Integer overflow in xdr_array() function when deserializing the XDR stream
Alerts:	SCO Group CSSA-2002-055.0 2002-12-04 Debian DSA-146-2 2002-08-08 Debian DSA-146-1 2002-08-08

Comments (none posted)

dvips: command execution vulnerability

Package(s):	dvips	CVE #(s):	CAN-2002-0836
Created:	October 16, 2002	Updated:	June 10, 2003
Description:	The dvips utility uses the system() function improperly when managing fonts. An attacker who can craft the right sort of print job can use this vulnerability to execute commands under the UID used by the print system.
Alerts:	Immunix IMNX-2003-7+-016-01 2003-06-09 OpenPKG OpenPKG-SA-2002.015 2002-12-16 Debian DSA-207-1 2002-12-11 Conectiva CLA-2002:537 2002-10-29 Mandrake MDKSA-2002:071 2002-10-24 Mandrake MDKSA-2002:070 2002-10-23 Gentoo tetex-20021018 2002-10-18 Red Hat RHSA-2002:194-18 2002-10-08

Comments (none posted)

Filename disclosure vulnerability in fam

Package(s):	fam	CVE #(s):	CAN-2002-0875
Created:	August 19, 2002	Updated:	January 5, 2005
Description:	"fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible.
Alerts:	Red Hat RHSA-2005:005-01 2005-01-05 Debian DSA-154-1 2002-08-15

Comments (none posted)

Another set of fetchmail buffer overflows

Package(s):	fetchmail fetchmail-ssl	CVE #(s):
Created:	October 1, 2002	Updated:	December 17, 2002
Description:	e-matters GmbH has issued an advisory warning of a new set of buffer overflows in the fetchmail header parsing code. The vulnerabilities have been fixed in fetchmail 6.1.0.
Alerts:	OpenPKG OpenPKG-SA-2002.016 2002-12-17 Gentoo 200212-3 2002-12-15 SCO Group CSSA-2002-051.0 2002-11-21 Conectiva CLA-2002:531 2002-10-16 Debian DSA-171-1 2002-10-07 Red Hat RHSA-2002:215-09 2002-10-07 EnGarde ESA-20021003-023 2002-10-03 Mandrake MDKSA-2002:063 2002-10-01 Gentoo fetchmail-20021001 2002-10-01

Comments (none posted)

GNU fileutils race condition

Package(s):	fileutils ucdsnmp	CVE #(s):	CAN-2002-0435
Created:	May 21, 2002	Updated:	May 16, 2003
Description:	A race condition in rm may cause the root user to delete the whole filesystem. The problem exists in the version of rm in fileutils 4.1 stable and 4.1.6 development version. A patch is available. (First LWN report: May 2).
Alerts:	Immunix IMNX-2003-7+-010-01 2003-05-16 Red Hat RHSA-2003:015-05 2003-02-12 Trustix 2002-0052 2002-06-06 SuSE SuSE-SA:2002:012 2002-04-08 Mandrake MDKSA-2002:031 2002-05-16 SCO Group CSSA-2002-018.1 2002-05-13

Comments (none posted)

Potential remote root exploit in glibc

Package(s):	glibc	CVE #(s):	CAN-2002-0391
Created:	August 14, 2002	Updated:	June 30, 2003
Description:	Felix von Leitner, discovered a potential division by zero bug in code derived from the SunRPC library which is used in glibc.This bug could be exploited to gain unauthorized root access to software linking to glibc. Updating as soon as practical is a good idea. Because SunRPC-derived XDR libraries are used by a variety of vendors in a variety of applications, this defect may lead to a number of differing security problems. Exploiting this vulnerability will lead to denial of service, execution of arbitrary code, or the disclosure of sensitive information. CERT/CC Vulnerability Note VU#192995 Integer overflow in xdr_array() function when deserializing the XDR stream
Alerts:	Debian DSA-333-1 2003-06-27 Conectiva CLA-2002:535 2002-10-29 Trustix 2002-0070 2002-10-17 EnGarde ESA-20021003-021 2002-10-03 Gentoo glibc-20020927 2002-09-27 Gentoo dietlibc-20020927 2002-09-27 Debian DSA-149-2 2002-09-26 Mandrake MDKSA-2002:061 2002-09-23 Gentoo glibc-20020905 2002-09-05 SuSE SuSE-SA:2002:031 2002-08-30 Trustix 2002-0067 2002-08-13 Eridani ERISA-2002:036 2002-08-13 Red Hat RHSA-2002:166-07 2002-08-12 Debian DSA-149-1 2002-08-13

Comments (none posted)

Buffer overflow in groff

Package(s):	groff	CVE #(s):	CAN-2002-0003
Created:	May 21, 2002	Updated:	December 9, 2002
Description:	The groff package has a buffer overflow vulnerability; if it is used with the print system, it is conceivably exploitable remotely.
Alerts:	SCO Group CSSA-2002-057.0 2002-12-06 Gentoo groff-20021019 2002-10-19 Yellow Dog YDU-20020127-11 2002-01-27 Trustix 2002-0020 2002-01-18 Red Hat RHSA-2002:004-06 2002-01-14 Mandrake MDKSA-2002:012 2002-02-07

Comments (none posted)

Buffer overflow in gv

Package(s):	gv	CVE #(s):	CAN-2002-0838
Created:	October 1, 2002	Updated:	November 25, 2002
Description:	gv, a graphical front end to ghostscript, has a buffer overflow vulnerability which can be exploited by a properly crafted PostScript or PDF file. If a user can be tricked into viewing such a file, arbitrary code can be executed with that user's privileges. See this iDEFENSE advisory for the details.
Alerts:	SCO Group CSSA-2002-053.0 2002-11-22 Conectiva CLA-2002:542 2002-10-31 Debian DSA-182-1 2002-10-28 Mandrake MDKSA-2002:069 2002-10-21 Debian DSA-179-1 2002-10-18 Gentoo ggv-20021017 2002-10-17 Debian DSA-176-1 2002-10-16 Red Hat RHSA-2002:212-06 2002-09-30

Comments (none posted)

heartbeat: remotely exploitable buffer overflow

Package(s):	heartbeat	CVE #(s):
Created:	October 16, 2002	Updated:	November 6, 2002
Description:	The heartbeat failover system has a remotely exploitable buffer overflow vulnerability; versions prior to 0.4.9e and 0.4.9.2 are affected. Any system that is worth running heartbeat on is worth upgrading. See the advisory for the details.
Alerts:	Conectiva CLA-2002:540 2002-10-30 SuSE SuSE-SA:2002:037 2002-10-14 Debian DSA-174-1 2002-10-14

Comments (none posted)

UW imapd remotely exploitable buffer overflow

Package(s):	imap	CVE #(s):	CAN-2002-0379
Created:	June 5, 2002	Updated:	December 20, 2002
Description:	UW imapd versions 2000c and prior allow remote authenticated users to execute code via a buffer overflow. A malicious user can craft a request to run commands on the server under their UID and GID. (First LWN report: May 23).
Alerts:	SuSE SuSE-SA:2002:048 2002-12-20 Trustix 2002-0054 2002-06-06 EnGarde ESA-20020607-013 2002-06-07 Yellow Dog YDU-20020606-1 2002-06-06 Red Hat RHSA-2002:092-11 2002-05-22 Mandrake MDKSA-2002:034 2002-05-27 Eridani ERISA-2002:018 2002-05-25 Conectiva CLA-2002:487 2002-05-24 SCO Group CSSA-2002-021.0 2002-05-15

Comments (2 posted)

Cross-site scripting vulnerability in Konqueror for KDE 3.0.3

Package(s):	kdelibs	CVE #(s):
Created:	September 17, 2002	Updated:	November 18, 2002
Description:	Konqueror for KDE 3.0.3, and earlier versions, is subject to this cross-site scripting vulnerability. Since the problem is in kdelibs, any other application which uses the KHTML renderer is also vulnerable. Javascript code running in one frame can access other frames which should be inaccessible. The problem is fixed in kdelibs 3.0.3a.
Alerts:	SCO Group CSSA-2002-047.0 2002-11-15 Mandrake MDKSA-2002:064 2002-10-09 Conectiva CLA-2002:525 2002-09-20 Debian DSA-167-1 2002-09-16

Comments (2 posted)

kernel: several security issues fixed

Package(s):	kernel	CVE #(s):
Created:	October 22, 2002	Updated:	November 22, 2002
Description:	A number of security fixes have gone out for the 2.2 and 2.4 kernels. There are no known exploits at this time, but upgrading will make sense anyway. As always with kernel updates, read the distributor instructions carefully; there is usually more involved than just installing a new package.
Alerts:	EnGarde ESA-20021122-030 2002-11-22 EnGarde ESA-20021022-026 2002-10-22 Trustix 2002-0068 2002-10-17 Red Hat RHSA-2002:210-06 2002-10-10 Red Hat RHSA-2002:205-15 2002-10-15 Red Hat RHSA-2002:206-12 2002-10-15

Comments (none posted)

krb5: Buffer Overflow in Kerberos Administration Daemon

Package(s):	krb5, heimdal	CVE #(s):	CAN-2002-1235
Created:	October 29, 2002	Updated:	January 14, 2003
Description:	CERT Advisory CA-2002-29 Buffer Overflow in Kerberos Administration Daemon Systems Affected MIT Kerberos version 4 and version 5 up to and including krb5-1.2.6 KTH eBones prior to version 1.2.1 and KTH Heimdal prior to version 0.5.1 Other Kerberos implementations derived from vulnerable MIT or KTH code Overview Multiple Kerberos distributions contain a remotely exploitable buffer overflow in the Kerberos administration daemon. A remote attacker could exploit this vulnerability to gain root privileges on a vulnerable system. The CERT/CC has received reports that indicate that this vulnerability is being exploited. In addition, MIT advisory MITKRB5-SA-2002-002 notes that an exploit is circulating. We strongly encourage sites that use vulnerable Kerberos distributions to verify the integrity of their systems and apply patches or upgrade as appropriate.
Alerts:	Mandrake MDKSA-2002:073-1 2003-01-13 Red Hat RHSA-2002:242-06 2002-11-06 Conectiva CLA-2002:534 2002-10-25 Debian DSA-185-1 2002-10-31 Debian DSA-184-1 2002-10-30 Sorcerer SORCERER2002-10-27 2002-10-27 Mandrake MDKSA-2002:073 2002-10-29 Debian DSA-183-1 2002-10-29 Gentoo kth-krb-20021026 2002-10-26

