One might think that there are already enough industry bodies working on
Linux in telephone applications. But, on November 14, a new group,
called the "Linux Phone Standards Forum" (or "LiPS")
announced
its existence. According to the release:
The LiPS Forum will accelerate the adoption of Linux in fixed,
mobile and converged devices by standardizing Linux-based services
and APIs that most directly influence the development, deployment
and interoperability of applications and user-level services.
In essence, LiPS wants to push toward the creation of a standard low-level
phone platform which allows vendors to focus their efforts on the
higher-level features which set their offerings apart. The appeal of this
idea is not that hard to understand. As an operating system for
telephones, Linux is hard to beat: it can be customized to taste, it is
efficient, and it lacks per-unit royalty costs. In addition, mobile
platforms have become powerful enough to run Linux, and many mobile
applications are sufficiently demanding to require a complete operating
system like Linux. On the other hand, Linux lacks the features specific to
telephony which can be found in a proprietary platform like Symbian. By
filling in that layer of telephony-specific features, LiPS hopes to create
a competitive platform for future products.
LiPS will probably be successful in scheduling meetings, generating white
papers, and cranking out press releases. But if LiPS truly wants to turn
Linux into a platform it can rely upon in the future, its management may
want to consider engaging openly with the development community;
"cooperating with OSDL" is not sufficient in this regard. If LiPS sees
itself as another proprietary, members-only consortium, it will cut itself
off from much that the community can provide.
A good start would be to admit some community projects to the group. For
example, since they claim to be trying to build platforms for telephony in
general - not limited to mobile devices - the LiPS member companies might
well benefit from having somebody from the Asterisk and Bayonne projects at
the table.
Even better would be to work with the community directly. A look at the
list of companies which have joined LiPS (ARM, Cellon, Esmertec, France
Telecom/Orange, FSM Labs, Huawei, Jaluna, MIZI Research, MontaVista
Software, Open-Plug and PalmSource) and the other companies which have been
active in Linux-based telephones (Motorola, Haier, Nokia, NEC, Panasonic,
Samsung, ...) has few intersections with the list of companies
participating in Linux kernel development. If the LiPS members truly want
to get the most out of Linux, they will be better off working with the
development community and contributing back their improvements. The recent
announcement by the
Consumer Electronics Linux Forum that it had hired a Linux kernel developer
is a step in the right direction, but it is only a beginning.
Finally, if LiPS truly wants to achieve world domination with Linux-based
phones, it should give some thought to the creation of a user-hackable
platform. A phone which can be extended to perform functions never
envisioned by its creators will be a far more valuable device, and it
should find a wider market. Unfortunately, the mobile phone market tends
to be dominated by companies which behave like, well, telephone companies,
with the result that even routine features (such as Bluetooth) can be
locked down, and user-hackable devices are a rarity. When a device is
fully locked down, it matters little to the user whether it is running
Linux or something else altogether. If LiPS were sufficiently enlightened
that it could go against the closed nature of the industry and
specify the creation of Linux-based phones which have not had the
natural freedom of Linux stripped out of them, it could be the start of
something truly interesting.
Comments (10 posted)
For most companies, simply being caught installing rootkit-like software
onto the systems of customers who simply thought they were playing a music
CD would be bad enough. Certainly, since the Halloween disclosure that
some SonyBMG discs install a rootkit (called "XCP") has been a source of grief for that
company, and rightly so. It takes a truly expansive interpretation of the
notion of "intellectual property rights" to believe that such rights allow
the installation of malware on other peoples' computers. As this event -
and those which have come after - have shown, however, SonyBMG appears to
have learned little from the whole episode.
Just how little the company has learned can be heard on this
NPR interview with SonyBMG manager Thomas Hesse. When asked about the
rootkit, Mr. Hesse responded:
Most people, I think, don't even know what a rootkit is, so why
should they care about it?
As the class-action suits begin to pile up, and as even Microsoft feels the
need to create a Sonyware removal tool, maybe Mr. Hesse will eventually
realize that people (who are rapidly learning what a rootkit is) do care.
SonyBMG has claimed that there is no "phone home" capability in this
software. Unfortunately for the company, connections back home are
relatively easy to detect. Some investigation
quickly showed that SonyBMG's software does indeed make a connection back
home when the CD is played. Nowhere has SonyBMG alerted its users to this
behavior and the associated privacy problems.
For additional amusement, see the EULA which
comes with the rootkit software.
SonyBMG has made an uninstaller available for those few users which are
capable of understanding what a rootkit does and being upset by it. It
turns out, however, that this uninstaller is worse than the original
rootkit. Running the uninstaller opens a number of holes - which can
be exploited via web pages - in the target system. So victims of SonyBMG's
rootkit who care about the security of their systems are in a bind; there
is currently no straightforward way to get that software off the system
without compromising the system even further.
Yet another ironic twist is the possibility
that Sony's rootkit includes some LGPL-licensed code, but does not comply
with the license. If this were true (and there are some doubts
on this point, though they seem to be getting
smaller), the hypocrisy would be complete.
In response to all this, SonyBMG announced that it would "temporarily" stop
making CDs with XCP on them. There was no apology, much less an offer to
compensate people whose systems have been compromised. Neither was there a
recall of the (apparently millions) of malware-infected discs which were
still in the retail pipeline. Only on November 15 did SonyBMG finally
give in, recall the outstanding XCP-infected CDs, and offer to replace
discs in the hands of its customers. Said users are still waiting for the
compensation offer, however.
It is also worth noting that Sony is still shipping CDs with
Sunncomm's MediaMax DRM code on them. MediaMax may not be quite as bad
as XCP, but it is still hostile software which, among other things, phones
home.
In the end, SonyBMG appears to have been slapped down fairly hard for its
actions. It would be a mistake to assume that this sort of incident will
not happen again, however. The entertainment industry has managed to
create such a strawman enemy out of "pirates" that any sort of response
appears to be justified. In a world where these folks can dictate the
design of radios and televisions, attempt to legalize online attacks against
"pirates," and file lawsuits against children, the addition of malware to a
music disc seems like a small thing. Until such a time as this industry
stops seeing its own customers as enemies, it will fail to show those
customers any respect.
Linux users should not expect much respect either. Efforts like the
broadcast flag already threaten to make the creation of free television and
radio receivers impossible. Beyond any doubt, the music industry looks
forward to the day when even playing a song on a free system will be
disallowed. As Linux users, we are not much impressed by the idea that, in
order to play a music track, we must accept the installation of hostile
software onto our systems. Unfortunately, we may yet see a day when that
is the only choice we have.
(See also: the EFF's open
letter to SonyBMG and the Sony
timeline on BoingBoing).
Comments (56 posted)
One would think that free software would be a natural for a country like
India. With free software, a developing nation can take greater control of
its infrastructure, avoid paying hard-currency licensing fees, and worry
less about "pirates" creating difficulties with foreign companies and
governments. When the country also has vast numbers of smart and
highly-educated people, as India does, free software seems like an even
better fit. There is no doubt that use of free software in India is
growing, but the country has not always been strongly represented in the
development community.
Things are clearly changing however, and one of the clearest signs of that
change is the upcoming FOSS.IN conference,
starting November 29 in Bangalore. This conference, now in its fifth
year, expects some 3000 attendees, offers over 140 talks, 20 tutorials, and
a growing list of BOF sessions. The list of speakers includes many
Indian names, quite a few of which are known well beyond India. Other
speakers, whose names might be more familiar to most LWN readers, include
Andrew Cowie, Harald Welte, Alan Cox, Jeremy Zawodny, Brian Behlendorf,
Dave Phillips, James Morris, Rasmus Lerdorf, and Danese Cooper. The talks
cover a vast range of topics, including legal and advocacy issues, a strong
education track, embedded systems, kernel hacking, security, and much
more. FOSS.IN,
in other words, is working toward being a world-class free software
conference.
This conference is certainly taken seriously within India. The
Visvesvaraya Technological University (the leading technical university in
the state of Karnataka) has sent out a letter to over 100
engineering colleges asking them to urge their students to attend FOSS.IN.
As it grows to become one of the largest technical free software events
anywhere, FOSS.IN is increasingly going for world-wide respect.
That notwithstanding, the conference organizers have also consented to let
LWN editor Jonathan Corbet speak at the event. This was an opportunity not
to be turned down, and your editor is looking forward to attending and
reporting from FOSS.IN (even if he's a little less enthusiastic about the
24-hour travel time each way). Look for the first reports in the December 1
Weekly Edition.
(The image shown above was taken from this very nice set of
posters put together by Hari Krishnan).
Comments (none posted)
A reminder: the (U.S.) Thanksgiving holiday is next week. LWN's editors
traditionally publish the Weekly Edition one day early on Thanksgiving
week in order to be able to go join their families and eat enough food to
last through the end of the year. We'll return to the regular schedule
the following week.
Comments (2 posted)
Page editor: Jonathan Corbet
Security
IBM has been pushing the use of the "trusted platform module" chip found in
its laptops (and on other systems as well) for some time; see
this report from OLS 2005 for a
summary of the benefits they see from trusted computing. Now IBM's
developers have posted
a new set
of security modules which make use of the TPM to lock down a system.
The three modules are:
- The simple Linux integrity model, or SLIM. This module
associates two attributes with every process and every file: the
integrity level and the privacy level. The integrity levels are
"system," "user," and "untrusted." Any process may read or execute
any file with an equal or higher integrity level (subject to the usual
permissions). Read and execute access to lower-integrity files is
also allowed, but, as a result, the process will, itself, be demoted
to the lower level. Writing files with a higher integrity level is
not allowed. The integrity levels thus implement a form of simple,
automatic sandboxing; if a process touches untrusted resources, it
also loses trust and has a lowered ability to change things elsewhere
on the system. Network sockets, incidentally, are always considered
to have an "untrusted" integrity level.
The privacy level has four levels: public, user, user-sensitive, and
system-sensitive. Processes can read files of equal or lower
sensitivity. If, instead, a process reads a higher-sensitivity file,
its own sensitivity level is raised to match. Writing
lower-sensitivity files is not allowed. This "high watermark"
mechanism is intended to prevent the leakage of secret data to
less-trusted contexts.
- The SLIM module, like SELinux, depends on the extended attributes of
a file to make security decisions. But what if something is able to
change those attributes? The extended verification module
(EVM) is an attempt to keep that from happening. EVM creates its own
extended attribute on each file which is an HMAC hash of the file's
contents and attributes. If the file and the HMAC fail to match, EVM
will deny access to the file.
One might argue that EVM's hash is no less susceptible to tampering
than the other attributes on the file. The difference is that EVM
uses the hardware TPM module to sign the HMAC result. The TPM will
only perform this operation if it is satisfied that the proper "secure
boot" rituals have been followed, and that the integrity of the
running system has not been compromised. Since the TPM key is
specific to that particular chip, it is not possible to remove the
drive and forge HMACs on a different system. If the trusted boot
chain, starting with the BIOS, holds, there should be a high level of
assurance that the system's files and their attributes have not been
tampered with.
- The third module is the integrity measurement architecture.
LWN readers have seen IMA
before, so that discussion will not be repeated. In short, IMA is
a remote attestation feature which can provide a convincing proof that
a system is running (only) well-known, trusted versions of approved
software.
The IMA module was not well received when it was last posted. The
developers hope that the largest objections have been addressed, and that
the set of TPM-related modules as a whole can be considered, eventually,
for merging. Before reaching that point, however, these modules have
another obstacle to overcome: they rely on the ability to run multiple
Linux security modules in a "stacked" mode. Stacked security modules have
been a contentious issue for
some time, and that capability has never been merged. The developers claim
that the new modules will make the case for stacking, but that
conversation has yet to take place.
Comments (none posted)
Brief items
SUSE has a reminder that no security updates will be available for SUSE
Linux 9.0 after December 15, 2005. "
As a consequence, the SUSE Linux
9.0 distribution directory on our ftp server ftp.suse.com has been moved
from /pub/suse/i386/9.0/ to the /pub/suse/discontinued/ directory tree
structure to free space on our mirror sites. The 9.0 directory in the
update tree /pub/suse/i386/update/9.0 will follow, as soon as all updates
have been published."