Comments (none posted)

linuxconf: bad sendmail configuration file creation

Package(s):	linuxconf	CVE #(s):
Created:	November 6, 2002	Updated:	November 6, 2002
Description:	The linuxconf "mailconf" module can create sendmail configurations which allow the server to run as an open relay, instantly turning your site into a spammer's tool and getting you onto blacklists.
Alerts:	Conectiva CLA-2002:544 2002-11-06

Comments (1 posted)

log2mail: buffer overflow

Package(s):	log2mail	CVE #(s):
Created:	November 6, 2002	Updated:	November 6, 2002
Description:	Enrico Zini discovered a buffer overflow in log2mail, a daemon for watching logfiles and sending lines with matching patterns via mail. The log2mail daemon is started upon system boot and runs as root. A specially crafted (remote) log message could overflow a static buffer, potentially leaving log2mail to execute arbitrary code as root.
Alerts:	Debian DSA-186-1 2002-11-01

Comments (none posted)

luxman: pathname vulnerability

Package(s):	luxman	CVE #(s):	CAN-2002-1245
Created:	November 6, 2002	Updated:	November 6, 2002
Description:	LuxMan is a maze game which, one would think, would not be much of a threat. It has, however, a pathname vulnerability that can be turned into a local root exploit. Versions through 0.41 are vulnerable.
Alerts:	Debian DSA-189-1 2002-11-06

Comments (none posted)

perl-MailTools: remote command execution

Package(s):	MailTools	CVE #(s):	CAN-2002-1271
Created:	November 5, 2002	Updated:	September 19, 2003
Description:	The SuSE Security Team reviewed critical Perl modules, including the Mail::Mailer package. This package contains a security hole which allows remote attackers to execute arbitrary commands in certain circumstances. This is due to the usage of mailx as default mailer which allows commands to be embedded in the mail body. Note that mail processing programs which use this package can be affected by this vulnerability; in particular, SpamAssassin is vulnerable if you use the -r or -w flags.
Alerts:	Debian DSA-386-1 2003-09-18 Gentoo 200302-01 2003-02-02 Mandrake MDKSA-2002:076 2002-11-07 Gentoo 200211-001 2002-11-06 SuSE SuSE-SA:2002:041 2002-11-05

Comments (none posted)

Cross-site scripting vulnerability in mhonarc

Package(s):	mhonarc	CVE #(s):	CAN-2002-0738 CAN-2002-1307 CAN-2002-1388
Created:	September 11, 2002	Updated:	January 3, 2003
Description:	Mhonarc is an HTML formatter for electronic mail; it can be vulnerable to cross-site scripting problems when presented with maliciously crafted messages. This problem is fixed in mhonarc version 2.5.3, but it is not clear that all possible vulnerabilities have been fixed. See the Debian advisory below for information on how to disable text/html attachment support in mhonarc, which may be a more secure solution.
Alerts:	Debian DSA-221-1 2003-01-03 Debian DSA-199-1 2002-11-19 Debian DSA-163-1 2002-09-09

Comments (none posted)

PHP Remote Compromise/DOS Vulnerability

Package(s):	mod_php4	CVE #(s):
Created:	July 22, 2002	Updated:	February 18, 2003
Description:	PHP 4.2.0 and 4.2.1 have an error in the handling of POST requests which can lead to the corruption of memory, and the usual bad consequences. According to this alert, the vulnerability can only be used for denial of service on x86 systems - there is no way to get it to run exploit code. SPARC/Solaris systems are apparently vulnerable to full remote compromise. According to the CERT Advisory, almost every Linux distributor, it seems, ships older (and thus not vulnerable) versions of PHP. Note that, sometimes, systems thought to be safe from remote compromise turn out to be vulnerable to a modified attack, so x86 users should not relax too much. The solution, for those systems with PHP 4.2.0 or 4.2.1 installed, is to upgrade to PHP 4.2.2. For more information see the alert from the discover of the vulnerability, Stefan Esser of e-matters GmbH, or the security advisory from the php team. CERT Advisory: CA-2002-21 Vulnerability in PHP
Alerts:	SuSE SuSE-SA:2003:0009 2003-02-18

Comments (1 posted)

mod_ssl: cross site scripting problem

Package(s):	mod_ssl, libapache-mod-ssl	CVE #(s):	CAN-2002-1157
Created:	October 22, 2002	Updated:	December 12, 2002
Description:	Joe Orton discovered a cross site scripting problem in mod_ssl, an Apache module that adds Strong cryptography (i.e. HTTPS support) to the webserver. The module will return the server name unescaped in the response to an HTTP request on an SSL port. Like the other recent Apache XSS bugs, this only affects servers using a combination of "UseCanonicalName off" and wildcard DNS. This is very unlikely to happen, though. Apache 2.0/mod_ssl is not vulnerable since it already escapes this HTML.
Alerts:	Red Hat RHSA-2002:222-21 2002-11-25 Conectiva CLA-2002:541 2002-10-30 EnGarde ESA-20021029-027 2002-10-29 Gentoo mod_ssl-20021027 2002-10-27 Mandrake MDKSA-2002:072 2002-10-24 OpenPKG OpenPKG-SA-2002.010 2002-10-23 Debian DSA-181-1 2002-10-22

Comments (none posted)

Mozilla: Privacy leak and other vulnerabilities

Package(s):	mozilla	CVE #(s):	CAN-2002-1126 CAN-2002-1091
Created:	November 1, 2002	Updated:	February 13, 2003
Description:	Mozilla 1.1 and earlier, and Mozilla-based browsers such as Netscape and Galeon, set the document referrer too quickly in certain situations when a new page is being loaded, which allows web pages to determine the next page that is being visited, including manually entered URLs. Netscape 6.2.3 and earlier, and Mozilla 1.0.1, allow remote attackers to corrupt heap memory and execute arbitrary code via a GIF image with a zero width. See also Mozilla's Recently fixed security issues page. All users are encouraged to upgrade to this latest stable 1.0.x release of Mozilla.
Alerts:	Conectiva CLA-2003:568 2003-02-13 Mandrake MDKSA-2002:075 2002-10-31

Comments (none posted)

ypserv: NIS information leak

Package(s):	nis, ypserv	CVE #(s):	CAN-2002-1232
Created:	October 21, 2002	Updated:	December 5, 2002
Description:	Thorsten Kukuck discovered a problem in the ypserv program which is part of the Network Information Services (NIS). A memory leak in all versions of ypserv prior to 2.5 is remotely exploitable. When a malicious user could request a non-existing map the server will leak parts of an old domainname and mapname.
Alerts:	SCO Group CSSA-2002-054.0 2002-12-04 Mandrake MDKSA-2002:078 2002-11-18 Conectiva CLA-2002:539 2002-10-30 Gentoo 200210-010 2002-10-28 Red Hat RHSA-2002:223-07 2002-10-24 Debian DSA-180-1 2002-10-21

Comments (none posted)

Buffer overflow in nss_ldap

Package(s):	nss_ldap	CVE #(s):	CAN-2002-0825 CAN-2002-0374
Created:	October 9, 2002	Updated:	December 11, 2002
Description:	The nss_ldap package has a buffer overflow which can be exploited when the module configures itself from information in DNS. The problem is fixed in nss_ldap-199 and later.
Alerts:	SCO Group CSSA-2002-058.0 2002-12-10 Gentoo nss_ldap-20021013 2002-10-13 Red Hat RHSA-2002:175-16 2002-10-03

Comments (none posted)

Remotely exploitable vulnerability in pine

Package(s):	pine	CVE #(s):	CAN-2002-0014
Created:	May 21, 2002	Updated:	November 27, 2002
Description:	Pine has an unpleasant vulnerability in URL handling vulnerability which can lead to command execution by remote attackers. (First LWN report:  January 17th). This vulnerability is remotely exploitable; updating is a good idea. Note: If an update isn't yet available for your distribution, setting enable-msg-view-urls to "off" in pine's setup will avoid the vulnerability. (Thanks to Greg Herlein).
Alerts:	SuSE SuSE-SA:2002:046 2002-11-25 Yellow Dog YDU-20020127-8 2002-01-27 Slackware sl-1010936849 2002-01-13 Red Hat RHSA-2002:009-06 2002-01-14 EnGarde ESA-20020114-002 2002-01-14 Conectiva CLA-2002:460 2002-01-31

Comments (none posted)

Buffer overflow vulnerabilities in PostgreSQL

Package(s):	PostgreSQL	CVE #(s):
Created:	August 21, 2002	Updated:	January 27, 2003
Description:	PostgreSQL 7.2.2 has been released in response to a number of buffer overrun vulnerabilities which have been identified recently. "...it should be noted that these vulnerabilities are only critical on 'open' or 'shared' systems, as they require the ability to be able to connect to the database before they can be exploited." Buffer overflow vulnerabilities fixed include those reported by "Sir Mordred The Traitor" in the cash_words, repeat, and lpad and rpad functions.
Alerts:	Yellow Dog YDU-20030127-5 2003-01-27 Red Hat RHSA-2003:001-16 2003-01-14 Red Hat RHSA-2003:010-10 2003-01-14 SuSE SuSE-SA:2002:038 2002-10-21 Trustix 2002-0071 2002-10-17 Mandrake MDKSA-2002:062 2002-10-01 Conectiva CLA-2002:524 2002-09-19 Debian DSA-165-1 2002-09-12 Gentoo postgresql-20020826 2002-08-26

Comments (none posted)

PXE server denial of service vulnerability

Package(s):	pxe	CVE #(s):	CAN-2002-0835
Created:	September 4, 2002	Updated:	November 11, 2002
Description:	The PXE server can be crashed using DHCP packets from some Voice Over IP (VOIP) phones. Maliciously formed DHCP packets could be used by a remote attacker to effect a denial of service attack. The PXE package contains the PXE (Preboot eXecution Environment) server and code needed for Linux to boot from a boot disk image on a Linux PXE server.
Alerts:	SCO Group CSSA-2002-044.0 2002-11-11 Eridani ERISA-2002:041 2002-09-03 Red Hat RHSA-2002:162-12 2002-08-30

Comments (none posted)

Local arbitrary code execution vulnerability in Python

Package(s):	python	CVE #(s):	CAN-2002-1119
Created:	August 28, 2002	Updated:	October 1, 2003
Description:	Zack Weinberg discovered that os._execvpe from os.py uses a predictable name which could lead to execution of arbitrary code. According to the Debian advisory, the problem was present in Python versions 1.5, 2.1 and 2.2. CAN-2002-1119
Alerts:	Red Hat RHSA-2002:202-33 2003-02-12 OpenPKG OpenPKG-SA-2003.006 2003-01-23 Red Hat RHSA-2002:202-25 2003-01-21 Mandrake MDKSA-2002:082-1 2002-12-09 Mandrake MDKSA-2002:082 2002-11-25 SCO Group CSSA-2002-045.0 2002-11-14 Trustix 2002-0073 2002-10-17 Gentoo python-20021003 2002-10-03 Conectiva CLA-2002:527 2002-10-01 Debian DSA-159-2 2002-09-09 Debian DSA-159-1 2002-08-28