Full Story (comments: none)
New vulnerabilities
acidlab: SQL injection
| Package(s): | acidlab |
CVE #(s): | CVE-2005-3325
|
| Created: | November 14, 2005 |
Updated: | November 16, 2005 |
| Description: |
Remco Verhoef has discovered a vulnerability in acidlab, Analysis
Console for Intrusion Databases, and in acidbase, Basic Analysis and
Security Engine, which can be exploited by malicious users to conduct
SQL injection attacks. |
| Alerts: |
|
Comments (none posted)
emacs: lisp execution vulnerability
| Package(s): | emacs |
CVE #(s): | CAN-2003-1232
|
| Created: | November 10, 2005 |
Updated: | November 16, 2005 |
| Description: |
Version 21.2 of the EMACS editor has a vulnerability in which
text files containing Lisp code can be executed without warning
the user. Attackers can cause users to execute arbitrary code. |
| Alerts: |
|
Comments (none posted)
flash-plugin: buffer overflow
| Package(s): | flash-plugin |
CVE #(s): | CVE-2005-2628
|
| Created: | November 10, 2005 |
Updated: | November 25, 2005 |
| Description: |
The Mozilla browser Macromedia Flash Player plug-in has a
buffer overflow vulnerability. A user who opens a maliciously
created Macromedia Flash file may be tricked into executing
arbitrary code. |
| Alerts: |
|
Comments (none posted)
ftpd: remote buffer overflow
| Package(s): | ftpd |
CVE #(s): | CVE-2005-3524
|
| Created: | November 14, 2005 |
Updated: | November 16, 2005 |
| Description: |
A buffer overflow vulnerability has been found in the linux-ftpd-ssl
package. A command that generates an excessively long response from the
server may overrun a stack buffer. An attacker that has permission to create directories that are accessible via the FTP server could exploit this vulnerability. Successful exploitation would execute arbitrary code on the local machine with root privileges. |
| Alerts: |
|
Comments (none posted)
gdk-pixbuf: multiple vulnerabilities
| Package(s): | gdk-pixbuf gtk2 |
CVE #(s): | CVE-2005-3186
CVE-2005-2976
CVE-2005-2975
|
| Created: | November 15, 2005 |
Updated: | March 20, 2006 |
| Description: |
The gdk-pixbuf package contains an image loading library used with the
GNOME GUI desktop environment. A bug was found in the way gdk-pixbuf
processes XPM images. An attacker could create a carefully crafted XPM file
in such a way that it could cause an application linked with gdk-pixbuf to
execute arbitrary code when the file was opened by a victim.
Ludwig Nussel discovered an integer overflow bug in the way gdk-pixbuf
processes XPM images. An attacker could create a carefully crafted XPM
file in such a way that it could cause an application linked with
gdk-pixbuf to execute arbitrary code or crash when the file was opened by a
victim.
Ludwig Nussel also discovered an infinite-loop denial of service bug in the
way gdk-pixbuf processes XPM images. An attacker could create a carefully
crafted XPM file in such a way that it could cause an application linked
with gdk-pixbuf to stop responding when the file was opened by a victim. |
| Alerts: |
|
Comments (none posted)
lynx: arbitrary command execution
| Package(s): | lynx |
CVE #(s): | CVE-2005-2929
|
| Created: | November 14, 2005 |
Updated: | September 14, 2009 |
| Description: |
An arbitrary command execute bug was found in the lynx "lynxcgi:" URI
handler. An attacker could create a web page redirecting to a malicious URL
which could execute arbitrary code as the user running lynx. |
| Alerts: |
|
Comments (none posted)
phpsysinfo: programming errors
| Package(s): | phpsysinfo |
CVE #(s): | CVE-2005-3347
CVE-2005-3348
|
| Created: | November 15, 2005 |
Updated: | November 23, 2005 |
| Description: |
Christopher Kunz discovered that local variables get overwritten
unconditionally and are trusted later, which could lead to the inclusion of
arbitrary files. Christopher Kunz also discovered that user-supplied input
is used unsanitized, causing a HTTP Response splitting problem. |
| Alerts: |
|
Comments (none posted)
RAR: format string and buffer overflow
| Package(s): | rar |
CVE #(s): | |
| Created: | November 14, 2005 |
Updated: | November 16, 2005 |
| Description: |
Tan Chew Keong reported two vulnerabilities in RAR: a format string error
exists when displaying a diagnostic error message that informs the user of
an invalid filename in an UUE/XXE encoded file and some boundary errors in
the processing of malicious ACE archives can be exploited to cause a buffer
overflow. |
| Alerts: |
|
Comments (none posted)
scorched3d: multiple vulnerabilities
| Package(s): | scorched3d |
CVE #(s): | |
| Created: | November 15, 2005 |
Updated: | August 11, 2006 |
| Description: |
Luigi Auriemma discovered multiple flaws in the Scorched 3D game
server, including a format string vulnerability and several buffer
overflows. A remote attacker could exploit these vulnerabilities to crash
a game server or execute arbitrary code with the rights of the game server
user. |
| Alerts: |
|
Comments (none posted)
Updated vulnerabilities
a2ps: input validation error
| Package(s): | a2ps |
CVE #(s): | CAN-2004-1170
CAN-2004-1377
|
| Created: | November 26, 2004 |
Updated: | December 19, 2005 |
| Description: |
The GNU a2ps utility fails to properly sanitize filenames, which can be
abused by a malicious user to execute arbitrary commands with the
privileges of the user running the vulnerable application. More
information at Security
Focus. |
| Alerts: |
|
Comments (none posted)
abiword: buffer overflow
| Package(s): | abiword |
CVE #(s): | CAN-2005-2964
|
| Created: | September 29, 2005 |
Updated: | November 14, 2005 |
| Description: |
The RTF import module of the AbiWord word processor has a
buffer overflow vulnerability. A user can be tricked into
opening a maliciously crafted RTF file, giving the attacker
the ability to execute code with the permissions of the user. |
| Alerts: |
|
Comments (none posted)
apache information disclosure if modssl=yes
| Package(s): | apache |
CVE #(s): | CAN-2005-2700
|
| Created: | September 2, 2005 |
Updated: | November 10, 2005 |
| Description: |
An information disclosure vulnerability was discovered in mod_ssl, the SSL/TLS module of the Apache webserver. When "SSLVerifyClient optional" was configured in the global virtual host configuration, an "SSLVerifyClient require" in per-location context was not enforced.
|
| Alerts: |
|
Comments (none posted)
awstats: command injection vulnerability
| Package(s): | awstats |
CVE #(s): | CAN-2005-1527
|
| Created: | August 11, 2005 |
Updated: | November 10, 2005 |
| Description: |
AWStats has a command injection vulnerability that can
be exploited by specially crafting referrer URLs that
contain Perl code. The code can then be executed with the
privileges of the web server. |
| Alerts: |
|
Comments (2 posted)
bzip2: race condition and infinite loop
| Package(s): | bzip2 |
CVE #(s): | CAN-2005-0953
CAN-2005-1260
|
| Created: | May 17, 2005 |
Updated: | January 10, 2007 |
| Description: |
A race condition in bzip2 1.0.2 and earlier allows local users to modify
permissions of arbitrary files via a hard link attack on a file while it is
being decompressed, whose permissions are changed by bzip2 after the
decompression is complete. Also specially crafted bzip2 archives may cause
an infinite loop in the decompressor. |
| Alerts: |
|
Comments (2 posted)
chmlib: several vulnerabilities
| Package(s): | chmlib |
CVE #(s): | CVE-2005-2659
CVE-2005-2930
CVE-2005-3318
|
| Created: | November 7, 2005 |
Updated: | November 28, 2005 |
| Description: |
Several vulnerabilities have been discovered in chmlib, a library for
dealing with CHM format files. |
| Alerts: |
|
Comments (none posted)
clamav: multiple vulnerabilities
| Package(s): | clamav |
CVE #(s): | CVE-2005-3239
CVE-2005-3500
CVE-2005-3501
CVE-2005-3303
|
| Created: | November 7, 2005 |
Updated: | November 9, 2005 |
| Description: |
Multiple security holes were found in clamav that may allow attackers to
cause a denial of service, memory corruption and execution of arbitrary code. |
| Alerts: |
|
Comments (none posted)
common-lisp-controller: design error
| Package(s): | common-lisp-controller |
CVE #(s): | CAN-2005-2657
|
| Created: | September 14, 2005 |
Updated: | November 21, 2005 |
| Description: |
François-René Rideau discovered a bug in common-lisp-controller, a
Common Lisp source and compiler manager, that allows a local user to
compile malicious code into a cache directory which is executed by
another user if that user has not used Common Lisp before.
|
| Alerts: |
|
Comments (none posted)
cpio: directory traversal
| Package(s): | cpio |
CVE #(s): | CAN-2005-1111
|
| Created: | June 20, 2005 |
Updated: | December 26, 2005 |
| Description: |
There is a vulnerability in
cpio (2.6 and previous) that allows a malicious cpio file to
extract to an arbitrary directory of the attackers choice. cpio will
extract to the path specified in the cpio file, this path can be absolute. |
| Alerts: |
|
Comments (1 posted)
cyrus-imapd: buffer overflows
| Package(s): | cyrus-imapd |
CVE #(s): | CAN-2005-0546
|
| Created: | February 23, 2005 |
Updated: | April 10, 2006 |
| Description: |
Cyrus-imapd, prior to version 2.2.12, contains several buffer overflows which could be exploited by an (authenticated) attacker to run code on the server system. |
| Alerts: |
|
Comments (none posted)
dia: missing input sanitizing
| Package(s): | dia |
CVE #(s): | CAN-2005-2966
|
| Created: | October 4, 2005 |
Updated: | April 6, 2006 |
| Description: |
Joxean Koret discovered that the SVG import plugin did not properly
sanitize data read from an SVG file. By tricking an user into opening
a specially crafted SVG file, an attacker could exploit this to
execute arbitrary code with the privileges of the user. |
| Alerts: |
|
Comments (none posted)
elm: buffer overflow
| Package(s): | elm |
CVE #(s): | CAN-2005-2665
|
| Created: | August 23, 2005 |
Updated: | November 11, 2005 |
| Description: |
A buffer overflow flaw in Elm was
discovered that was triggered by viewing a mailbox containing a message
with a carefully crafted 'Expires' header. An attacker could create a
malicious message that would execute arbitrary code with the privileges of
the user who received it. |
| Alerts: |
|
Comments (none posted)
emacs21: format string vulnerability in "movemail"
| Package(s): | emacs21 |
CVE #(s): | CAN-2005-0100
|
| Created: | February 7, 2005 |
Updated: | May 15, 2006 |
| Description: |
Max Vozeler discovered a format string vulnerability in the "movemail"
utility of Emacs. By sending specially crafted packets, a malicious
POP3 server could cause a buffer overflow, which could be exploited to
execute arbitrary code with the privileges of the user and the "mail"
group. |
| Alerts: |
|
Comments (none posted)
enigmail: information disclosure
| Package(s): | enigmail |
CVE #(s): | CVE-2005-3256
|
| Created: | October 20, 2005 |
Updated: | December 13, 2005 |
| Description: |
The key selection dialog from the Mozilla Thunderbird enigmail plugin
has an information disclosure vulnerability.
A key with an empty user id from a user's keyring will be used by
default, allowing a message to be decrypted. This can lead to an
unauthorized information disclosure. |
| Alerts: |
|
Comments (none posted)
enscript: arbitrary code execution
| Package(s): | enscript |
CVE #(s): | CAN-2004-1184
CAN-2004-1185
CAN-2004-1186
|
| Created: | January 21, 2005 |
Updated: | May 27, 2006 |
| Description: |
Erik Sjölund has discovered several security relevant problems in enscript,
a program to convert ASCII text into Postscript and other formats.
Unsanitized input can cause the execution of arbitrary commands via EPSF
pipe support. Due to missing sanitizing of filenames it is possible that a
specially crafted filename can cause arbitrary commands to be executed.