Comments (none posted)

Multiple-use vulnerability in Safe.pm

Package(s):	Safe.pm	CVE #(s):	CAN-2002-1323
Created:	October 9, 2002	Updated:	February 20, 2004
Description:	usePerl has a description of a vulnerability in the Safe.pm Perl module. It seems that if a Safe compartment is used more than once, it ceases to be safe. The problem is fixed in Safe 2.08.
Alerts:	SCO Group CSSA-2004-007.0 2004-02-20 Gentoo 200212-6 2002-12-20 Trustix 2002-0087 2002-12-19 OpenPKG OpenPKG-SA-2002.014 2002-12-16 Debian DSA-208-1 2002-12-12

Comments (none posted)

sendmail smrsh bypass vulnerability

Package(s):	sendmail	CVE #(s):	CAN-2002-1165
Created:	October 2, 2002	Updated:	November 29, 2002
Description:	iDEFENSE has posted an advisory warning of a couple of ways of bypassing the restrictions imposed by the sendmail "smrsh" utility. smrsh puts limits on which programs a user may run out of a .forward file; this vulnerability could give a local user undesired access to the mail server system. A patch has been made available from sendmail.org which closes the vulnerability.
Alerts:	Mandrake MDKSA-2002:083 2002-11-28 SCO Group CSSA-2002-052.0 2002-11-21 Conectiva CLA-2002:532 2002-10-16 Gentoo sendmail-20021013 2002-10-13

Comments (none posted)

Multiple vulnerabilities fixed in Squid-2.4.STABLE7

Package(s):	squid	CVE #(s):
Created:	July 8, 2002	Updated:	November 15, 2002
Description:	Here is the security advisory for the Squid proxy server reporting several vulnerabilities in versions up to and including 2.4.STABLE7. Several of the bugs are believed to allow remote code execution. The security advisory lists the following changes: Several bugfixes and cleanup of the Gopher client, both to correct some security issues and to make Squid properly render certain Gopher menus. Security fixes in how Squid parses FTP directory listings into HTML FTP data channels are now sanity checked to match the address of the requested FTP server. This to prevent theft or injection of data. See the new ftp_sanitycheck directive if this sanity check is not desired. The MSNT auth helper has been updated to v2.0.3+fixes for buffer overflow security issues found in this helper. A security issue in how Squid forwards proxy authentication credentials has been fixed
Alerts:	SCO Group CSSA-2002-046.0 2002-11-14 Eridani ERISA-2002:031 2002-07-26 Mandrake MDKSA-2002:044 2002-07-17 Trustix 2002-0062 2002-07-15 SuSE SuSE-SA:2002:025 2002-07-09 Conectiva CLA-2002:506 2002-07-05

Comments (none posted)

squirrelmail: cross-site scripting vulnerability

Package(s):	squirrelmail	CVE #(s):	CAN-2002-1131 CAN-2002-1132
Created:	October 16, 2002	Updated:	January 2, 2003
Description:	The Squirrelmail web mail package has a cross-site scriptinog vulnerability; versions 1.2.7 and prior are affected. See the advisory for details.
Alerts:	Debian DSA-220-1 2003-01-02 Gentoo 200212-4 2002-12-15 Debian DSA-191-2 2002-11-07 Debian DSA-191-1 2002-11-07 Red Hat RHSA-2002:204-10 2002-10-09

Comments (none posted)

syslog-ng: buffer overflow vulnerability

Package(s):	syslog-ng	CVE #(s):
Created:	October 16, 2002	Updated:	November 14, 2002
Description:	Versions 1.4.15 and 1.5.20 (and prior) of the syslog-ng system logging package have a remotely exploitable buffer overflow vulnerability; see this advisory for the details.
Alerts:	Conectiva CLA-2002:547 2002-11-14 SuSE SuSE-SA:2002:039 2002-10-31 EnGarde ESA-20021029-028 2002-10-29 EnGarde ESA-20021016-025 2002-10-16 Debian DSA-175-1 2002-10-15 Gentoo syslog-ng-20021012 2002-10-12

Comments (none posted)

File overwrite vulnerability in tar and unzip

Package(s):	tar unzip	CVE #(s):	CAN-2001-1267 CAN-2001-1268 CAN-2001-1269 CAN-2002-0399
Created:	October 1, 2002	Updated:	April 10, 2006
Description:	The tar utility does not properly filter file names containing "../", meaning that a hostile archive can, if unpacked by an unsuspecting user, overwrite any file that is writable by that user. GNU tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42 has the same vulnerability.
Alerts:	Fedora-Legacy FLSA:183571-1 2006-04-04 Red Hat RHSA-2006:0195-01 2006-02-21 Conectiva CLA-2002:538 2002-10-29 Mandrake MDKSA-2002:066 2002-10-10 Mandrake MDKSA-2002:065 2002-10-10 EnGarde ESA-20021003-022 2002-10-03 Gentoo unzip-20021001 2002-10-01 Gentoo tar-20021001 2002-10-01 Red Hat RHSA-2002:096-24 2002-09-18

Comments (1 posted)

Multiple vendor telnetd vulnerability

Package(s):	telnet Telnet netkit-telnet-ssl kerberos telnetd netkit-telnet nkitb/nkitserv/telnetd krb5	CVE #(s):
Created:	May 21, 2002	Updated:	October 5, 2004
Description:	This vulnerability, originally thought to be confined to BSD-derived systems, was first covered in the July 26th Security Summary. It is now known that Linux telnet daemons are vulnerable as well.
Alerts:	Gentoo 200410-03 2004-10-05 Yellow Dog YDU-20010810-2 2001-08-10 Yellow Dog YDU-20010810-1 2001-08-10 SuSE SuSE-SA:2001:029 2001-09-03 Slackware sl-997726350 2001-08-09 Red Hat RHSA-2001:100-02 2001-08-09 Red Hat RHSA-2001:099-09 2002-02-07 Red Hat RHSA-2001:099-06 2001-08-09 Progeny PROGENY-SA-2001-27 2001-08-14 Mandrake MDKSA-2001:093 2001-12-17 Mandrake MDKSA-2001:068 2001-08-13 HP HPSBTL0202-023 2002-02-12 Debian DSA-075-2 2001-08-14 Debian DSA-075-1 2001-08-14 Conectiva CLA-2001:413 2001-08-24 SCO Group CSSA-2001-030.0 2001-08-10

Comments (none posted)

Tomcat 4.x JSP source code exposure vulnerability

Package(s):	tomcat	CVE #(s):
Created:	September 25, 2002	Updated:	January 29, 2003
Description:	Rossen Raykov reports that Tomcat 4.0.5 and 4.1.12 fix a JSP source code exposure vulnerability in "Tomcat 4.0.4 and 4.1.10 (probably all other earlier versions also).". The current version of Tomcat is available here. Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.
Alerts:	Debian DSA-246-1 2003-01-29 Debian DSA-225-1 2002-01-09 Gentoo tomcat-20021015 2002-10-15 Debian DSA-169-1 2002-10-04 Gentoo tomcat-20020925 2002-09-25

Comments (none posted)

webalizer: reverse DNS buffer overflow vulnerability

Package(s):	webalizer	CVE #(s):
Created:	May 21, 2002	Updated:	January 27, 2003
Description:	The cause is a buffer overflow bug. This one sounds nasty. If reverse DNS lookups are enabled in webalizer, "an attacker with control over the victims DNS may spoof responses thus triggering a buffer overflow, potentially leading to a root compromise." Webalizer 2.01-10 "fixes this and a few other buglets that have been discovered in the last month or so". (First LWN report:  April 18th, 2002).
Alerts:	Yellow Dog YDU-20030127-4 2003-01-27 Red Hat RHSA-2002:254-05 2002-12-04 SCO Group CSSA-2002-036.0 2002-10-22 EnGarde ESA-20020423-009 2002-04-23 Conectiva CLA-2002:476 2002-04-26

Comments (none posted)

Webmin/Usermin vulnerabilities

Package(s):	webmin	CVE #(s):
Created:	May 21, 2002	Updated:	January 10, 2003
Description:	Webmin is a web-based interface for system administration for Unix. Webmin has cross-site scripting and session ID spoofing vulnerabilities which are fixed in the May 6, 2002 release of version 0.970. (First LWN report: May 9). This one is scary. The session ID spoofing vulnerability allows the "possibility that arbitrary commands may be executed with root privileges." Upgrading is strongly recommended. At a minimum avoid the "preconditions for a successful exploit" by disabling password timeouts under Webmin->Configuration->Authentication.
Alerts:	SCO Group CSSA-2003-002.0 2003-01-09 Yellow Dog YDU-20020522-7 2002-05-22 Mandrake MDKSA-2002:033 2002-05-21

Comments (1 posted)

Multiple vulnerabilities in wordtrans

Package(s):	wordtrans	CVE #(s):	CAN-2002-0837
Created:	September 11, 2002	Updated:	February 4, 2003
Description:	The "wordtrans" interface to multilingual dictionaries suffers from input validation and cross-site scripting vulnerabilities; versions through 1.1pre8 are vulnerable. See this Guardent advisory for details.
Alerts:	Red Hat RHSA-2002:188-08 2002-09-05

Comments (none posted)

Problems with libgtop_daemon

Package(s):	wuftpd libgtop	CVE #(s):
Created:	May 21, 2002	Updated:	May 7, 2003
Description:	The libgtop_daemon package is a GNOME program which makes system information available remotely. LWN reported the remotely exploitable format string and buffer overflow vulnerabilities in that package on December 6th. On November 28th disabling the libgtop_daemon on systems where it is running until an update is available. Many Linux systems do not run libgtop by default, but applying the update is a good idea anyway.
Alerts:	Debian DSA-301-1 2003-05-07 Mandrake MDKSA-2001:094 2001-12-19 Debian DSA-098-1 2002-01-09 Conectiva CLA-2002:448 2002-01-03

Comments (1 posted)

Wwwoffle remote privilege escalation vulnerability

Package(s):	wwwoffle	CVE #(s):	CAN-2002-0818
Created:	August 14, 2002	Updated:	October 1, 2003
Description:	The wwwoffle web proxy incorrectly processes HTTP PUT and POST requests with negative Content Length values. "It is believed that an attacker could exploit this bug to gain remote wwwrun access to the system wwwoffled is running on." CAN-2002-0818
Alerts:	SCO Group CSSA-2002-048.0 2002-11-18 Debian DSA-144-1 2002-08-06 SuSE SuSE-SA:2002:029 2002-08-01

Comments (none posted)

Denial of service vulnerability in xinetd

Package(s):	xinetd	CVE #(s):
Created:	August 14, 2002	Updated:	December 3, 2002
Description:	A file descriptor leak into services started from xinetd may be used, by programs it stats, to crash xinetd. Xinetd is a replacement for the BSD derived inetd.
Alerts:	Red Hat RHSA-2002:196-19 2002-12-02 Red Hat RHSA-2002:196-09 2002-10-14 Mandrake MDKSA-2002:053 2002-08-26 Gentoo xinetd-20020814 2002-08-14 Debian DSA-151-1 2002-08-13

Comments (none posted)

Resources

Timing the Application of Security Patches for Optimal Uptime

Steve Beattie, Seth Arnold, Crispin Cowan, Perry Wagle, and Chris Wright published a paper at LISA 2002 entitled "Timing the Application of Security Patches for Optimal Uptime." It is now available for download in PostScript format.