Multiple buffer overflows can cause the program to crash. |
| Alerts: |
|
Comments (none posted)
ethereal: multiple vulnerabilities
Comments (none posted)
evolution: format string issues
Comments (2 posted)
fetchmailconf: insecure file creation
| Package(s): | fetchmail |
CVE #(s): | CVE-2005-3088
|
| Created: | October 26, 2005 |
Updated: | November 22, 2005 |
| Description: |
The fetchmailconf utility can create files which are world-readable for a brief period. These files may contain passwords, and thus should not be created in this manner.
|
| Alerts: |
|
Comments (none posted)
firefox: multiple vulnerabilities
Comments (none posted)
Foomatic: Arbitrary command execution in foomatic-rip
| Package(s): | foomatic |
CVE #(s): | CAN-2004-0801
|
| Created: | September 20, 2004 |
Updated: | May 31, 2006 |
| Description: |
There is a vulnerability in the foomatic-filters package. This
vulnerability is due to insufficient checking of command-line parameters
and environment variables in the foomatic-rip filter. This vulnerability
may allow both local and remote attackers to execute arbitrary commands on
the print server with the permissions of the spooler. |
| Alerts: |
|
Comments (none posted)
gaim: buffer overflow
| Package(s): | gaim |
CVE #(s): | CAN-2005-2103
|
| Created: | August 10, 2005 |
Updated: | February 27, 2006 |
| Description: |
Gaim suffers from a heap-based buffer overflow which can be exploited via a hostile "away message" to execute arbitrary code. |
| Alerts: |
|
Comments (none posted)
gdb: multiple vulnerabilities
| Package(s): | gdb |
CVE #(s): | CAN-2005-1704
CAN-2005-1705
|
| Created: | May 20, 2005 |
Updated: | August 11, 2006 |
| Description: |
Tavis Ormandy of the Gentoo Linux Security Audit Team discovered an integer
overflow in the BFD library, resulting in a heap overflow. A review also
showed that by default, gdb insecurely sources initialization files from
the working directory. Successful exploitation would result in the
execution of arbitrary code on loading a specially crafted object file or
the execution of arbitrary commands. |
| Alerts: |
|
Comments (5 posted)
gtk-pixbuf, gtk2: denial of service
| Package(s): | gdk-pixbuf gtk2 |
CVE #(s): | CAN-2005-0891
|
| Created: | March 30, 2005 |
Updated: | December 19, 2005 |
| Description: |
The BMP image processing code in gdk-pixbuf and gtk2 contains a denial of service vulnerability exploitable via a specially crafted image file.
|
| Alerts: |
|
Comments (none posted)
gedit: format string vulnerability
| Package(s): | gedit |
CVE #(s): | CAN-2005-1686
|
| Created: | June 9, 2005 |
Updated: | February 5, 2009 |
| Description: |
A format string vulnerability has been discovered in gedit. Calling
the program with specially crafted file names caused a buffer
overflow, which could be exploited to execute arbitrary code with the
privileges of the gedit user. |
| Alerts: |
|
Comments (1 posted)
gettext: Insecure temporary file handling
| Package(s): | gettext |
CVE #(s): | CAN-2004-0966
|
| Created: | October 11, 2004 |
Updated: | March 1, 2006 |
| Description: |
gettext insecurely creates temporary files in world-writeable directories
with predictable names. A local attacker could create symbolic links in
the temporary files directory, pointing to a valid file somewhere on the
filesystem. When gettext is called, this would result in file access with
the rights of the user running the utility, which could be the root user. |
| Alerts: |
|
Comments (1 posted)
glibc: tempfile vulnerability in catchsegv script
| Package(s): | glibc |
CVE #(s): | CAN-2004-0968
|
| Created: | October 21, 2004 |
Updated: | November 14, 2005 |
| Description: |
The catchsegv script in the glibc package has a symlink vulnerability
that may allow a local user to overwrite arbitrary
files with the permissions of the user that is running the script. |
| Alerts: |
|
Comments (none posted)
gpsdrive: format string vulnerability
| Package(s): | gpsdrive |
CVE #(s): | CVE-2005-3523
|
| Created: | November 9, 2005 |
Updated: | November 9, 2005 |
| Description: |
The gpsdrive navigation system contains a format string vulnerability which could be exploited to execute arbitrary code. |
| Alerts: |
|
Comments (none posted)
grip: buffer overflow
| Package(s): | grip |
CVE #(s): | CAN-2005-0706
|
| Created: | March 10, 2005 |
Updated: | November 19, 2008 |
| Description: |
Grip, a CD ripper, has a buffer overflow vulnerability that can
occur when the CDDB server returns more than 16 matches. |
| Alerts: |
|
Comments (none posted)
groff: insecure temporary directory
| Package(s): | groff |
CVE #(s): | CAN-2004-0969
|
| Created: | November 1, 2004 |
Updated: | February 9, 2006 |
| Description: |
Recently, Trustix Secure Linux discovered a vulnerability in the groff
package. The utility "groffer" created a temporary directory in an
insecure way, which allowed exploitation of a race condition to create
or overwrite files with the privileges of the user invoking the
program. |
| Alerts: |
|
Comments (none posted)
gzip: arbitrary command execution
| Package(s): | gzip |
CVE #(s): | CAN-2005-0758
|
| Created: | August 1, 2005 |
Updated: | January 10, 2007 |
| Description: |
zgrep in gzip before 1.3.5 does not handle shell metacharacters like '|'
and '&' properly when they occurred in input file names. This could be
exploited to execute arbitrary commands with user privileges if zgrep is
run in an untrusted directory with specially crafted file names. |
| Alerts: |
|
Comments (2 posted)
horde3: design error
| Package(s): | horde3 |
CVE #(s): | CVE-2005-3344
|
| Created: | November 7, 2005 |
Updated: | November 9, 2005 |
| Description: |
Mike O'Connor discovered that the default installation of Horde3 on
Debian includes an administrator account without a password. Already
configured installations will not be altered by this update. |
| Alerts: |
|
Comments (none posted)
htdig: cross site scripting
| Package(s): | htdig |
CVE #(s): | CAN-2005-0085
|
| Created: | February 14, 2005 |
Updated: | January 10, 2006 |
| Description: |
Michael Krax discovered that ht://Dig fails to validate the 'config'
parameter before displaying an error message containing the parameter.
This flaw could allow an attacker to conduct cross-site scripting
attacks. |
| Alerts: |
|
Comments (none posted)
imap: buffer overflow in c-client
| Package(s): | imap |
CVE #(s): | CAN-2003-0297
|
| Created: | February 18, 2005 |
Updated: | April 10, 2006 |
| Description: |
A buffer overflow flaw was found in the c-client IMAP client. An attacker
could create a malicious IMAP server that if connected to by a victim could
execute arbitrary code on the client machine. |
| Alerts: |
|
Comments (none posted)
kdebase: local root vulnerability
| Package(s): | kdebase |
CVE #(s): | CAN-2005-2494
|
| Created: | September 7, 2005 |
Updated: | August 11, 2006 |
| Description: |
The kdebase package (and kcheckpass in particular) found in KDE versions 3.2.0 through 3.4.2 suffers from a lock file handling error which can enable a local attacker to obtain root access. See this advisory for details. |
| Alerts: |
|
Comments (none posted)
kdelibs: kate backup file permission leak
| Package(s): | kdelibs kate kwrite |
CVE #(s): | CAN-2005-1920
|
| Created: | July 19, 2005 |
Updated: | September 21, 2010 |
| Description: |
Kate / Kwrite, as shipped with KDE 3.2.x up to including 3.4.0, creates a file backup before saving a modified file. These backup files are created with default permissions, even if the original file had more strict permissions set. See this advisory for more information. |
| Alerts: |
|
Comments (1 posted)
kernel: multiple vulnerabilities
Comments (none posted)
krb5: double-free flaw
| Package(s): | krb5 |
CVE #(s): | CAN-2004-0175
CAN-2005-0488
CAN-2005-1175
CAN-2005-1689
|
| Created: | July 12, 2005 |
Updated: | December 6, 2005 |
| Description: |
The krb5 authentication has a double-free flaw which may be
initiated by a remote unauthenticated attacker.
Also, a single byte heap overflow in the krb5_unparse_name() function
can lead to a denial of service and an information disclosure may
be caused by a malicious telnet server. See
This report for more
information. |
| Alerts: |
|
Comments (none posted)
libconvert-uulib-perl: arbitrary code execution
| Package(s): | libconvert-uulib-perl |
CVE #(s): | CAN-2005-1349
|
| Created: | May 20, 2005 |
Updated: | January 27, 2006 |
| Description: |
Mark Martinec and Robert Lewis discovered a buffer overflow in
Convert::UUlib (before 1.051), a Perl interface to the uulib library, which
may result in the execution of arbitrary code. |
| Alerts: |
|
Comments (1 posted)
libdbi-perl: insecure temporary file
| Package(s): | libdbi-perl |
CVE #(s): | CAN-2005-0077
|
| Created: | January 25, 2005 |
Updated: | March 2, 2006 |
| Description: |
Javier Fernández-Sanguino Peña from the Debian Security Audit Project
discovered that the DBI library, the Perl5 database interface, creates
a temporary PID file in an insecure manner. This can be exploited by a
malicious user to overwrite arbitrary files owned by the person
executing the parts of the library. |
| Alerts: |
|
Comments (none posted)
libgadu: memory alignment bug
| Package(s): | libgadu |
CVE #(s): | CAN-2005-2370
|
| Created: | July 29, 2005 |
Updated: | June 25, 2007 |
| Description: |
Szymon Zygmunt and Michal Bartoszkiewicz discovered a memory alignment
error in libgadu (from ekg, console Gadu Gadu client, an instant
messaging program) which is included in gaim, a multi-protocol instant
messaging client, as well. This can not be exploited on the x86
architecture but on others, e.g. on Sparc and lead to a bus error,
in other words a denial of service.
|
| Alerts: |
|
Comments (none posted)
libgd2: buffer overflows in PNG handling
| Package(s): | libgd2 |
CVE #(s): | CAN-2004-0990
CAN-2004-0941
|
| Created: | October 29, 2004 |
Updated: | June 28, 2006 |
| Description: |
Several buffer overflows have been discovered in libgd's PNG handling
functions.
If an attacker tricked a user into loading a malicious PNG image, they
could leverage this into executing arbitrary code in the context of
the user opening image. Most importantly, this library is commonly
used in PHP. One possible target would be a PHP driven photo website
that lets users upload images. Therefore this vulnerability might lead
to privilege escalation to a web server's privileges.
Multiple buffer overflows in the gd graphics library (libgd) 2.0.21 and
earlier may allow remote attackers to execute arbitrary code via malformed
image files that trigger the overflows due to improper calls to the
gdMalloc function. |
| Alerts: |
|
Comments (none posted)
libgda2: format string vulnerabilities
| Package(s): | libgda2 |
CVE #(s): | CAN-2005-2958
|
| Created: | October 25, 2005 |
Updated: | November 18, 2005 |
| Description: |
Steve Kemp discovered two format string vulnerabilities in libgda2,
the GNOME Data Access library for GNOME2, which may lead to the
execution of arbitrary code in programs that use this library. |
| Alerts: |
|
Comments (none posted)
libnet-ssleay-perl: weakened cryptographic operations
| Package(s): | libnet-ssleay-perl |
CVE #(s): | CAN-2005-0106
|
| Created: | May 3, 2005 |
Updated: | January 27, 2006 |
| Description: |
Javier Fernandez-Sanguino Pena discovered that this library used the
file /tmp/entropy as a fallback entropy source if a proper source was
not set in the environment variable EGD_PATH. This can potentially
lead to weakened cryptographic operations if an attacker provides a
/tmp/entropy file with known content. |
| Alerts: |
|
Comments (none posted)
libpam-ldap: authentication bypass
| Package(s): | libpam-ldap |
CVE #(s): | CAN-2005-2641
|
| Created: | August 25, 2005 |
Updated: | October 6, 2006 |
| Description: |
libpam-ldap, the PAM LDAP interface, has a vulnerability in which
it fails to authenticate with an LDAP server which is not configured
properly, allowing an authentication bypass. |
| Alerts: |
|
Comments (none posted)
libTIFF: buffer overflow
| Package(s): | libtiff |
CVE #(s): | CAN-2005-1544
|
| Created: | May 10, 2005 |
Updated: | February 18, 2006 |
| Description: |
Tavis Ormandy of the Gentoo Linux Security Audit Team discovered a
stack based buffer overflow in the libTIFF library when reading a TIFF
image with a malformed BitsPerSample tag. Successful exploitation would
require the victim to open a specially crafted TIFF image, resulting in the
execution of arbitrary code. |
| Alerts: |
|
Comments (1 posted)
libungif: memory corruption
| Package(s): | libungif |
CVE #(s): | CAN-2005-2974
|
| Created: | November 3, 2005 |
Updated: | March 20, 2006 |
| Description: |
The libungif library has a vulnerability in the GIF file
colormap handling code. A maliciously crafted GIF file can
cause out of bounds memory writing and register corruption. |
| Alerts: |
|
Comments (none posted)
libxml2 - arbitrary code execution
| Package(s): | libxml2 |
CVE #(s): | CAN-2004-0110
|
| Created: | February 26, 2004 |
Updated: | August 19, 2009 |
| Description: |
Yuuichi Teranishi discovered a flaw in libxml2 versions prior to 2.6.6.
When fetching a remote resource via FTP or HTTP, libxml2 uses special
parsing routines. These routines can overflow a buffer if passed a very
long URL. If an attacker is able to find an application using libxml2 that
parses remote resources and allows them to influence the URL, then this
flaw could be used to execute arbitrary code. |
| Alerts: |
|
Comments (none posted)
libxml2: multiple buffer overflows
| Package(s): | libxml2 |
CVE #(s): | CAN-2004-0989
|
| Created: | October 28, 2004 |
Updated: | August 19, 2009 |
| Description: |
libxml2 prior to version 2.6.14 has multiple buffer overflow
vulnerabilities, if a local user passes a specially crafted
FTP URL, arbitrary code may be executed. |
| Alerts: |
|
Comments (none posted)
libXpm: new buffer overflows
| Package(s): | libXpm |
CVE #(s): | CAN-2005-0605
|
| Created: | March 4, 2005 |
Updated: | March 8, 2006 |
| Description: |
A new vulnerability has been discovered in libXpm, which is included in
OpenMotif and LessTif, that can potentially lead to remote code
execution. |
| Alerts: |
|
Comments (none posted)
lm-sensors: insecure temp files
| Package(s): | lm-sensors |
CVE #(s): | CAN-2005-2672
|
| Created: | August 23, 2005 |
Updated: | November 10, 2005 |
| Description: |
Javier Fernández-Sanguino Peña noticed that the pwmconfig script created
temporary files in an insecure manner. This could allow a symlink attack to
create or overwrite arbitrary files with full root privileges since
pwmconfig is usually executed by root. |
| Alerts: |
|
Comments (1 posted)
Mantis: multiple vulnerabilities
| Package(s): | mantisbt |
CVE #(s): | CVE-2005-3091
CVE-2005-3335
CVE-2005-3336
CVE-2005-3338
CVE-2005-3339
|
| Created: | October 28, 2005 |
Updated: | December 22, 2005 |
| Description: |
Mantis contains several vulnerabilities, including a remote file inclusion
vulnerability, an SQL injection vulnerability, multiple cross site
scripting vulnerabilities and multiple information disclosure
vulnerabilities. |
| Alerts: |
|
Comments (none posted)
mod_python: remote access vulnerability
| Package(s): | mod_python |
CVE #(s): | CAN-2005-0088
|
| Created: | February 10, 2005 |
Updated: | April 10, 2006 |
| Description: |
mod_python has a vulnerability in the publisher handler that may allow
a remote user to use a specially crafted URL to allow access to
objects that should be protected. An information leak can result. |
| Alerts: |
|
Comments (none posted)
mysql: buffer overflow
| Package(s): | mysql |
CVE #(s): | CAN-2005-2558
|
| Created: | September 12, 2005 |
Updated: | January 12, 2006 |
| Description: |
The mysql CREATE FUNCTION can be used to create a buffer overflow.
A specially crafted long function name can be used by a local attacker
to crash the server or execute arbitrary code with the privileges of
the server. |
| Alerts: |
|
Comments (none posted)
mysql: low-impact security fix
| Package(s): | mysql |
CVE #(s): | CAN-2005-1636
|
| Created: | July 20, 2005 |
Updated: | February 22, 2006 |
| Description: |
An update to MySQL version 4.1.12 fixes a low-impact security
problem (bz#158689). |
| Alerts: |
|
Comments (1 posted)
ncpfs: multiple vulnerabilities
| Package(s): | ncpfs |
CVE #(s): | CAN-2005-0013
CAN-2005-0014
|
| Created: | January 31, 2005 |
Updated: | May 15, 2006 |
| Description: |
Erik Sjolund discovered two vulnerabilities in the programs bundled
with ncpfs: there is a potentially exploitable buffer overflow in
ncplogin (CAN-2005-0014), and due to a flaw in nwclient.c, utilities
using the NetWare client functions insecurely access files with
elevated privileges (CAN-2005-0013). |
| Alerts: |
|
Comments (none posted)
nfs-utils: arbitrary code execution
| Package(s): | nfs-utils |
CVE #(s): | CAN-2004-0946
|
| Created: | January 11, 2005 |
Updated: | February 27, 2006 |
| Description: |
Arjan van de Ven discovered a buffer overflow in rquotad on 64bit
architectures; an improper integer conversion could lead to a buffer
overflow. An attacker with access to an NFS share could send a specially
crafted request which could then lead to the execution of arbitrary code. |
| Alerts: |
|
Comments (none posted)
ntp: uses wrong gid
| Package(s): | ntp |
CVE #(s): | CAN-2005-2496
|
| Created: | August 26, 2005 |
Updated: | August 11, 2006 |
| Description: |
When starting xntpd with the -u option and specifying the
group by using a string not a numeric gid the daemon uses
the gid of the user not the group. This problem is now fixed
by this update. |
| Alerts: |
|
Comments (none posted)
openssh: GSSAPI credential disclosure
| Package(s): | openssh |
CVE #(s): | CAN-2005-2798
|
| Created: | September 7, 2005 |
Updated: | February 3, 2006 |
| Description: |
OpenSSH prior to version 4.2 will allow GSSAPI credentials to be delegated to users who are not using GSSAPI authentication, possibly leading to the unwanted disclosure of those credentials. OpenSSH 4.2 has the fix.
|
| Alerts: |
|
Comments (none posted)
openssl: protocol rollback
| Package(s): | openssl |
CVE #(s): | CAN-2005-2969
|
| Created: | October 12, 2005 |
Updated: | December 19, 2005 |
| Description: |
OpenSSL prior to version 0.9.7h or 0.9.8a contains a vulnerability which could enable an attacker to force the use of the older, less secure SSL 2.0 protocol. See this advisory for details or this analysis for even more details. |
| Alerts: |
|
Comments (1 posted)
openvpn: format string vulnerability
| Package(s): | openvpn |
CVE #(s): | CVE-2005-3393
CVE-2005-3409
|
| Created: | November 2, 2005 |
Updated: | December 12, 2005 |
| Description: |
OpenVPN 2.0.x contains a format string vulnerability which can be exploited by a hostile server; see this advisory for details. |
| Alerts: |
|
Comments (none posted)
pcre3: arbitrary code execution
| Package(s): | pcre3 |
CVE #(s): | CAN-2005-2491
|
| Created: | August 23, 2005 |
Updated: | March 10, 2006 |
| Description: |
A buffer overflow has been discovered in the PCRE, a widely used library
that provides Perl compatible regular expressions. Specially crafted
regular expressions triggered a buffer overflow. On systems that accept
arbitrary regular expressions from untrusted users, this could be exploited
to execute arbitrary code with the privileges of the application using the
library. |
| Alerts: |
|
Comments (none posted)
perl: setuid vulnerabilities
| Package(s): | perl |
CVE #(s): | CAN-2005-0155
CAN-2005-0156
|
| Created: | February 2, 2005 |
Updated: | August 11, 2006 |
| Description: |
There are two vulnerabilities with perl when it is used in a setuid mode. The PERLIO_DEBUG environment variable can be used to overwrite arbitrary files; there is also an associated buffer overflow which can be exploited to gain root access. |
| Alerts: |
|
Comments (none posted)
perl: symlink vulnerability
| Package(s): | perl |
CVE #(s): | CAN-2005-0448
|
| Created: | March 9, 2005 |
Updated: | January 30, 2006 |
| Description: |
The rmtree() function in the File:Path.pm module has a symlink vulnerability which could be exploited to create setuid binaries. |
| Alerts: |
|
Comments (none posted)
php: multiple vulnerabilities
| Package(s): | php |
CVE #(s): | CVE-2005-3390
CVE-2005-3389
CVE-2005-3388
CVE-2005-3353
|
| Created: | November 8, 2005 |
Updated: | December 23, 2005 |
| Description: |
There are multiple vulnerabilities in PHP, including malicious requests may overwrite the GLOBALS array, the parse_str() function may enable the
register_globals setting, cross-site scripting bugs in phpinfo() and a bug in EXIF image parsing that may crash the process. |
| Alerts: |
|
Comments (none posted)
phpMyAdmin: local file inclusion and XSS
| Package(s): | phpmyadmin |
CVE #(s): | CVE-2005-2869
CVE-2005-3300
CVE-2005-3301
|
| Created: | October 25, 2005 |
Updated: | November 18, 2005 |
| Description: |
Stefan Esser discovered that by calling certain PHP files directly, it
was possible to workaround the grab_globals.lib.php security model and
overwrite the $cfg configuration array. Systems running PHP in safe
mode are not affected. Futhermore, Tobias Klein reported several
cross-site-scripting issues resulting from insufficient user input
sanitizing. A local attacker may exploit this vulnerability by sending
malicious requests, causing the execution of arbitrary code with the rights
of the user running the web server. Furthermore, the cross-site scripting
issues give a remote attacker the ability to inject and execute malicious
script code or to steal cookie-based authentication credentials,
potentially compromising the victim's browser. |
| Alerts: |
|
Comments (none posted)
phpsysinfo: cross-site-scripting
| Package(s): | phpsysinfo |
CVE #(s): | CAN-2005-0870
|
| Created: | May 18, 2005 |
Updated: | November 15, 2005 |
| Description: |
The phpsysinfo program contains several cross-site scripting vulnerabilities. |
| Alerts: |
|
Comments (none posted)
postgresql: database initialization errors
| Package(s): | postgresql |
CVE #(s): | CAN-2005-1409
CAN-2005-1410
|
| Created: | May 4, 2005 |
Updated: | February 28, 2006 |
| Description: |
PostgreSQL suffers from two vulnerabilities in how databases are set up by default; they allow a local attacker (one with access to the database) to crash the back end and, perhaps, execute code with the privileges of the server process. See this advisory for details and workarounds.
|
| Alerts: |
|
Comments (none posted)
Pound: buffer overflow
| Package(s): | pound |
CVE #(s): | CVE-2005-1391
|
| Created: | May 2, 2005 |
Updated: | January 10, 2006 |
| Description: |
Steven Van Acker has discovered a buffer overflow vulnerability in the
"add_port()" function in Pound 1.8.2+. A remote attacker could send a
request for an overly long hostname parameter, which could lead to the
remote execution of arbitrary code with the rights of the Pound daemon
process. |
| Alerts: |
|
Comments (none posted)
pstotext: remote execution of arbitrary code
| Package(s): | pstotext netpbm |
CVE #(s): | CAN-2005-2471
|
| Created: | August 1, 2005 |
Updated: | March 28, 2006 |
| Description: |
Max Vozeler reported that pstotext calls the GhostScript interpreter on
untrusted PostScript files without specifying the -dSAFER option. An
attacker could craft a malicious PostScript file and entice a user to run
pstotext on it, resulting in the execution of arbitrary commands with the
permissions of the user running pstotext. See this Secunia advisory for more information. |
| Alerts: |
|
Comments (2 posted)
pwdutils: privilege escalation
| Package(s): | pwdutils shadow |
CVE #(s): | |
| Created: | November 4, 2005 |
Updated: | November 9, 2005 |
| Description: |
Thomas Gerisch found that the setuid 'chfn' program contained in the
pwdutils suite insufficiently checks it's arguments when changing the GECOS
field. This bug leads to a trivially exploitable local privilege escalation
that allows users to gain root access. |
| Alerts: |
|
Comments (none posted)
Py2Play: remote execution of arbitrary Python code
| Package(s): | Py2Play |
CVE #(s): | CAN-2005-2875
|
| Created: | September 19, 2005 |
Updated: | September 6, 2006 |
| Description: |
Py2Play uses Python pickles to send objects over a peer-to-peer game network, that clients accept without restriction the objects and code sent by peers. A remote attacker participating in a Py2Play-powered game can send
malicious Python pickles, resulting in the execution of arbitrary
Python code on the targeted game client. |
| Alerts: |
|
Comments (none posted)
rp-pppoe, pppoe: missing privilege dropping
| Package(s): | rp-pppoe, pppoe |
CVE #(s): | CAN-2004-0564
|
| Created: | October 4, 2004 |
Updated: | November 15, 2005 |
| Description: |
Max Vozeler discovered a vulnerability in pppoe, the PPP over Ethernet
driver from Roaring Penguin. When the program is running setuid root
(which is not the case in a default Debian installation), an attacker
could overwrite any file on the file system. |
| Alerts: |
|
Comments (none posted)
smb4k: temporary file vulnerability
| Package(s): | smb4k |
CVE #(s): | CVE-2005-2851
|
| Created: | September 7, 2005 |
Updated: | December 7, 2005 |
| Description: |
Smb4K has a temporary file vulnerability which can allow an unprivileged user to read certain files which would otherwise be inaccessible.