Full Story (comments: none)

Linux Advisory Watch - November 8th 2002

The LinuxSecurity.com Linux Advisory Watch newsletter for November 8 is available.

Full Story (comments: none)

Events

The Conference on Mobile and Wireless Security

MIS Training Institute has announced that the Conference on Mobile and Wireless Security will happen in Scottsdale, Arizona on February 11 to 13, 2003.

Comments (none posted)

Page editor: Jonathan Corbet

Kernel development

Brief items

Kernel release status

The current development kernel is 2.5.47, which was released by Linus on November 10. Changes this time around include more IPSec work (to the point that it works now), a big kernel timer cleanup, continuing work on the large page mechanism, a PowerPC64 update, some XFS updates, improvements to the new crypto API, an ALSA update, a zero-copy NFS server patch, and lots of other fixes and tweaks. The long-format changelog has the details.

Linus's (pre-2.5.48) BitKeeper tree contains more timer cleanups, a rewrite of the software suspend code, Rusty Russell's in-kernel module loader, continuing IPSec work, and various other fixes.

The current development kernel prepatch from Alan Cox is 2.5.47-ac2. It includes the latest ACPI code, some device mapper fixes, some new IDE work, and a number of fixes.

The latest 2.5 status summary from Guillaume Boissiere is dated November 13.

The current stable kernel is 2.4.19. Marcelo has released no prepatches since the first 2.4.20 release candidate came out on October 29.

Comments (none posted)

Kernel development news

2.5 kernel progress charts

Guillaume Boissiere, keeper of the 2.5 Kernel Status Summary, has put together a couple of images showing how features were merged into the 2.5 kernel over time up to the feature freeze. Have a look at the simple progress chart and the compounded chart (also shown at right).

Comments (none posted)

The new module loader

Linus has stated that the October 31 feature freeze date was a deadline for submissions to him, not for actual merging. He has been restrained in what he has merged since then, but one significant change that will show up in 2.5.48 is the new module loader by Rusty Russell. This patch was covered briefly here back in September. As of this writing, the code that has been merged is missing a few little features, like modversions, module parameters, module license checking, and device table support (which is needed to make hotplugging work). Fixes for these omissions are promised for the near future.

Meanwhile, the new code is simpler for both the kernel and user space; it is also safer in a number of ways. It does, however, require a new set of module utilities to work; these can be obtained as a source tarball from Rusty's site.

Comments (none posted)

Some documentation for 2.5 IPSec

As of the 2.5.47 kernel, the new, native Linux IPSec implementation actually (sort of) works. Bert Hubert has been playing with this code, and has put together a quick HOWTO on how to make it go. Anybody who is interested in a solid, stable IPSec implementation in 2.6 (and almost all of us are, whether we realize it or not) should consider having a look and testing it out.

Comments (none posted)

What's to become of devfs?

From a recent posting by Alexander Viro:

He continues with a long list of changes he would like to make to the devfs code; it's a massive set of cleanups which would, it is claimed, shrink the devfs code base considerably and make things work better. Comments were requested on the proposal; the few that came in were favorable.

The posting led to an entirely different sort of discussion, however. As Ted Ts'o asked, how many people are actually using devfs?

The question is worth asking. Despite the fact that devfs has been in the 2.4 kernel since it first shipped, very few distributions are turning it on for their customers. The devfs way of doing things has failed to take over the world.

And, perhaps more to the point, there is a new approach to dynamic device management that, while not yet actually implemented, is attracting interest. The combination of the /sbin/hotplug mechanism and the device model provides (or can provide) everything that is needed to create devfs-like filesystems in user space. The device model, via the sysfs (formerly driverfs) filesystem, provides a complete view of the state of the system, including all attached hardware. /sbin/hotplug gives user space the ability to know about (and react to) changes in the system state. Using that information, user-space code can populate a device directory hierarchy that implements just about any kind of policy that one could imagine.

All it takes is somebody to hack up the remaining pieces; a user-space devfs could easily be a reality in the 2.5 development series. And, since it lives in user space, there are no real issues with the feature freeze.

Of course, none of this points to a removal of devfs in this development series. Removal of features violates the feature freeze as surely as additions do. It is also standard practice to leave such features in place (though "deprecated") for one stable series to give users time to make the transition. So, even if the decision to remove devfs is made (and that certainly has not happened at this point), it will be around for a while.

Comments (17 posted)

Kexec

One of the remaining features that may yet get merged is the "Kexec" patch by Eric Biederman. This patch performs what may seem to be a straightforward task - it reboots the system directly into a new kernel. Things are not always as simple as they seem, however, and this patch has been through an extended period of reworking on its way toward (probable) inclusion.

One might wonder what the use of Kexec is, given that people have somehow managed to reboot their systems for years now. Kexec differs from a normal reboot in that the old kernel loads the new one, and jumps to it, directly. There is no need to reset the hardware and go through the whole BIOS startup routine. So, reboots are faster and, perhaps, more reliable. There is also an obvious advantage for kernel developers, who can simply say "boot that image" without having to tell a boot loader (such as LILO) about it first.

Rebooting on the fly in this manner is not an entirely easy thing to do. The new kernel, after all, probably wants to sit in the same part of memory as the current one. So the new kernel can not be put into its real place until the old kernel has finished shutting down gracefully. But, by that point, the old kernel is no longer in a position to load the new one from user space, or from anywhere else.

So the Kexec code has to start by buffering a copy of the new kernel somewhere else in memory. When user space indicates that it has a new kernel to boot, the Kexec code allocates a big pile of memory pages to hold the kernel code. This code is spread out through (non-high) memory, and is not contiguous or otherwise ready to execute. Also allocated along with the memory for the kernel code is the "reboot code buffer." This buffer is typically just a single page.

When the time comes to boot into the new kernel, the Kexec code does the following:

• Shuts down the kernel, and tries to reset devices to a known state. The code does not unmount filesystems, kill processes, etc.; that work is expected to have been done by user space prior to the reboot call.

• Copies a small bit of assembly code into the reboot code buffer. This code's job is to take the set of pages holding the new kernel and copy them into their real destination - typically overwriting the old kernel.

• Jumps (via a return, actually) into the new kernel.

The original Kexec patch created a kexec() system call which would load the new kernel image as described above, and immediately reboot into that image. That approach, however, wasn't quite what Linus had in mind, even though Linus likes the Kexec idea in general. Why not, asked Linus, split up the operations of loading the new kernel and rebooting into it?

The reasoning for splitting these operations has mostly to do with other possible uses for Kexec. For example, one can imagine all kinds of things that could be done when the kernel panics: boot into a debugger or crash dump generator, or just bring up that old 2.2 kernel that always worked. The problem is that, when the system has gone into a panic, you really do not want it digging around in the filesystem looking for an image to boot; that needs to have been set up ahead of time. And the only way to do that is to split the load and reboot steps.

So the current patch has a kexec_load() system call which loads a kernel image into memory. Then, a new LINUX_REBOOT_CMD_KEXEC command for the existing reboot() call finishes the task. This version of Kexec still does not handle the panic case, but it has most of the infrastructure needed to do that.

Comments (3 posted)

Patches and updates

Kernel trees

• Marc-Christian Petersen: WOLK v3.7.1 UPDATE // [PATCH]. (November 7, 2002)

• Stephen Hemminger: linux-2.5.47-dcl1. (November 12, 2002)

• J.A. Magallon: Linux 2.4.20-rc1-jam2. (November 13, 2002)

Core kernel code

• Jim Houston: alternate Posix timer patch4. (November 7, 2002)

• Dipankar Sarma: RCU statistics 2.5.46. (November 7, 2002)

• Alexander Viro: late-boot cleanups. (November 11, 2002)

• Tim Schmielau: use 64 bit jiffies 1/4. (November 11, 2002)

• Tim Schmielau: use 64 bit jiffies 2/4. (November 11, 2002)

• Tim Schmielau: use 64 bit jiffies 3/4. (November 11, 2002)

• Tim Schmielau: use 64 bit jiffies 4/4. (November 11, 2002)

• Peter Waechtler: unified SysV and POSIX mqueues - complete rewrite. (November 11, 2002)

• Erich Focht: NUMA scheduler (1/2). (November 11, 2002)

• Erich Focht: NUMA scheduler (2/2). (November 11, 2002)

• Eric W. Biederman: Kexec for v2.5.47-bk2. (November 13, 2002)

• george anzinger: POSIX clocks & timers take 11 (NOT HIGH RES). (November 13, 2002)

• george anzinger: High-res-timers part 1 (core) take 14. (November 13, 2002)

• george anzinger: High-res-timers part 2 (x86 platform code) take 14. (November 13, 2002)

• george anzinger: High-res-timers part 3 (posix to hrposix) take 14. (November 13, 2002)

• Pavel Machek: swsusp for 2.5.47 [not for inclusion]. (November 13, 2002)

• Pavel Machek: swsusp: cleanups. (November 13, 2002)

Development tools

• Jeff Martin: LTP-20021107. (November 8, 2002)

• Vamsi Krishna S .: kprobes for 2.5.47. (November 12, 2002)

• Rusty Lynch: kprobes sample driver. (November 13, 2002)

Device drivers

• Paul Mackerras: Update ADB drivers in 2.5. (November 7, 2002)

• Jaroslav Kysela: ALSA update. (November 11, 2002)

• Grover, Andrew: ACPI patches updated (20021111). (November 12, 2002)

• Mukker, Atul: MegaRAID RAID driver version 2.00 - introduced as new megaraid2 in 2.4.x and 2.5.x. (November 13, 2002)

• J.E.J. Bottomley: add request prep functions to SCSI. (November 13, 2002)