|
| Alerts: |
|
Comments (none posted)
spamassassin: denial of service
| Package(s): | spamassassin |
CVE #(s): | CVE-2005-3351
|
| Created: | November 9, 2005 |
Updated: | March 7, 2006 |
| Description: |
Spamassassin through version 3.0.4 can be made to dump core if a message arrives with too many addresses in the To: field. |
| Alerts: |
|
Comments (none posted)
squid: authentication handling
| Package(s): | squid |
CVE #(s): | CAN-2005-2917
|
| Created: | September 30, 2005 |
Updated: | March 15, 2006 |
| Description: |
Upstream developers of squid, the popular WWW proxy cache, have
discovered that changes in the authentication scheme are not handled
properly when given certain request sequences while NTLM
authentication is in place, which may cause the daemon to restart. |
| Alerts: |
|
Comments (none posted)
sudo: missing input sanitizing
| Package(s): | sudo |
CVE #(s): | CVE-2005-2959
|
| Created: | October 25, 2005 |
Updated: | February 19, 2006 |
| Description: |
Tavis Ormandy noticed that sudo, a program that provides limited super
user privileges to specific users, does not clean the environment
sufficiently. The SHELLOPTS and PS4 variables are dangerous and are
still passed through to the program running as privileged user. This
can result in the execution of arbitrary commands as privileged user
when a bash script is executed. These vulnerabilities can only be
exploited by users who have been granted limited super user
privileges. |
| Alerts: |
|
Comments (none posted)
sudo: race condition
| Package(s): | sudo |
CVE #(s): | CAN-2005-1993
|
| Created: | June 21, 2005 |
Updated: | February 24, 2006 |
| Description: |
Charles Morris discovered a race condition in sudo which could lead to
privilege escalation. If /etc/sudoers allowed a user the execution of
selected programs, and this was followed by another line containing
the pseudo-command "ALL", that user could execute arbitrary commands
with sudo by creating symbolic links at a certain time. |
| Alerts: |
|
Comments (none posted)
sylpheed: buffer overflow
| Package(s): | sylpheed |
CVE #(s): | CVE-2005-3354
|
| Created: | November 9, 2005 |
Updated: | January 6, 2006 |
| Description: |
The sylpheed mail client, prior to versions 1.0.6 and 2.0.4, contains a buffer overflow in the LDIF address book import code. |
| Alerts: |
|
Comments (none posted)
sysreport: insecure temporary file
| Package(s): | sysreport |
CVE #(s): | CAN-2005-2104
|
| Created: | August 9, 2005 |
Updated: | November 11, 2005 |
| Description: |
Bill Stearns discovered a bug in the way sysreport creates temporary files.
It is possible that a local attacker could obtain sensitive information
about the system when sysreport is run. |
| Alerts: |
|
Comments (none posted)
File overwrite vulnerability in tar and unzip
| Package(s): | tar unzip |
CVE #(s): | CAN-2001-1267
CAN-2001-1268
CAN-2001-1269
CAN-2002-0399
|
| Created: | October 1, 2002 |
Updated: | April 10, 2006 |
| Description: |
The tar utility does not properly filter file names containing
"../", meaning that a hostile archive can, if unpacked by an
unsuspecting user, overwrite any file that is writable by that user. GNU
tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42
has the same vulnerability. |
| Alerts: |
|
Comments (1 posted)
tcpdump: multiple DoS issues
| Package(s): | tcpdump |
CVE #(s): | CAN-2005-1280
CAN-2005-1279
CAN-2005-1278
|
| Created: | May 2, 2005 |
Updated: | April 10, 2006 |
| Description: |
The rsvp_print function in tcpdump 3.9.1 and earlier allows remote
attackers to cause a denial of service (infinite loop) via a crafted RSVP
packet of length 4. (CAN-2005-1280)
tcpdump 3.8.3 and earlier allows remote attackers to cause a denial of
service (infinite loop) via a crafted BGP packet, which is not properly
handled by RT_ROUTING_INFO, or LDP packet, which is not properly
handled by the ldp_print function. (CAN-2005-1279)
The isis_print function, as called by isoclns_print, in tcpdump 3.9.1 and
earlier allows remote attackers to cause a denial of service (infinite
loop) via a zero length, as demonstrated using a GRE packet.
(CAN-2005-1278) |
| Alerts: |
|
Comments (none posted)
texinfo: temporary file vulnerability
| Package(s): | texinfo |
CVE #(s): | CAN-2005-3011
|
| Created: | October 5, 2005 |
Updated: | November 9, 2006 |
| Description: |
Texinfo prior to version 4.8-r1 suffers from a temporary file vulnerability. |
| Alerts: |
|
Comments (none posted)
thttpd: insecure temp file
| Package(s): | thttpd |
CVE #(s): | CVE-2005-3124
|
| Created: | November 4, 2005 |
Updated: | November 9, 2005 |
| Description: |
Javier Fernández-Sanguino Peña from the Debian Security Audit team
discovered that the syslogtocern script from thttpd, a tiny webserver,
uses a temporary file insecurely, allowing a local attacker to craft a
symlink attack to overwrite arbitrary files. |
| Alerts: |
|
Comments (none posted)
ucd-snmp: denial of service
| Package(s): | ucd-snmp |
CVE #(s): | CAN-2005-2177
|
| Created: | August 9, 2005 |
Updated: | January 27, 2006 |
| Description: |
A denial of service bug was found in the way ucd-snmp uses network stream
protocols. A remote attacker could send a ucd-snmp agent a specially
crafted packet which will cause the agent to crash. |
| Alerts: |
|
Comments (none posted)
uim: privilege escalation
| Package(s): | uim |
CVE #(s): | CVE-2005-3149
|
| Created: | October 4, 2005 |
Updated: | December 7, 2005 |
| Description: |
Masanari Yamamoto discovered that Uim uses environment variables
incorrectly. This bug causes a privilege escalation if setuid/setgid
applications are linked to libuim. This bug only affects
immodule-enabled Qt (if you build Qt 3.3.2 or later versions with
USE="immqt" or USE="immqt-bc"). |
| Alerts: |
|
Comments (none posted)
unzip: race condition
| Package(s): | unzip |
CVE #(s): | CAN-2005-2475
|
| Created: | September 29, 2005 |
Updated: | January 12, 2006 |
| Description: |
Unzip has a race condition vulnerability
in the handling of output files.
During file unpacking, a local attacker can modify the permissions
of arbitrary files in the victim's directory. |
| Alerts: |
|
Comments (none posted)
up-imapproxy: format string vulnerabilities
| Package(s): | up-imapproxy |
CVE #(s): | CAN-2005-2661
|
| Created: | October 10, 2005 |
Updated: | March 7, 2006 |
| Description: |
up-imapproxy contains two format string vulnerabilities which could be exploited to execute arbitrary code.
|
| Alerts: |
|
Comments (none posted)
util-linux: unintentional grant of privileges by umount
| Package(s): | util-linux |
CVE #(s): | CAN-2005-2876
|
| Created: | September 13, 2005 |
Updated: | December 19, 2005 |
| Description: |
Linux umount command as provided in the util-linux package in
versions 2.8 to 2.12q, 2.13-pre1 and 2.13-pre2 grants root privileges. See this BugTraq post for more information. |
| Alerts: |
|
Comments (none posted)
uw-imap: buffer overflow
| Package(s): | uw-imap |
CVE #(s): | CAN-2005-2933
|
| Created: | October 11, 2005 |
Updated: | April 10, 2006 |
| Description: |
"infamous41md" discovered a buffer overflow in uw-imap, the University
of Washington's IMAP Server that allows attackers to execute arbitrary
code. |
| Alerts: |
|
Comments (none posted)
vixie-cron: crontab allows any user to read another users crontabs
| Package(s): | vixie-cron |
CVE #(s): | CAN-2005-1038
|
| Created: | April 15, 2005 |
Updated: | March 15, 2006 |
| Description: |
crontab in Vixie cron 4.1, when running with the -e option, allows local
users to read the cron files of other users by changing the file being
edited to a symlink. NOTE: there is insufficient information to know
whether this is a duplicate of CVE-2001-0235. See also this Security Focus
report. |
| Alerts: |
|
Comments (none posted)
w3c-libwww: possible stack overflow
| Package(s): | w3c-libwww |
CVE #(s): | CVE-2005-3183
|
| Created: | October 14, 2005 |
Updated: | May 2, 2007 |
| Description: |
xtensive testing of libwww's handling of multipart/byteranges content from
HTTP/1.1 servers revealed multiple logical flaws and bugs in
Library/src/HTBound.c |
| Alerts: |
|
Comments (1 posted)
XChat 2.0.x SOCKS5 Vulnerability
| Package(s): | xchat |
CVE #(s): | CAN-2004-0409
|
| Created: | April 19, 2004 |
Updated: | November 15, 2005 |
| Description: |
XChat is vulnerable to a stack overflow that may allow a remote attacker to
run arbitrary code. The SOCKS 5 proxy code in XChat is vulnerable to a
remote exploit. Users would have to be using XChat through a SOCKS 5
server, enable SOCKS 5 traversal which is disabled by default and also
connect to an attacker's custom proxy server. This vulnerability may allow
an attacker to run arbitrary code within the context of the user ID of the
XChat client. |
| Alerts: |
|
Comments (none posted)
xine-lib: buffer overflows
| Package(s): | xine-lib |
CVE #(s): | CAN-2004-1379
|
| Created: | September 22, 2004 |
Updated: | April 10, 2006 |
| Description: |
xine-lib (through version 1_rc6) contains buffer overflows in the subtitle parsing and DVD sub-picture decoder code. |
| Alerts: |
|
Comments (none posted)
xine-ui - insecure temporary file creation
| Package(s): | xine-ui |
CVE #(s): | CAN-2004-0372
|
| Created: | April 6, 2004 |
Updated: | April 27, 2006 |
| Description: |
Shaun Colley discovered a problem in xine-ui, the xine video player
user interface. A script contained in the package to possibly remedy
a problem or report a bug does not create temporary files in a secure
fashion. This could allow a local attacker to overwrite files with
the privileges of the user invoking xine. |
| Alerts: |
|
Comments (none posted)
xloadimage: buffer overflows
| Package(s): | xloadimage |
CVE #(s): | CAN-2005-3178
|
| Created: | October 10, 2005 |
Updated: | May 15, 2006 |
| Description: |
Three buffer overflows were discovered in xloadimage when handling the image title name. A malicious user can construct a NIFF file that when viewed and processed (with either zoom, reduce or rotate) by xloadimage, will cause the program to overwrite the return address and execute arbitrary code. |
| Alerts: |
|
Comments (none posted)
xorg-x11: heap overflow
| Package(s): | xorg-x11 |
CVE #(s): | CAN-2005-2495
|
| Created: | September 12, 2005 |
Updated: | March 8, 2006 |
| Description: |
The pixmap memory allocation code in the X.Org X window system is
vulnerable to an integer overflow, a local user can use this to
execute arbitrary code with elevated privileges. |
| Alerts: |
|
Comments (none posted)
xpdf: buffer overflow
| Package(s): | xpdf |
CVE #(s): | CAN-2005-0064
|
| Created: | January 19, 2005 |
Updated: | March 15, 2007 |
| Description: |
iDEFENSE has found yet another xpdf buffer overflow; see this advisory for details. |
| Alerts: |
|
Comments (1 posted)
xpdf: denial of service
| Package(s): | xpdf kpdf |
CVE #(s): | CAN-2005-2097
|
| Created: | August 9, 2005 |
Updated: | August 2, 2006 |
| Description: |
A flaw was discovered in Xpdf in that could allow an attacker to construct
a carefully crafted PDF file that would cause Xpdf to consume all available
disk space in /tmp when opened. |
| Alerts: |
|
Comments (none posted)
zlib: buffer overflow
| Package(s): | zlib |
CVE #(s): | CAN-2005-1849
|
| Created: | July 21, 2005 |
Updated: | April 11, 2006 |
| Description: |
zlib has a vulnerability that can cause code that executes it to crash
if a corrupted file is opened. |
| Alerts: |
|
Comments (none posted)
Resources
Plash 1.14 is out. Plash is:
...is a secure, restricted execution environment for running Linux
programs with the minimum necessary privileges. It is similar to
using chroot jails, but is more lightweight and flexible. You can use
Plash to grant a process read-only or read-write access to specific
files and directories, which can be mapped at any point in its private
filesystem namespace.
This release includes a new "file powerbox" capability which can allow a user to grant access to specific files to an application on the fly.
Full Story (comments: none)
Page editor: Jonathan Corbet
Kernel development
Brief items
The current stable 2.6 kernel is 2.6.14.2,
released on November 10.
2.6.14.2 contains about a dozen fixes, including one for the zero-length
datagram bug. It does not contain a fix for the
file lease denial of service bug yet, however.
The current 2.6 prepatch is 2.6.15-rc1, announced by Linus on
November 11. Says Linus:
It's hard to go through in any great detail, because even the
shortlog is actually almost five thousand lines and about 200kB in
size, and would thus run afoul of the mailing list limits so I
can't include it here. The same is true of the diffstat, only even
more so. The unidiff is about a million lines in size, just the
diffstat is 300+kB.
The changes are really pretty much all over the place, with over
four thousand commits merged in the two weeks since 2.6.14...
The changes in 2.6.15 have been listed in detail here last week and the week before. Significant
changes merged since last week's article, but before 2.6.15-rc1, include a
new, simpler, type-safe netlink API, a new netfilter connection tracking
implementation (which understands IPv6 and will eventually replace the
current code), the removal of some SCSI subsystem typedefs
(Scsi_Device, Scsi_Pointer, and
Scsi_Host_Template), the removal of the owner field from
struct pci_driver, and a new "platform driver" interface.
For those who are just tuning in: some of the more significant changes in
2.6.15 will include device model changes, basic hotplug memory support, a
reworked NTFS implementation with improved write behavior, a big CIFS
update, a number of block improvements (and a reorganization of the block
layer into its own top-level directory), the Open-iSCSI initiator,
InfiniBand SCSI RDMA, RapidIO
support, a number of scheduler tweaks, the shared subtrees patch,
four-level page tables for the ia-64 architecture, and much more. See the short log for a long list of changes, or
the
long-format changelog for the details.
2.6.15-rc1 marks the closing of the window for new features, so Linus's git
repository contains mostly fixes. It does, however, also include a generic
cmpxchg implementation for i386, new Omnikey Cardman 4000 and 4040
drivers, and a new DMA32 zone for the x86-64 architecture.
The current -mm tree is 2.6.14-mm2. Recent changes to
-mm include some relayfs enhancements, some scheduler tweaks, and various
fixes.
The current 2.4 kernel is 2.4.32, released by Marcelo on
November 16. 2.4 is in deep maintenance mode, so there's not a whole
lot of new features in 2.4.32.
Comments (1 posted)
Kernel development news
Greg Kroah-Hartman has gotten tired of answering the same questions about
Linux kernel development. So he has put together
a HOWTO document to get people
started. The goals are ambitious: "
This is the be-all, end-all
document on this topic. It contains instructions on how to become a Linux
kernel developer and how to learn to work with the Linux kernel development
community." Now people just have to
read it...
Comments (6 posted)
The question of whether the i386 architecture should move to using 4K
kernel stacks by default has been raised a few times; LWN last
covered the 4K stack issue in
September. Adrian Bunk has started the discussion anew with
this proposal that the -mm tree
go to 4K stacks (only) now, with an eye toward changing the mainline for
2.6.16.
Most of the technical issues have not changed since September, so those
arguments will not be repeated here. It is worth noting that layered block
devices and filesystems have mostly been fixed. In past kernels, highly
stacked devices (think of a combination of RAID, encryption, and network
filesystems) could end up with very long call chains in the kernel, and, as
a result, overflow the kernel stack. Most of these calls have since been
serialized, so block-layer stacking should not be a problem.
The issue that remains is NDISwrapper, the glue layer which allows Windows
NDIS drivers to be loaded into a Linux kernel. Windows runs with a much
larger kernel stack size, so NDIS driver writers have no reason to be as
careful about stack usage. And, of course, these drivers cannot be fixed
to work properly with Linux. Some have argued that breaking NDISwrapper is
not a possibility, since many users rely upon it to make their wireless
network adapters work. But patience with this line of thought is running
thin, as can be seen in this outburst from
Dave Jones:
If we continue down this path, we'll have no native wireless
drivers for Linux. The answer is not to complain to linux-kernel
for breaking ndiswrapper, but complain to the vendors for not
releasing specifications for native drivers to be written.
The good news is that the wireless situation is
not as bad as one might think. There is documentation for Broadcom
chips available now, and a
Broadcom driver is in the works. There is also an
Atheros driver which is "nearly done." Once these drivers are complete
and joined with the Intel drivers already in the mainline, Linux will have
much better support for wireless devices, and far fewer systems will have
any reason to use NDISwrapper.
There are a number of reasons for going with the 4K stack mode, including
better performance and higher reliability. Some distributions (e.g. Fedora
Core and RHEL) have been shipping 4K kernels for a while now. So, while
nobody has committed to moving the mainline (or -mm) toward 4K-only yet,
chances are improving that it will happen sometime in the not-too-distant
future.
Comments (15 posted)
Page migration is the act of moving a process's pages from one part of the
system to another. Often, the motivation is moving pages between NUMA nodes
in the hope of improving performance. When this page last
looked at the page migration patch
set, it worked by forcing target pages out to the swap device. When
the owning process later faults them in, these pages will end up on the
desired node. This technique works, but it is not optimal: it would be
nicer to avoid having to write the pages to disk and read them back in.
Christoph Lameter has now followed up with the direct migration patch set,
which does away with the side-trip to the swap device. A look at the patch
shows why things were not done this way in the first place; direct page
migration involves rather more than simply copying the data over. The
first step, after choosing a target page, is to lock that page so that
nobody else will mess with it. There might currently be I/O active which
involves that page, so the kernel must wait for any such I/O to complete.
Only then can the real migration work begin.
The kernel must establish a swap cache entry for the page, even though it
intends to avoid writing the page to swap. This entry will cause the right
thing to happen if a process faults on the page while it is being moved.
Then all references
to the page (page table entries) are unmapped. With luck, all references
will go away; if references remain for any reason, the page cannot be
moved.
Actually moving the page involves copying a subset of the page status bits
over, copying the page data itself, then copying the rest of the status
bits. The old page is cleared out and freed. If any writeback has been
queued up for the new page, it is set in motion. Then it's just a matter
of cleaning up, and the page has been successfully moved.
If the kernel runs out of free pages on the target node, it will fall back
to the swap-based mechanism. So that stage of this patch's evolution
remains useful.
With this code in place, the kernel has the support it needs to try to keep
a process's pages in local memory. The migration code might also prove
useful for hotplug memory uses, where all pages must be vacated from a
given region. Indeed, some of this code was originally written for hotplug
applications. But, at this point, the migration is done on a best-effort
basis. For NUMA systems, failure to move a page results in worse
performance, but nothing particularly severe. For hotplug memory, instead,
this sort of failure will block a memory remove operation altogether.
Moving all pages in a region with 100% certainty remains a difficult
problem without a complete solution at this time.
One of the pieces of such a solution might be active memory defragmentation
which, among other things, works to keep non-movable memory allocations out
of memory regions which might be removed. When we looked at active
defragmentation last week,
that patch set looked like it was in trouble. The overhead of the
defragmentation code seemed to be too high, and a number of developers
(Linus included) felt that this sort of functionality should be implemented
using the kernel's zone system, rather then with a new layer in the memory
allocator.
Defragmentation hacker Mel Gorman doesn't give up that easily, however. He
has posted a new, "light" version
of the defragmentation patch which, he hopes, will be better received.
As he describes it:
This is a much simplified anti-defragmentation approach that simply
tries to keep kernel allocations in groups of 2^(MAX_ORDER-1) and
easily reclaimed allocations in groups of 2^(MAX_ORDER-1). It uses
no balancing, tunables special reserves and it introduces no new
branches in the main path. For small memory systems, it can be
disabled via a config option. In total, it adds 275 new lines of
code with minimum changes made to the main path.
In this version of the patch, a new GFP flag (__GFP_EASYRCLM) is
added; its presence indicates an allocation which the kernel can easily get
back should the need arise. It is used for user-space pages (which can
usually be forced out to backing store) and in a few other situations, such
as for some kernel buffers. The buddy allocator already keeps track of
memory in large chunks; the new code simply steers reclaimable allocations
toward some chunks, while keeping the non-reclaimable allocations in
others. In this way, it is hoped, there will be no situations where one
non-movable page blocks the freeing of the large, contiguous region in
which it is located.
The patch works by creating a "usemap" array tracking which kind of allocation is
being done from each large chunk of memory. Mel also had to split the
per-CPU free lists which are used to perform fast single-page allocations;
now there are two such lists, one for each allocation type. From there, it
is just a matter of taking allocations from the proper pile, depending on
the __GFP_EASYRCLM flag.
This version certainly reduces the footprint and overhead of the
defragmentation patches. It is still not the zone-based approach that
others were pushing for, however. So it remains to be seen whether "active
defragmentation lite" is, in the end, better received than its
predecessors.
Comments (4 posted)
The kernel has long had a series of functions which read and write memory
locations in the legacy ISA memory range. These functions, with names like
isa_readb(), require no special preparation to use, and they only
work in the ISA hole. They also have been obsolete and deprecated for
quite some time.
Recently, there has been an effort to finally get rid of
isa_readb() and friends. To that end, Al Viro has posted a set of
"isaectomy" patches which fix up the remaining callers (they are made to
use ioremap() and the not quite as obsolete readb()
family of functions) so that the old stuff can be deleted. One would think
that this work would be uncontroversial, but Linus, it turns out, is unconvinced:
Hmm.. I actually believe that the isa_read() functions are more
portable and easier to use than ioremap().
The reason? A platform will always know where any legacy ISA bus
resides, while the "ioremap()" thing will depend on platform PCI
code to have set the right offsets (and thus the resource
addresses) for whatever bus the PCI device is on.
The fact is, however, that very little in-tree code still uses these
functions. They are a deprecated interface to a very old and obsolete
hardware standard, and they have few defenders. So anybody maintaining
out-of-tree which still uses these functions might want to take warning:
they probably will not stay around for much longer.
Comments (1 posted)
The relative calm which has settled around the software suspend subsystem
may be about to come to an end. This part of the kernel, which has never
worked to everybody's satisfaction, remains subject to different ideas of
how the problem should be solved.
Pavel Machek's user-space software suspend patch was covered here in September.
Pavel has now posted a
new version of the patch with a request that it be merged for 2.6.16.
The user-space approach is, clearly, the way Pavel thinks that software
suspend should go. Beyond getting some code out of the kernel, this
approach makes a number of add-on features, such as graphical displays,
image compression, image encryption, network-based suspend, etc., easier to
implement. If you want to hang a big pile of features onto the suspend
mechanism, you eventually have to get into user space.
One of the first responses came from Dave
Jones, who said:
Just for info: If this goes in, Red Hat/Fedora kernels will fork
swsusp development, as this method just will not work there.