Documentation

• Randy.Dunlap: swap mini-howto updated. (November 8, 2002)

• Thomas Molina: 2.5 Problem Report Status for 10 Nov. (November 11, 2002)

• Denis Vlasenko: lk maintainers. (November 13, 2002)

• Rusty Russell: Modules and the Interfaces who Love Them (Take I). (November 13, 2002)

Filesystems and block I/O

• tytso@mit.edu: ext2/3 bugfix 0/6: INTRODUCTION. (November 7, 2002)

• Jan Kara: Quota SMP locking. (November 7, 2002)

• tytso@mit.edu: [0/4]: Ext2/3 updates: Introduction. (November 12, 2002)

• tytso@mit.edu: [1/4]: Ext2/3 updates: Fix/simplify alternate superblock logic. (November 12, 2002)

• tytso@mit.edu: [2/4]: Ext2/3 updates: Cleanup: Eliminate EXT3/2_DEF_RES[UG]ID. (November 12, 2002)

• tytso@mit.edu: [3/4]: Ext2/3 updates: HTREE backwards compatibility patch. (November 12, 2002)

• tytso@mit.edu: [4/4]: Ext2/3 updates: Update required e2fsprogs version. (November 12, 2002)

Kernel building

• Tom Rini: Templates and tweaks (for size performance and more). (November 7, 2002)

Memory management

• Manfred Spraul: numa slab, rediffed against 2.5.46. (November 11, 2002)

• Andrew Morton: 2.5.46-mm2. (November 11, 2002)

• Andrew Morton: 2.5.47-mm1. (November 11, 2002)

• Andrew Morton: 2.5.47-mm2. (November 13, 2002)

• Rik van Riel: 2.4.19-rmap14c. (November 13, 2002)

Networking

• Trond Myklebust: slabify the sunrpc layer. (November 11, 2002)

• Trond Myklebust: Lift the 256 outstanding NFS read/write request limit.. (November 11, 2002)

• Chuck Lever: NFS O_DIRECT clean-up #2. (November 13, 2002)

• Roland Dreier: [RFC] increase MAX_ADDR_LEN. (November 12, 2002)

• Lennert Buytenhek: explicit connection confirmation. (November 12, 2002)

Architecture-specific

• Osamu Tomita: Support for PC-9800 subarchitecture agaist 2.5.47. (November 11, 2002)

• William Lee Irwin III: NUMA-Q: remove PCI bus number mangling. (November 12, 2002)

• William Lee Irwin III: NUMA-Q: use sysdata as quad numbers in pci_scan_bus(). (November 12, 2002)

• William Lee Irwin III: NUMA-Q: fetch quad numbers from struct pci_bus. (November 12, 2002)

• William Lee Irwin III: NUMA-Q: use quad numbers passed to low-level PCI config helpers. (November 12, 2002)

• William Lee Irwin III: NUMA-Q: remove last traces of bus number mangling. (November 12, 2002)

• J.E.J. Bottomley: Voyager subarchitecture for 2.5.47. (November 13, 2002)

Security-related

• Olaf Dietsche: 2.5.46: Filesystem capabilities 0.11. (November 7, 2002)

• Olaf Dietsche: 2.5.46: access permission filesystem 0.11. (November 12, 2002)

• Russell Greene: 18 potential security holes. (November 11, 2002)

Benchmarks and bugs

• Con Kolivas: 2.5.46-mm1 with contest. (November 8, 2002)

• Con Kolivas: 2.4.{18,19{-ck9},20rc1{-aa1}} with contest. (November 11, 2002)

• Con Kolivas: 2.5.47{-mm1} with contest. (November 12, 2002)

Miscellaneous

• David Grothe: Linux-streams registration 2.5.46. (November 8, 2002)

• Albert D. Cahalan: procps 3.1.0. (November 11, 2002)

• Matthias Andree: lk-changelog.pl 0.50. (November 11, 2002)

• Matthias Andree: BK-kernel-tools: update shortlog. (November 11, 2002)

Page editor: Jonathan Corbet

Distributions

Distribution News

Debian Weekly News - November 12th, 2002

The Debian Weekly News is now available. This week: the APT Development requires Help; Hewlett-Packard recently expanded their Test Drive Program to support Debian GNU/Linux; The Debian project was honored with the Linux New Media Award; and much more.

Full Story (comments: none)

Mandrake Linux

The Mandrake Linux Community Newsletter for November 7, 2002, is available. This week news looks at the new CLIC distribution; also get the top 10 "freshest" RPMs from MandrakeClub; and much more.

MandrakeSoft announced the availability of boxed versions of Mandrake Linux 9.0. There are three packaged versions from which to choose: the Mandrake Linux PowerPack and Standard editions are designed for individual users, and the ProSuite Edition is created for small and medium-sized enterprises.

Comments (none posted)

Red Hat Linux

Red Hat has an updated version of the GNU Compiler Collection (GCC) available for Red Hat Linux 7.1, 7.2, and 7.3. This update addresses various issues filled in bug reports.

IBM developerWorks has a tutorial detailing the ins and outs of transforming a stock, "out of the box" Red Hat installation into a finely tuned, stable system customized to individual needs and tastes. The material presented here is based on Red Hat 7.3. Registration is required

Comments (none posted)

Slackware Linux

Slackware current has upgraded to KDE 3.1-rc2.

Comments (none posted)

Armor-plated Linux gets backup (News.com)

News.com covers the release of a new wrapper for the NSA's SE Linux. "The Open Source Development Group (OSDgroup), a Linux training firm, and Houston-based network consultancy Westcam have teamed up to release a package that adds a graphical installer and new security settings to the OS released by the National Security Agency almost two years ago."

Comments (none posted)

SCO Boosts the Number of Applications Available for UnitedLinux

The SCO Group has announced a series of new programs to encourage application development for its SCO Linux Powered by UnitedLinux product to be released this fall. Through its enhanced Developer Network, SCO is providing commercial and Open Source developers with increased educational opportunities, access to technical information and expert technical support to help them write or port applications and drivers for SCO Linux and other UnitedLinux products.

Comments (none posted)

How to do a SuSE 8.1 FTP Install (PCLinuxOnline)

SuSE is a GNU/Linux distribution which does not have freely downloadable ISOs. A workaround to this is installing via FTP. PCLinuxOnline.com shows how to do this.

Comments (none posted)

New Distributions

Bootix Linux

Bootix Linux (now Bootyx Linux) is a bootable Linux CD based on Slackware Linux 8.0 designed to allow the easy imaging of multiple workstations, using the updcast set of Linux tools. Bootix v0.80 was released November 7, 2002.

Comments (none posted)

Minor distribution updates

Astaro Security Linux

Astaro Security Linux has released v3.211 with minor security fixes. "Changes: This Up2Date improves Surf Protection restart, the SelfMonitoring for Surf Protection, and adds a new IDENT Proxy version. It fixes a cosmetic issue in the WebAdmin license display and a DoS IPSec Bug (VU#459371)."

Comments (none posted)

Coyote Linux

Coyote Linux has released v1.0.283 of the Wolverine firewall and VPN server with major bugfixes. "Changes: This version contains fixes for several problems with the PPTP server limiting and refusing connections, IPSEC updates, a new kernel, a completely replaced SNMP subsystem, and adds the beginnings of PPPoE support."

Comments (none posted)

KNOPPIX

KNOPPIX has released v3.1-8-11-2002 with minor feature enhancements. "Changes: This release has a Spanish translation for (/usr/local/bin/)knx-hdinstall, a WINE update (20021031/unstable), the correct DHCP entry in /etc/network/interfaces with netcardconfig, and a PCMCIA update (3.2.2)."

Comments (none posted)

Mindi Linux

Mindi Linux has released v0.71_20021109 with minor bug fixes. "Changes: This version features an updated 2.4.20 kernel, better handling of Debian and Gentoo Linux distributions, better tape/CD support, and numerous bugfixes."

Comments (none posted)

RxLinux

RxLinux has released v1.0.7 with major feature enhancements. "Changes: IPSEC and PPTP are now supported using FreeS/Wan and Poptop. LVS is now supported, and RxLinux can be configured as an LVS director. iptables was added, the kernel was updated to 2.4.19 and patched for IPVS, and OpenMosix was upgraded to 0.2.4. The RxMaster interface was also simplified."

Comments (none posted)

uClinux

uClinux has released v2.5.47-uc0 with major feature enhancements. "Changes: This release uses the latest development kernel. Most of uClinux has been rolled into the main Linux distribution."

Comments (none posted)

Warewulf

Warewulf has released v1.5 with major bugfixes. "Changes: Fixes for bugs in the following tools: wwjobs, nodes, nodeupdate, and nodeconf, a new ability to integrate various kernel args into the node build process, and some minor GUI tweaks to nodes."

Comments (none posted)

Page editor: Rebecca Sobol

Development

The Frequency Clock Free Media System

Version 1.0 of a new open-source multimedia system known as The Frequency Clock has been announced. "We are very happy to let you know about a new open source software system which has been released today, which is a powerful mechanism to manage and control 'channels' of audio and video online. Its designed especially for not-for-profit organisations and the cultural sector, but can be used by anyone who has online audio and video."

The components of the Frequency Clock consist of:

• A Program Database: for containing information about live and pre-recorded programs.
• A Timetabling System: a tool that allows programs to be placed into the program database for scheduled playback.
• A Streaming Media Player: a multi-platform web-based scheduled audio/video playback application.

See the Functionality List for more details.

The system can be used to produce online channels of streaming video and audio for web sites. Media files can be chained together in a schedule for playback by site visitors.

One of the design goals is to have the Streaming Media Player be able to play a wide variety of streaming media formats such as WindowsMedia, Real, and Quicktime, allowing it to replace a collection of proprietary players.

The system has been designed for the following users: "community radio stations, community cable television operators, film and video organisations, museums and galleries, filmmakers and documentary-makers, artists, DJs and musicians."

The Frequency Clock looks like a well thought out system, be sure to check out some of the screen shots on the main web page.

Comments (2 posted)

System Applications

Audio Projects

preamp simulates Fender guitar amp

For you guitar enthusiasts out there, Tim Goetze has put out a new version of preamp, a plugin for the LADSPA system that simulates a Fender vacuum tube (valve) preamplifier.

Comments (none posted)

Electronics

gEDA News

The latest news from the gEDA project includes new snapshots of Icarus Verilog and gaf (gschem and friends).

Comments (none posted)

Networking Tools

Systrace - Interactive Policy Generation for System Calls

A utility known as Systrace is now available for Linux. "Systrace enforces system call policies for applications by constraining the application's access to the system. The policy is generated interactively. Operations not covered by the policy raise an alarm and allow an user to refine the currently configured policy." Thanks to Marius Aamodt Eriksen.

Comments (3 posted)

Printing

CUPS v1.1.16 is Released

Version 1.1.16 of the CUPS printing system has been released. "CUPS 1.1.16 adds support for a new CUPS printer driver for Windows NT/2000/XP that provides accurate page accounting as well as support for the banner, job billing, job priority, and page label options. The new release also contains many small bug fixes and enhancements, including better USB printing support, support for printer names containing any printable character (123print, my-long-printer-name, etc.), and French language localization of the web interface and documentation." See the release notes for the full list of changes.

Comments (none posted)

Web Site Development

Nemein.Net 1.8.3 "Snowstorm" released

Nemein has released the version 1.8.3 of the Nemein.Net Professional Services Automation suite of applications.

Full Story (comments: none)

ZODB 3.2 release plan posted

The release plan for ZODB 3.2 has been published. "There are a small set of proposed features centering around better configuration and management of ZEO and ZODB. Feedback is welcome." Thanks to Jeremy Hylton.

Comments (none posted)

Zope Members News

The most recent headlines on the Zope Members News include: NeoBoard 1.1 alpha 2 released, and Turkish Zope Hosting.

Comments (none posted)

Standards

Announcing the LSB1.3 LI18NUX Level 1 testset beta

A new test set has been released for the Linux Standard Base, LSB 1.3 LI18NUX Level 1.

Full Story (comments: none)

Desktop Applications

Audio Applications

Audacity version 1.1.1 released

Version 1.1.1 of Audacity, a multi-platform sound file editor, has been released. "Audacity 1.1.1 has much improved support for Mac OS X, and for foreign languages. Users who use Mac OS X or who wish to use Audacity in Bulgarian, Danish, Dutch, French, German, Hungarian, Italian, Polish, Russian, Slovenian, or Spanish should download Audacity 1.1.1." See the release notes for a detailed list of changes.

Comments (none posted)

JACK Rack 1.0

Bob Ham has released JACK Rack 1.0, a stereo LADSPA effects "rack" for the JACK audio connection kit and GTK+ 2. The screenshot looks interesting. The code is available as a source tarball.

Comments (none posted)

ALSA Patch Bay version 0.3 available

Version 0.3 of ALSA Patch Bay, a graphical patch bay for the ALSA sequencer API, is available. This version includes an fltk 1.1 interface and an updated gtkmm interface.

Comments (none posted)

Desktop Environments

FootNotes

Headlines on the GNOME desktop FootNotes site include: a Robin Rowe Interview, GNOME Development Series Snapshot 2.1.2: ''Life Preserver'', GNOME Summary for 2nd to 9th November, Evolution 1.2 available!, Sawfish 1.2 released, OpenOffice.org Project Update, GnomeICU 0.99 beta Released, GIMP 1.3.10 released, First version of libwpd released, Candidates for Fall 2002 GNOME Foundation Elections, and more.

Comments (none posted)

GNOME Summary

The November 2-9, 2002 GNOME Summary is out. Topics include Tons of Evolution, New tooth in the GNOME bite, GNOME Foundation Candidates, GNOME Filesector Continued, Anjuta 1.0, More good medicine, Nautilus Bugzilla, Gtkmm 2.0, GNOME and Python, Translated GNOME summaries, and more.

Full Story (comments: none)

KDE 3.1 RC3: Last Dance?

KDE.News covers the release of KDE 3.1 RC3. Several severe bugs from the RC2 release have been fixed. Testers are needed.

Comments (none posted)

KDE Merchandise Sales to Support Developers

Shawn Gordon of theKompany has announced that sales from a new line of KDE-themed merchandise has been made available and each month a random KDE developer will be awarded with the profits from the sale.

Comments (none posted)

Xfce 3.8.18 released

Version 3.8.18 of the Xfce desktop environment has been released. Release information is in the source code.

Comments (none posted)

Graphics

GIMP Development Version hits the Big 1-0

Gimp.org mentions that GIMP version 1.3.10 (development release) is available. "In addition to many tweaks and bugfixes, this is the first release in the 1.3 series in which Python scripting can be enabled. As with all GIMP releases, 1.3.10 can be downloaded from your favorite mirror. Happy bug hunting!"

Comments (none posted)

Interoperability

Kernel Cousin Wine

Kernel Cousin Wine Issue #143 is out. Topics include: Wine-20021031 and Commercial Devel, Wine 0.9 To Do, Testing Apps: Tucows' Top 20 Apps, Testing Apps: Mozilla and Multimedia Players, RPCSS.exe Replacement, Avoiding ASCII/Unicode Function Duplication, Thanks from Bob, Author Needed for Winelib Article.

Comments (none posted)

Office Applications

AbiWord Weekly News

Issue #117 of the AbiWord Weekly News is out with the latest AbiWord word processor development news. "Now, as for AbiWord, 1.1.1 was released this week, in the four month build up to AbiWord II: The Wrath of Dom, this version is even niftier. Will and Marc start a wv-like library for WordPerfect. And there's still some more dipping into learning how AbiWord's proprietary format works."

Comments (none posted)

Kernel Cousin GNUe

Kernel Cousin GNUe Issue #54 is out with the latest GNU Enterprise development news.

Comments (none posted)

Web Browsers

mozillaZine

The latest mozillaZine topics include: Netscape DevEdge Update, Bugzilla Upgraded, Creating a Skin for Mozilla, Phoenix on BeOS, Introduction to the XUL Runtime Environment, MozillaNews Launches Bonsai Watch, Introduction to the DOM Inspector, and Newsgroup Filtering Coming to a Mozilla Near You.

Comments (none posted)

Languages and Tools

Caml

Caml Weekly News

The Caml Weekly News for November 5 - 12, 2002 is out with the latest Caml software releases. Topics include: New release of OCamSDL, OS X distribution issue, Cameleon 1.2, caml2html, What are Classes for in O'Caml?, Gettext, Berkeley DB, exuberant ctags for ocaml?, Camlp4 and lightweight records, and ant 0.4.

Full Story (comments: none)

The Caml Hump

This week, the new software on The Caml Hump includes lightweight records, OCamlBDB, Gettext, Ant, ActiveBuffer, Overflow, caml2html, and APM.

Comments (none posted)

Eiffel

ELJ 0.5, Open Source Projects for Eiffel

The ELJ Project has released version 0.5 of ELJ, the open source projects and library bindings for Eiffel.

Full Story (comments: none)

Java

Get ahead with Java Web services (IBM developerWorks)

James McCarthy introduces Sun's Java Web Services Developers Pack on IBM's developerWorks. "Java developers who are interested in getting started with Web services should check out the Java Web Services Developers Pack (WSDP). In this article, James McCarthy takes you on a quick tour of this package. You'll learn what the tools in this package can do for you, and find out which components are just for testing and which are ready for production use as-is."

Comments (none posted)

Learning the New Jakarta Struts 1.1, Part One (O'Reilly)

Sue Spielman covers Jakarta Struts 1.1 on O'Reilly. "Over the last year, the Struts framework, a Jakarta open source project, has become practically the de facto standard for building Web applications. Based on the MVC architecture, Struts has proven to be a solid framework that can be used on systems of all sizes. In fact, I’d be hard-pressed to come up with a reason why you and your development team should spend cycles developing a custom MVC framework for a project. It just doesn’t make sense."

Comments (none posted)

Java Essentials: What Is Wireless Java? (O'Reilly)

Steve Anglin explains Wireless Java on O'Reilly. "Wireless Java consists primarily of the Java 2ME (Micro Editon) platform with its API and tools like the Wireless Java Toolkit. In the J2ME, there's the Foundation Profile MIDP PersonalJava Configurations. The Foundation Profile lets you write applications for small wireless devices that do not support a GUI. Mobile Information Device Profile (MIDP) is a more advanced set of APIs including MIDlets (wireless-optimized servlets) and other instructions for downloadable applications and services for network-connectable, battery-operated mobile handheld devices such as cell phones, two-way pagers, and PalmPilots."

Comments (none posted)

Perl

This Week on perl5-porters (use Perl)

Use Perl has published This Week on perl5-porters for November 4-11, 2002. "The usual suspects are once again rounded up. Unicode bugs, PerlIO bugs and closure bugs are featured in this week's summary. In a sense, that's a good thing, meaning that the older or more widely used features seem to work quite well." Topics include: Determine whether a scalar is a number, Two UTF8 bugs, Lexical quandry, and In brief.

Comments (none posted)

This week on Perl 6 (O'Reilly)

This week on Perl 6 for November 4, 2002 is out. Topics include: C# and Parrot, Scratchpad Confusion, Help! Bugs! Crawling All Over Me! OR the Road to 0.0.9, Keyed ops, the Return, 64-bit ints and Noncapable Hardware, Configuring and DOD, Execute in place?, Copyright Notices and License Stuff, Allow a NULL Interpreter in sprintf Like Functions, Draft Sketch of Bytecode Generation, Meanwhile, in perl6-language, Character Properties, Perl6 Built-in Types, Power of Lisp Macros, and more.

Comments (none posted)

PHP

PHP Weekly Summary

Topics on this week's PHP Weekly Summary include the 4.3.0 schedule, a possible pcntl addition, the inconsistant return of 1, strlen() optimisation, photos from the PHP conference, OpenSSL additions, MySQL embedded PHP, XSLT / Sablotron 0.97, Cryptopp-php, an smbclient extension, Apache hooks, and a question about SQL server with Unix PHP.

Comments (none posted)

PHP compatible editor page

Keith Edmunds has moved his Keith's PHP Editors page, a list of PHP compatible editors, to a new location.

Comments (2 posted)

PHP Cookbook Trip Mapping with PHP (O'Reilly)

David Sklar discusses the use of PHP for the creation of maps. "Remember Raiders of the Lost Ark? One of the distinctive images was a thick red line cruising across a map, showing Indiana Jones' routes when crisscrossing the globe and fighting bad guys. I don't think they used PHP for any of the special effects in 1981, but you can use PHP today to create a similar map of the United States. "

Comments (none posted)

Python

Dr. Dobb's Python-URL!

The Dr. Dobb's Python-URL! for November 11, 2002 is out with lots of Python development news.

Full Story (comments: none)

Python persistence management (IBM developerWorks)

Patrick K. O'Brien discusses Python persistence on IBM's developerWorks. "Persistence is all about keeping objects around, even between executions of a program. In this article you'll get a general understanding of various persistence mechanisms for Python objects, from relational databases to Python pickles and beyond. You'll also take an in-depth look at Python's object serialization capabilities."