The main issue is the fact that the user-space approach uses
/dev/kmem to repopulate memory at resume time. Red Hat and Fedora
kernels do not allow memory to be overwritten in this way; there are no
other applications which need that capability, with the exception of
rootkits. Allowing user space to overwrite arbitrary physical pages is, to
Dave, not worth it, no matter how many software suspend features it
enables. Says Dave: "I'll take 'rootkit doesnt work' over 'bells and
whistles'."
Nigel Cunningham, the author of the Suspend2 patches, also has some
thoughts on the matter. He has been busily cleaning up the suspend2
patches with an eye toward making them more palatable for merging into the
mainline. It turns out that Nigel has a set of
225 patches which he will soon make available. Since few people have
seen the new patch set, it's not clear what sort of reception it will get.
It can be said, though, that 225 patches is a large pile of code. Anybody
trying to get a patch set of that size merged needs to have some fairly
convincing arguments in hand.
At some point, Nigel's code mountain will become available, and some sort
of decision will have to be made. Software suspend could be transformed
into suspend2, or moved partially to user space. Or it could be left
more-or-less as it is now. These are three very distinct choices -
especially as nobody wants to see a repeat of the situation where the
mainline kernel supported more than one software suspend implementation.
With luck, when the dust settles, Linux will have a more featureful and
reliable software suspend implementation than it does now. But expect some
interesting discussion between now and then.
Comments (5 posted)
Patches and updates
Kernel trees
Core kernel code
Development tools
Device drivers
- dmitry pervushin: SPI.
(November 11, 2005)
Documentation
Filesystems and block I/O
Memory management
Architecture-specific
Security-related
Miscellaneous
Page editor: Jonathan Corbet
Distributions
News and Editorials
With all the current attempts to make Linux as user-friendly and easy-to-use
as possible, some might wonder why there has been so little effort to do
the same with one of the BSDs. After all, FreeBSD has proven itself to be a
fast, reliable and extremely stable workhorse, powering many of the world's
most popular web servers and search engines. Although support for more
exotic hardware in the BSD kernel usually lags behind that in Linux, many
commonly used devices work well with any recent FreeBSD release. This, in
addition to the availability of thousands of open source software packages
(the recently released FreeBSD 6.0 includes over 12,000 ports), should make
FreeBSD an ideal operating system for general computing, development work
and perhaps even common office tasks.
Unfortunately, FreeBSD is not an easy operating system to set up as a
desktop or workstation. It is perhaps even harder than setting up Slackware
in the Linux world, as FreeBSD too requires a fair amount of dirty work and
expert knowledge to mold it into a usable shape. With the curses-based
sysconfig being just about the most user-friendly utility there is
in FreeBSD, and where everything, even font anti-aliasing and sound module
loading, requires extensive hacking in obscure configuration files, there
is little wonder that FreeBSD, or indeed any other *BSD, has not taken over
the desktops of ordinary users.
But this is about to change. Some six months ago a project called PC-BSD was born with a clear vision: to
turn FreeBSD into a user-friendly and intuitive operating system that
anybody can install and use without having to first obtain a computer
science degree. Naturally, with so many new distributions launching all the
time these days, it is easy to be skeptical about any new project with such
lofty claims. Luckily, the response to the initial announcement was nothing
short of overwhelming and the developers soon found themselves besieged by
hundreds of enthusiastic users as well as experienced developers,
translators and documentation writers who quickly set up channels for
contributing to the project. Then, last week, they released a
feature-complete release candidate which will shortly become the project's
first official product - PC-BSD 1.0.
What exactly constitutes the "user-friendliness" of PC-BSD? Firstly, there
is the installer. Based on the original FreeBSD live CD by FreeSBIE, the installation CD starts
with auto-detecting and auto-configuring the system's video card before
presenting the user with an installation interface somewhat resembling Red
Hat's Anaconda. After selecting the keyboard layout, hard disk partition
and a place to install the boot loader (with sensible defaults), the
installer copies all applications from the CD to the hard disk. When done,
the user is asked to set the root password and create a user account.
That's it. Barring some unforeseen circumstances, a reboot will bring up
KDE 3.4.3 with a scenic desktop wallpaper. FreeBSD has never looked so
good!
Admittedly, the installation CD contains a rather minimal graphical system
that is unlikely to satisfy most users. A quick solution to the problem is
to visit pbiDIR, the official
repository for .pbi packages or, in other words, a categorized collection
of binary applications designed to work with PC-BSD. While not quite
"click-n-run", the installation of .pbi files is fairly straightforward:
after saving a .pbi package on the hard disk, a double-click will launch a
package installation dialog (root password is required). This will guide
the user through the process of installing the package and to make a couple
of simple decisions, such as whether or not to place the application's
icons in the KDE menu and/or on the desktop. All installed programs can be
removed later from a graphical utility called "PC-BSD Package Manager".
Although the number of .pbi software packages in the repository is fairly
limited, the developers do provide instructions for creating these
packages, so anybody can build and submit their preferred applications.
Since PC-BSD is essentially a dressed-up FreeBSD, the options of compiling
applications from ports or installing binary ones with pkg_add are
also available. In fact, the developers have created a graphical interface
for downloading and installing the entire FreeBSD ports tree, although
those who will want to take advantage of it will still need to reach for
the command line. Likewise, downloading the FreeBSD kernel and userland
sources is also just a mouse click away. Complementing the PC-BSD "System"
utility is an option to switch to an SMP kernel, to enable or disable SSH,
NFS, Samba and CUPS services, and to generate a diagnostic sheet - all from
the comfort of a graphical user interface. Several Qt-based graphical tools
for setting up monitor, network, users, printing, etc. are also available,
while a custom "Online Update" utility will upgrade the installed system to
a new version without the need to re-install.
I spent a couple of days examining the RC1 of PC-BSD 1.0 on a spare Pentium
4 computer with a Matrox graphics card, Sound Blaster Live! sound card and
a Realtek 8139too network card. All of the hardware was detected and set up
correctly during installation (except for the screen resolution which
needed a quick adjustment). I also installed and removed a number of .pbi
packages and even compiled a few ports from source - all without the
slightest hitch. The system felt fast and responsive and the boot and
shutdown times were noticeably shorter than those of most Linux
distributions. The project has a well-designed web site with good basic
installation documentation and highly active user forums frequented by many
obvious beginners to BSD. Perhaps the only real drawback of PC-BSD, from
the point of view of a novice user, is the relatively low number of
easily-installable .pbi packages, but this can only improve with time.
PC-BSD is currently the best attempt at developing a desktop FreeBSD
operating system with "a human face", and certainly the easiest way to get
a FreeBSD desktop up and running without any toiling on the command line.
Despite the project's young age, it has already achieved most of the early
goals of producing a usable desktop FreeBSD for non-technical users where
system installation and essential configuration can be effected with a
mouse. More unexpectedly, there seems to be plenty of momentum and
excitement about the project. It will be interesting to see whether PC-BSD
will be able to popularize FreeBSD as an operating system that can be used
by ordinary people, not just seasoned UNIX hackers.
Comments (10 posted)
New Releases
Xandros has released a German version of its desktop operating system at
the Frankfurt LinuxWorld Conference and Expo. "
New features in the
German package include NoMachine thin client support and OpenOffice.org 2.0
for creating standards-based documents and spreadsheets."
Full Story (comments: none)
Distribution News
Debian Project Leader Branden Robinson looks at delegation of
responsibilities. "
The Constitution of the Debian Project specifies
a decision making process known as "delegation", which the Debian Project
Leader can use to spread decision-making authority throughout the Project.
Historically, this power has been underused (including by myself),
particularly in areas of infrastructural administration. This turns out
not to be due to past (or present) Project Leaders' lack of
motivation or desire to do so."
Full Story (comments: none)
The Debian installer is getting an update for the etch release. The first
beta is out, with lots of improvements. Click below for a list of new
features.
Full Story (comments: none)
Another round of package renamings of some libraries written in C++ is
needed. Click below to find out more.
Full Story (comments: none)
Enrico Zini has announced (click below) a a new kind of package search.
"
It's an experimental new way of searching Debian packages: you start
with a normal text search, and then you work with categories."
Full Story (comments: none)
This
announcement covers changes in
Dapper's menu system.
Dapper has a new 2.6.15-2.2 (2.6.15-rc1 based) kernel available for AMD64 and x86. The PowerPC kernel was not
available at the time of the writing, but it should be available soon.
Comments (none posted)
John W. Linville has announced the availability of a new Fedora-based
kernel repository. The kernels available there are based upon the standard
Fedora kernels, with the addition of current upstream networking patches
which are more recent than the Fedora kernel's upstream base. Click below
for the announcement or find out more
here.
Full Story (comments: none)
The LCA Debian miniconf is set for January 23-24, 2006 in Dunedin, New
Zealand. As usual, the Debian miniconf precedes the annual Geek migration
to the warmer climes of the southern hemisphere known as linux.conf.au.
Full Story (comments: none)
Mandriva Linux is planning on an international install party on Saturday,
November 19, 2005. "
Following the release of Mandriva Linux 2006,
Mandriva is mobilizing its network of Linux User Groups (LUGs). Free
community installation sessions will take place around the world. Major
participating locations include the United States, Brazil, Canada, China,
Moroco, and the island of Reunion. More than 60 cities are involved,
including a dozen in China and 15 and Brazil."
Full Story (comments: 2)
New Distributions
Bent Linux is a compact Linux
distribution, inspired by Linux From Scratch. It uses Busybox, uClibc, and
static linking to keep the size down. "
It's particularly suited to
building dedicated servers, initrds for custom installers and rescue disks,
and systems with a nice crisp mid-1980s mouthfeel to satisfy the mid-life
crises of crusty curmudgeons." (Thanks to Wladimir Mutel, who is
running Bent on an AM386 test box with 8 MB of RAM.)
Comments (none posted)
G-ZyX is a Fedora based distribution
with a collection of open source software that runs from a single CD/DVD.
Optional configurationless installation (smart caching) to available hard
disk or flash based storage is supported. G-ZyX is the flagship
manifestation of the ViROS distribution generation platform. ViROS
leverages popular open and free RPM based *nix distributions to generate
custom purpose live-CDs. G-ZyX's predecessor cousin TVOS is suited for
home theater applications, while G-ZyX is suited for general purpose
computing and development. An alpha release of G-ZyX is currently
available.
Comments (none posted)
Distribution Newsletters
The November 15 Debian Weekly News is out. This week's topics include the
big-endian ARM port, the first beta of the Etch installer, the debate over
Debconf licensing, and more.
Full Story (comments: none)
The
Fedora
Weekly News, issue #22, looks at the Linux Worm Lupii, the new Fedora
Logo, a logo lesson, Fedora International community websites, FOSS India
2005 Fedora slides, and several other topics.
Comments (none posted)
The
Gentoo
Weekly Newsletter for the week of November 14, 2005 is out. This
week's edition notes the switch to stage3 as the default installation
method, an interview with Douglas Robertson about his video jukeboxes on
Gentoo, Gentoo at the LWE and DevCon in the Frankfurt/Main area, and more.
Comments (none posted)
The
DistroWatch
Weekly for November 14, 2005 is out. "
The controversy over
Nexenta's use of GPL software in its OpenSolaris-based distribution and the
never-ending GNOME vs KDE flame wars dominated the headlines last week. We
will briefly look at the above stories before examining other interesting
events and releases of the week. We also feature an exclusive interview
with Barry Kauler, the founder and lead developer of the increasingly
popular Puppy Linux. And to prove that a new distribution is born just
about every day, we have added seven new ones to the waiting list last week
- including a controversial one called "Open Windows", developed by -- wait
for this -- a law firm!"
Comments (none posted)
Package updates
Fedora Core 4 updates:
kernel-2.6.14-1.1637_FC4 (rebases to 2.6.14.1
and includes several patches),
net-tools
(bug fixes),
mc (bug fixes, update to the
4.6.1a branch),
kdenetwork (rebuild against
new wireless-tools),
kdebindings
(3.4.2-0.fc4.2),
chkconfig-1.3.22-0.4 (bug
fixes),
gaim (bug fixes),
chkconfig-1.3.23-0.4 (more bug fixes),
xterm (upgrade to upstream version 205),
pkgconfig (update to 0.20.0),
ghostscript (fix lips4v driver),
shadow-utils (fix useradd segfaults),
mc (new slang support).
Fedora Core 3 updates: gaim (bug
fixes), mc (new slang support).