Comments (none posted)

The Daily Python-URL

This week's Daily Python-URL article topics include: Webcasts from Lightweight Languages Workshop 2002, Play with regexps from the safety of your browser, How to add Spyce to your life, Python 2.2.2 for AS/400, IDEStudio, Notes on Lisp Advocacy, Roundup 0.5.2, Kiwi, the Python meetup, and more.

Comments (none posted)

Ruby

The Ruby Garden

This week's Ruby Garden features a plea for help from a new Ruby user. The Ruby Weekly News has articles on: an upcoming Ruby Hacking Fest, Ruby docs online, a Ruby article in SD magazine, Rubyconf coverage, a Rubycentral DNS problem, and Ruby documentation vision.

Comments (none posted)

Scheme

Scheme Weekly News

The November 12, 2002 edition of the Scheme Weekly News is out. Topics include: TeXmacs 1.0.0.21 released, Scheme UK, guile-gtk homepage moves, guile-gobject updated, and Conference pictures from ILC 2002.

Full Story (comments: none)

XML

W3C Advances XForms 1.0 (Dr. Dobb's)

Dr. Dobb's covers the release of Candidate Recommendation 1.0 for XForms. "XForms is seen as the foundation for next-generation Web-based forms, using XML to make it possible to write forms in a number of markup languages and deliver them to diverse devices, from PDAs to cell phones and screen readers, without having to rewrite the forms. The specification achieves this by giving authors the ability to distinguish the descriptions of the purpose of the form from the presentation of the form and how the results are written in XML."

Comments (none posted)

Plan to use XML namespaces, Part 2 (IBM developerWorks)

David Marston completes his mini-series on XML namespaces with the second article. "This two-part article introduces XML namespaces, explores their practical benefits, and shows you how they are used in the standard XML formats and tools defined by the W3C. Here in part 2, David shows you how to intermix XML vocabularies and define vocabularies of your own, with several best practices highlighted. Best practices range from terminology usage up through system-wide design." You may want to start with part 1.

Comments (none posted)

Ontology Building: A Survey of Editing Tools (O'Reilly)

Michael Denny discusses ontologies on O'Reilly's XML.com. "As the hype of past decades fades, the current heir to the artificial intelligence legacy may well be ontologies. Evolving from semantic network notions, modern ontologies are proving quite useful. And they are doing so without relying on the jumble of rule-based techniques common in earlier knowledge representation efforts."

Comments (none posted)

Automatic Numbering, Part 1 (O'Reilly)

Bob DuCharme writes about number formatting with XSLT. "XSLT's xsl:number instruction makes it easy to insert a number into your result document. Its value attribute lets you name the number to insert, but if you really want to add a specific number to your result, it's much simpler to add that number as literal text."

Comments (none posted)

Miscellaneous

The Zen of Comprehensive Archive Networks (use Perl)

use Perl has an article that describes some of the work behind developing a language archive site such as Perl's CPAN. "It seems that there is a lot of interest in having similar archives for other languages like CPAN is for Perl. I should know; over the years people from at least Python, Ruby, and Java communities have approached me or other core CPAN people to ask basically 'How did we do it?'. Very recently I've seen even more interest from some people in the Perl community wanting to actively reach out a helping hand to other communities. This 'missive' tries to describe my thinking and help people wanting to build their own CANs. Since I hope this message will somehow end up reaching the other language communities I will explicitly include URLs that are (hopefully) obvious to Perl people."

Comments (none posted)

Page editor: Forrest Cook

Linux in the news

Recommended Reading

A kinder, gentler Perens is going Global now (Register)

The Register takes a look at what Bruce Perens is up to these days. "One thing you have to admire about Bruce Perens: he has lots of ideas and he's not afraid to implement them. Before the door was fully closed behind him at HP, he started Sincere Choice to counter Microsoft's "Software Choice" initiative. Now he's heading up a new non-profit: the Global Technology Policy Institute."

Comments (none posted)

Trust or treachery? (News.com)

News.com warns us about some potentially treacherous uses of Microsoft's Palladium architecture. " Richard Stallman, founder of the Free Software Foundation and co-founder of the GNU project for creating free versions of key Unix programs, lampooned the technology in a recent column as "treacherous computing.""

Comments (6 posted)

OpenOffice.org Project Update (Linux Journal)

The Linux Journal looks at the state of the OpenOffice project. "There are installations in place or in planning stages in the German Bundestag, the Maltese Prime Minister's office, to name just two. The governments of Italy, England, Canada, China, Peru, Chile, Costa Rica and many other countries have taken a view that these platforms can help them manage and control both smaller, more efficient IT budgets and establish for the first time a path to universal access to public documents."

Comments (3 posted)

When It's Life or Death, Some 911 Systems Turn To Linux (CIN)

CIN looks at using Linux in 911 emergency services. "While the low cost of Linux makes it attractive, the big draw for IT managers like Stebbins is its reliability. The machines in the St. George 911 center are in use 24 hours a day, seven days a week, says Stebbins. One of the systems has been running continuously for nearly a year and a half."

Comments (none posted)

Companies

Dell on Linux and Tablets (vnunet)

Vnunet covers Dell chief executive Michael Dell's pro-Linux keynote address at the recent Gartner symposium. ""We see a lot of customers who have developed Unix applications moving to Linux," he said. "Chief information officers have said that they knew Linux would cost less, but were surprised that it performed better.""

Comments (7 posted)

Microsoft memo: Linux fight backfiring (News.com)

According to this News.com article, Microsoft execs are now realizing their tactics are not effective against Linux. " Top Microsoft executives, including co-founder Bill Gates and Chief Executive Steve Ballmer, have long derided open-source software as being everything from a "cancer" to "Pac-Man-like." But those messages have failed to diminish the popularity of open-source programs such as Linux among developers and customers, according to a Microsoft memo distributed at a strategy meeting in Berlin in September."

Comments (none posted)

MS admits its Linux-bashing jihad is a failure (Register)

Here's the Register's take on this year's Halloween memo from Microsoft. "The Beast has hired a research crew to do a bit of attitude sampling among the Great Unwashed in the US and abroad, and has found that slagging Linux is not winning it any points. In a company memo posted by Eric S. Raymond here we learn that regular folks are both eager for a Microsoft alternative and generally respectful of the open-source concept."

Comments (3 posted)

SGI to unveil new supercomputer (News.com)

News.com takes a look at some new supercompters from SGI. "In the next few months, SGI will come out with its first Itanium 2 computers. These systems will hold 32 processors per rack and will run the Linux operating system."

Comments (none posted)

Original Mac hand leads Sun desktop charge (Register)

The Register looks at Sun's plans for a Linux desktop. "Jonathan Schwartz thinks Sun will be the first company to present a deployable Linux desktop with all the trimmings - the management software, applications (iPlanet) and the channel - to Fortune 500 customers. Since no one else of Sun's size is trying to do this, and IBM and Hewlett Packard are Windows licensees and are doing Linux everywhere except on the desktop, he's probably right. At least on this scale."

Comments (none posted)

Turbolinux sells clustering business to start-up (Register)

Turbolinux is in the process of changing its business model. This article in the Register covers the sale of its EnFuzion clustering software to start-up company Axceleon Inc. "The formation of Axceleon and the acquisition of EnFuzion follow the acquisition of Turbolinux by Japanese software house Software Research Associates Inc in August. While SRA acquired the Turbolinux name and Linux distribution business, Turbolinux's US management team planned to launch a new company based around its PowerCockpit server provisioning software under the management of former Turbolinux CEO Ly-Huong Pham."

Comments (none posted)

Business

Linux adds desktop tools (vnunet)

Vnunet looks at new desktop releases coming from SuSE and Red Hat. "But Linux's near-term corporate success is still more likely to be on the server side. Suse said over 500 downloads of the UnitedLinux beta are being requested every day. UnitedLinux is an attempt to create a standard Linux configuration backed by Suse, SCO, Turbolinux and Conectiva."

Comments (none posted)

Linux & Learning (eSchoolNews)

The eSchoolNews examines ways in which Linux can save schools money. "Schools across the country are finding that Linux can help reduce their total cost of ownership (TCO) in a number of ways. Tightening budget constraints mean schools must capitalize on their existing infrastructure. Linux can run on a processor as slow as a 386. Remember those?" Thanks to Alonzo (Registration required)

Comments (1 posted)

Interviews

Stallman: Disk, I/O issues delay GNU OS (InfoWorld)

InfoWorld talks to Richard Stallman about the GNU OS. ""I would say that when two features that are that essential are still missing, we are not at version 1.0 of the system yet," Stallman told IDG News Service in an interview this week in Bangalore. Stallman was however noncommittal on a new release date." Thanks to Daniel Lark

Comments (10 posted)

Tech legend takes on Microsoft (CNN)

CNN covers Mitch Kapor, the software pioneer who introduced products such as Lotus' Notes, Agenda and 1-2-3 spreadsheet, in a new open-source venture. "Kapor's latest effort, an open-source "interpersonal" information manager, has been under development for more than a year but doesn't yet exist. Yet already there are expectations it could challenge Outlook, the industry heavyweight."

Comments (2 posted)

Oracle's Jarvis: Unplugged--but not unarmed (ZDNet)

ZDNet talks with Mark Jarvis, Chief Marketing Officer of Oracle. "As OracleWorld transpires this week, Oracle Chief Marketing Officer Mark Jarvis hopes to give Microsoft some grief with version 2 of the Oracle Collaboration Suite. In addition, Jarvis is calling OracleWorld a Linux festival, and touts the cost benefits of Linux/Intel solutions over Wintel and Unix platforms."

Comments (none posted)

Resources

LinuxDevices Embedded Linux Newsletter for Nov. 7, 2002

Get the top stories for Embedded Linux with the LinuxDevices.com Embedded Linux Newsletter

Full Story (comments: none)

Grounds for Identity (Linux Journal)

Linux Journal tackles the hot topic of identity. "At the show I made as much trouble as I could. On the opening day I moderated a panel on identity and open source. On the closing day I gave a talk about the open-source nature of internet infrastructure--the need for open identity protocols and other standards that commercial interests alone would be unlikely to provide."

Comments (none posted)

Data security for Linux power users (Register)

This Register article has some tips for keeping data secure on your Linux system. "I'll get into the Linux home network soon in a forthcoming article with our John Lettice. For now I'll concentrate on data hygiene and on-line anonymity. Why? because your Linux box is literally peppered with data traces indicating the Web sites you've visited, the files you've uploaded and downloaded, and every file you've recently accessed. You think encryption is the way to go? Think again. It's only as private as your passphrase is strong. It may be impractical for a remote attacker to crack it, but a brute-force attack is quite plausible for someone who has physical possession of your box and plenty of time. Like a police forensics lab, say."

Comments (1 posted)

Lightweight Linux, Part 1 (IBM developerWorks)

This IBM developerWorks article is about leveraging older hardware to break the hardware/software upgrade cycle. "Too often, modern operating system vendors treat hardware as if it were disposable -- use it for a year and then throw it away. One might be tempted to believe that secret backroom meetings are going on between vendors of operating systems and computer hardware manufacturers. New operating systems and applications demand the latest, most powerful hardware. The newest hardware works best only with the latest, most feature-rich software. I'm sure the churn helps someone's bottom line, but it does nothing for mine."

Comments (12 posted)

Clustered Linux: supercomputing on the cheap (ZDNet)

ZDNet is carrying a TechRepublic article about Linux clustering technology. "According to Linux vendors and industry analysts, cost-effectiveness is just one of several reasons prompting more enterprises to choose Linux systems."

Comments (2 posted)

Developing LSB-certified applications (IBM developerWorks)

Here's a HOW-TO article on IBM developerWorks about developing LSB-certified applications. "The Linux Standard Base is a big step toward ensuring binary compatibility among Linux applications, and it should greatly reduce the amount of testing and validation required for operation on multiple platforms. In five straightforward steps, George Kraft, chairman of the Linux Standard Base, shows you how to build an LSB-certified application."

Comments (none posted)

Reviews

Major German Paper praises KDE and Konqueror

KDE.news is carrying the news from a big German newspaper Süddeutsche, which has published a 10-part installation report of SuSE Linux 8.1, complete with praise for KDE and Konqueror. Other projects such as the Gimp and OpenOffice.org are also mentioned positively.

Comments (none posted)

Device Profile: CDL Paron 'secure PDA' (LinuxDevices)

LinuxDevices takes the CDL Paron for a test drive. "IBM and Consumer Direct Link, Inc. (CDL; Costa Mesa, CA) have co-developed the Paron MPC, a unique handheld PC which combines the functions of a PDA, Bluetooth wireless access, cellular telephone, and biometric fingerprint recognition, along with a security-oriented hardware/software architecture. In particular, IBM and CDL claim that the Paron represents the world's first handheld wireless device with built-in biometric user authentication."

Comments (none posted)

Zope quickstart in November Linux Productivity Magazine

The November issue of Linux Productivity Magazine explains the power of Zope, and then takes a completely uninitiated user through the steps to install and learn Zope. Included is a glossary of Zope terminology.

Comments (none posted)

Page editor: Forrest Cook

Announcements

Commercial announcements

SBE Aims Adapter at the Linux Enterprise Market

SBE Inc.has announced a PCI version of its wanPMC-C4T1E1 adapter card. Three versions include single, dual, and quad port options as wanADAPT-C1T1E1, wanADAPT-C2T1E1, and wanADAPT-C4T1E1. This adapter was a result of customer demand for T1 or E1 links in a Linux server or router.

Comments (none posted)

HP ProLiant Servers Running Linux-based Sendmail Outperform Sun Platforms

HP and Sendmail, Inc. announced the results of a performance benchmark testing Sendmail's email software on industry-standard HP ProLiant servers vs. proprietary Sun systems. The results show that significant price/performance benefits and better message throughput are achievable when Sendmail's software is deploying mail and messaging solutions on industry-standard hardware running Linux, as compared to more expensive Sun servers running Solaris.

Comments (none posted)

NuSphere and MySQL settle

NuSphere and MySQL have issued a press release announcing the resolution of their long-standing legal dispute. "The settlement resolves all outstanding issues between the two companies including ownership and use of trademarks and domain names and assignment to MySQL AB of copyrights for all NuSphere contributions to the MySQL program, and MySQL AB has issued a letter to NuSphere Corporation verifying GPL compliance."

Comments (2 posted)

Turbolinux announced "TurboDB", a commercial PostgreSQL-based product

Thanks to LWN correspondent Maya Tamiya we have an idea of what Turbolinux is up to these days. It seems that SRA, the company that recently acquired Turbolinux, is the current employer of Bruce Momjian, one of the core developers of PostgreSQL, leading to TurboDB, a PostgreSQL-based product.

Full Story (comments: none)

Fonix DECtalk Now Available for Linux

Fonix Corporation has announced the availability of a Linux version of Fonix DECtalk. "...the world's most intelligible text-to-speech solution for embedded device applications. The new Linux support will be especially useful for application providers developing screen readers and other reading aids for the visually challenged on the Linux platform."

Comments (none posted)

"Building Secure Servers with Linux" Released by O'Reilly

"Building Secure Servers with Linux" has been released by O'Reilly. The book focuses on the most common use of Linux, as a hub offering services to an organization or the larger Internet, and shows readers how to harden their hosts against attacks.

Full Story (comments: none)

HP's Itanium 2-based Workstation Advantage for Higher Education

HP is offering US colleges and universities discounts on HP Workstations zx2000 and zx6000 loaded with 64-bit Red Hat Linux Advanced Workstation operating system, for a limited time.

Full Story (comments: none)

Red Hat to Distribute Oracle Cluster File System

Red Hat, Inc. announced that it will make the Oracle Cluster File System (OCFS) available to Red Hat enterprise customers. "The Oracle Cluster File System, combined with Red Hat Linux Advanced Server, allows customers to manage their database storage in an Oracle9i Real Application Cluster (RAC) configuration as easily as on a single system. The Oracle Cluster File system supports all database files, archive logs, redo files and control files. This greatly simplifies Oracle database installation and management."

Comments (none posted)

New Aurora Linux Driver Offers Async Serial Connection and Custom Baud Rates

Aurora Technologies, Inc. announced its SIOLX 2.11, a new Linux device driver that supports Aurora's PCI asynchronous serial communications cards. The new SIOLX Linux driver works with Intel-based systems running a distribution of the 2.4 Linux kernel and supports Aurora's Aries family of 8 and 16-port asynchronous PCI multiport serial controllers.

Full Story (comments: none)

Rococo Software Releases Bluetooth DevKit for Linux Over BlueZ

Rococo Software announced the release of Impronto Developer Kit for Linux, a Bluetooth development environment that makes building Bluetooth applications in Linux faster and easier. Impronto Developer Kit for Linux is available free of charge for non-commercial use from Rococo's web site.

Full Story (comments: none)

Yamaha Invests in MontaVista Software

MontaVista Software Inc. announced it has received an equity investment from Yamaha Corporation, the global company that manufactures and markets a broad range of products including digital musical instruments, professional audio and recording, and home entertainment systems.

Full Story (comments: none)

Zintec Selects MontaVista Linux as Foundation Platform for New Set-Top Box Products

Zintec Holding and MontaVista Software Inc. are collaborating on the development of next-generation set-top box products.

Full Story (comments: none)

Evolution 1.2 released

Ximian has announced the release of version 1.2 of the Evolution mail client. There'a s long list of new features; see the announcement for the details. There is also a new version of Ximian Connector to go along with the new Evolution, of course.

Comments (3 posted)

Qt 3.1 released

Trolltech has announced the release of Qt 3.1. The biggest addition this time around appears to be "QMotif," which allows Motif applications to be gradually shifted over to the Qt toolkit.

Comments (1 posted)

Luke Macpherson Wins John Lions Award For 2002

The Australian UNIX and Open Systems User Group (AUUG, Inc.) announced that Luke Macpherson has won the John Lions Award for 2002 for his work on IP Spoofing and Aliasing for the BSD Network Stack.

Full Story (comments: none)

Linux NetworX announces "Life Sciences Cluster"

Linux NetworX has announced a new "Life Sciences Cluster" product. It is a Linux-based cluster with a number of life science applications (BLAST, HMMer, ClustalW, Amber, etc.) thrown in. The announcement is interesting in that it shows the Linux cluster industry developing more focus and aiming its products at specific sets of customers. Free software is well suited to this sort of focus; there should be numerous business opportunities out there for companies creating application-specific products.

Full Story (comments: none)

Upcoming Events

Linux Cluster: the openMosix Approach

A one-day workshop on using openMosix for building Linux clusters will be held in Bologna, Italy on November 28, 2002.

Full Story (comments: none)

Perl Conference dates and location announced (use Perl)

Use Perl has an announcement for the Open Source Convention and accompanying Perl Conference, to be held in Portland, Oregon on July 7-11, 2003.

Comments (none posted)

YAPC::Europe Committee nominated (use Perl)

Accdording to Use Perl, president of the Perl YAS has nominated the members of the YAPC::Europe Committee in preparation for the upcoming event.

Comments (none posted)

YAPC::Europe 2003 to be held in Paris (use Perl)

According to Use Perl, the next YAPC::Europe will be held in Paris sometime in 2003.

Comments (none posted)

Red Hat Chairman and CEO, Matthew Szulik, to Deliver Keynote at International Oracle User Group Event

The International Oracle Users Group has announced that Sunday at the International Oracle User Group (IOUG) Day at Oracle World, Red Hat will kick off the week with an address from Red Hat Chairman and CEO, Matthew Szulik. Oracle users will hear first-hand about Red Hat's relationship with Oracle and how the two companies work together to support "Unbreakable Linux" and to provide business infrastructure solutions to enterprise customers.

Comments (none posted)

Events: November 14, 2002 - January 9, 2003

Date	Event	Location
November 14 - 15, 2002	The Open Source Health Care Alliance(OSHCA)	(UCLA Medical Center)Los Angeles, CA
November 14 - 15, 2002	Java Days Europe	Helsinki, Oslo, Frankfurt, Zurich, Milan
November 18 - 21, 2002	Embedded Systems Conference, Boston	(Hynes Convention Center)Boston, Mass
November 18 - 21, 2002	ApacheCon US 2002	(Alexis Park Resort)Las Vegas, NV
December 3 - 5, 2002	Linux Bangalore/2002	(J.N.Tata Auditorium)Bangalore, India
December 9 - 20, 2002	UMeet conference	On IRC

Comments (none posted)

Web sites

The latest from LinuxLookup

LinuxLookup.com has a number of new articles, including a review of Tablet PCs with LindowsOS, an editorial on embedded Linux, tools to transition from Windows to Linux, and more.

Comments (none posted)

Software announcements

This week's software announcements

Here are the software announcements, courtesy of Freshmeat.net. They are available in two formats:

• Sorted alphabetically,
• Sorted by license.

Comments (none posted)

Miscellaneous

Open Source Victoria

A new Australian Linux advocacy group known as Open Source Victoria has been formed. "A new advocacy group, Open Source Victoria, has been formed to educate Victoria's business and government leaders about the benefits of using Open Source software for both server and desktop environments. Open Source Victoria also intends to seek State funding from the Next Wave program in order to set up an Open Source Cluster in Victoria."

Full Story (comments: none)

Page editor: Forrest Cook