Comments (none posted)
Updates for 2006.0:
scim-qtimm (fix for
2006/x86_64),
e2fsprogs (fix segfault in
mklost+found),
ldetect-lst (bug fix),
drakxtools (multiple bug fixes),
autofs (bug fix),
acpid (bug fixes).
Comments (none posted)
Newsletters and articles of interest
HowtoForge has a
tutorial
on setting up Xen on a Debian Sarge box. "
This tutorial provides
step-by-step instructions on how to install Xen (version 2) on a Debian
Sarge (3.1) system. It should apply to Ubuntu systems with little or no
modifications. Xen lets you create guest operating systems (*nix operating
systems like Linux and FreeBSD), so called "virtual machines" or domUs,
under a host operating system (dom0). Using Xen you can separate your
applications into different virtual machines that are totally independent
from each other (e.g. a virtual machine for a mail server, a virtual
machine for a high-traffic web site, another virtual machine that serves
your customers' web sites, a virtual machine for DNS, etc.), but still use
the same hardware."
Comments (none posted)
Page editor: Rebecca Sobol
Development
November is shaping up to be a month of important Linux Telephony releases.
Two weeks ago, we examined the
GNU Bayonne 2
Telephony Application Server. This week, we look at
Asterisk, an
open-source PBX
(Private Branch eXchange).
The Asterisk
description states:
Asterisk is a complete PBX in software. It runs on Linux, BSD and MacOSX and provides all of the features you would expect from a PBX and more. Asterisk does voice over IP in many protocols, and can interoperate with almost all standards-based telephony equipment using relatively inexpensive hardware.
Version 1.2 of Asterisk
was released
at the IP.4.IT Conference this week:
"Asterisk
1.2 is the first major revision to Asterisk since the release of Asterisk
1.0 in September 2004, and includes over 3,000 feature additions and
improvements to the overall performance and efficiency of memory usage."
The original author of Asterisk is Mark Spencer, president of
Digium, Inc.
Digium is a supplier of PC telephony cards and telephony systems,
and is sponsoring Asterisk development. The company also sells
Asterisk Business Edition, a commercial version of the software.
The software is being developed by a wide variety of programmers,
using the standard open-source development model.
Asterisk has been licensed under version 2 of the GNU General Public License (GPL).
Asterisk's
feature set
and list of supported protocols is lengthy.
A few highlights include:
- Architected as a central PBX core with loadable module APIs.
- Works as a traditional PBX on standard telephone lines.
- Supports Voice over IP (VoIP).
- No special hardware is required for VoIP use.
- Supports switching between all of the supported interfaces.
- Supports connection to other Asterisk PBX instances for scalability.
- Supports both U.S. and European standard signaling protocols.
- Runs on Linux, OpenBSD, FreeBSD, and Mac OS X.
- Works with a wide variety of telephony hardware.
- Has free and commercial customer support options.
Asterisk looks like a fun and active open-source project,
those with needs for both simple and complex PBX systems
would be advised to give it a try.
The code is available for download
here.
Comments (4 posted)
System Applications
Database Software
The November 13, 2005 edition of the PostgreSQL Weekly News
is out with the latest PostgreSQL articles.
Full Story (comments: 1)
Interoperability
Version 3.0.21rc1 of Samba has been announced.
"
This is a release candidate of the 3.0.21 code base and is
provided for testing purposes only. While close to the final
stable release, this snapshot is *not* intended for production
servers."
Full Story (comments: none)
Networking Tools
Version 3.0.0 of Shorewall, an iptables based firewall with flexible
configuration, is out with several new features.
Full Story (comments: none)
Printing
A new
CUPS
printing system tutorial is available:
"
If you want certain users to have access to administer printers and nothing else, you need to create a group."
Comments (none posted)
Miscellaneous
Version 0.9 of Bootchart, is a tool for performance analysis and visualization of the GNU/Linux boot process,
is available.
"
Version 0.9 introduces application monitoring, alternative init invocation (e.g. initng) and offers better FHS compliance."
Comments (none posted)
Desktop Applications
Audio Applications
Version 0.1.1 of LDAS, the Low Delay Audio Streamer,
is out with code improvements. Here's the change notice:
"
More correct use of the memory mapped access to the sound card when
copying data from the queue to the sound card. The code should now
be more generic, and work for more sound cards."
Full Story (comments: none)
Business Applications
Version 0.30.1 of WyattERP, an enterprise resource and management
application,
has been released.
"
WyattERP is a set of tools to create customized, integrated ERP modules for small businesses. It has been developed and tested with the assistance of Action Target, Inc.
This new release features Wylib and Wyseman as separate entities. Wylib enables the creation of tcl/tk ERP modules that closely tie into the database model created and managed by Wyseman."
Comments (none posted)
Desktop Environments
GNOME 2.13.2 has been announced.
"
This is our second development release on our road towards GNOME
2.14.0, which will be released in March 2006."
Full Story (comments: 1)
Emmanuele Bassi has announced the first GNOME Dictionary
status report.
"
In order to let others know how's the status of GNOME Dictionary
Breaking is progressing (and in order to force myself hacking on it
regularly ;-)), I'm sending the
Not So Weekly Status Report on GNOME Dictionary
Containing the status of the review-slash-breaking-slash-rewrite process
of the GNOME Dictionary application and applet."
Full Story (comments: none)
If you like animated controls on your desktop, take a look at
the
Clearlooks gtk-engine patch.
"
tirpse (aka SchAmane) made an Clearlooks gtk-engine patch to get animated progressbar and checkboxes using cairo. Just download latest clearlooks gtk-engine CVS, patch and compile."
Comments (none posted)
The following new GNOME software has been announced this week:
- audio-convert 0.3.1 (new features, bug fixes, and translation work)
- Buoh 0.8 (initial release)
- control-center 2.13.2 (bug fixes and translation work)
- Evolution 2.5.2 and EDS 1.5.2 (new features, bug fixes, and translation work)
- Eye of GNOME 2.13.2 (UI redesign and bug fixes)
- gcalctool v5.7.11 (bug fixes and translation work)
- GDM2 2.8.0.6 (bug fixes)
- GDM2 2.13.0.1 (new features, bug fixes and translation work)
- GLib 2.8.4 (bug fixes, documentation and translation work)
- gnome-games 2.13.2 (bug fixes)
- gnome-speech 0.3.9
(bug fixes)
- Gnome-utils 2.13.2 (new features, bug fixes, and translation work)
- GTK+ 2.8.7 (new features, bug fixes and documentation work)
- Gtk2-Perl 2.13.2 (new features and bug fixes)
- gtksourceview 1.5.1 (new features and bug fixes)
- java-access-bridge 1.4.6 (new features)
- Metacity 2.13.1 (new features, bug fixes and translation work)
- Zenity 2.13.2 (new features and translation work)
You can find more new GNOME software releases at
gnomefiles.org.
Comments (none posted)
KDE 3.5 is about to be finished, and the first release candidate is now
available for testing. "
Because of the short timeframe for the
release candidates we don't give the distributors a head start of one week
for binary packages..."
Full Story (comments: none)
KDE.News
notes the launch of the
Oxygen web site. Oxygen is the look and feel of the upcoming (someday) KDE4 desktop, so the site gives some hints of what KDE users can expect to be working with in the future.
Comments (11 posted)
KDE.News
covers
a collaboration between OpenSync and KDE.
"
The OpenSync and KDE teams have joined forces to create a unified library to synchronize data from mobile devices with the data on the desktop. OpenSync, the successor to the MultiSync project, provides a modular desktop-independent synchronization platform. It can be extended by plugins to support additional devices and data types. Plugins for the most commonly used devices and applications such as Kontact, Palm, Windows CE, mobile phones and more are already available or under development. KDE has now adopted OpenSync as the base for its future synchronization tools."
Comments (1 posted)
The following new KDE software has been announced this week:
You can find more new KDE software releases at
kde-apps.org.
Comments (none posted)
Release Candidate 2 of the X11R6.9/X11R7 window system is out.
"
This RC includes many bug fixes and updates since the first RC.
We have tagged both the monolithic and modular trees and have prepared
tarballs for you to test."
Full Story (comments: 2)
Version 4.2.3.1 of the
Xfce lightweight desktop environment
is out.
"
A new bug fix release of Xfce is finally available, after almost 6 months!" See the
change log file for details.
Comments (none posted)
Electronics
The
LEDLoad project
has been launched.
"
LEDLoad is a CPU load display using a single dual color LED. It is
designed to use a free internal USB port of any modern PC and replace
the power LED in the case with something more interesting. A host driver
kernel module is available for Linux."
Comments (none posted)
Version 3.4.9 of
XCircuit,
an electronic schematic drawing package, is available.
This release features a number of bug fixes.
Comments (none posted)
Graphics
Version 1.00 of ShadeVis
has been announced.
"
The ShadeVis tool computes a simple static, but much more correct, per-vertex ambient term. This effect, commonly known as ambient occlusion, is aimed to provide more faithful shading for realtime rendering.
In practice rather than considering the ambient lighting to exist uniformally throughout a scene, this approach determines the ambient brightness of each part of a surface to be proportional to the extent to which the surface has "its outward view of its environment" free i.e. ''occluded'', by other surfaces of the object. Inner part will therefore appear darker."
Comments (none posted)
GUI Packages
Version 3.15.1 of PyQt,
a comprehensive set of Python bindings for the Qt GUI toolkit,
has been announced, it features minor bug fixes.
Comments (none posted)
Interoperability
Version 0.9.1 of Wine ("a free implementation of Windows on Unix")
is out.
Here are the changes:
"
Support for Find function in regedit,
Winelib app to eject a CD, Many MSI improvements,
Better support for running text-mode apps without X,
Improved support for various code obfuscation tools, and
Lots of bug fixes."
Comments (none posted)
Mail Clients
Version 0.96.6 of bogofilter, a Bayesian email filter,
is out with bug fixes.
Full Story (comments: none)
Medical Applications
Version 1.0 RC2 of
ClearHealth,
an open-source medical suite,
has been announced.
"
After a long testing and packaging cycle RC2 is finally available. This release includes numerous fixes, enhancements and entirely new features. Some of these highlights include comprehensive billing support (CA Medicare and CA Medicaid tested/certified), graphical installer and performance improvements."
Comments (none posted)
Version 2.8.0 of the OpenEMR electronic medical record system
has been announced, it includes a long list of new features.
"
Today OpenEMR version 2.8.0 is released for download at the project's SourceForge site. Concurrently, a companion FreeB release 0.11 is available."
Comments (none posted)
LinuxMedNews
looks at an Open Healthcare Framework extension to the
Eclipse development framework.
"
eclipse.org states: 'The goal of the Open Healthcare Framework (OHF) is to extend the Eclipse Platform to create an open-source framework for building interoperable, extensible healthcare systems.'"
Comments (none posted)
Office Applications
Version 4.2.3 of Hylafax, a fax modem application,
has been announced.
Changes include a security update, bug fixes, and new capabilities.
Comments (none posted)
Office Suites
Peter Korn, an accessibility architect at Sun, has posted
a detailed look at accessibility issues involving OpenOffice and the OpenDocument format. "
The accessibility issues affecting people with disabilities in the applications that read and write Open Document Format are real. While some users with some disabilities should have no difficulty with ODF (and in fact in some specific cases an improved experience), for others a move to Open Document capable applications today would have significant impacts on their productivity and efficiency. However, the first significant Open Document deployment affecting people with disabilities - in the State of Massachusetts - is still nearly 14 months away."
Comments (none posted)
Science
The 1.0 release of the StrBio Java classes
have been announced, the code has just been released under the
LGPL license.
"
The StrBio library is a set of Java classes useful for development of software for computational structural biology research. These classes are the basis for software in several published research projects, including the Pred2ary secondary structure prediction software, the JThread fold prediction algorithm, and parts of the ASTRAL Compendium for Sequence and Structure Analysis (http://astral.berkeley.edu)."
Comments (none posted)
Video Applications
Version 0.20 of CinePaint
has been released.
"
CinePaint version 0.20 is a major release of the popular motion picture deep colour paint and retouching program. Thanks to Kai-Uwe Behrmann for creating this release.
This release is the latest Film Gimp (GTK) version of CinePaint. CinePaint developers continue to maintain this legacy architecture until the future Glasgow architecture is complete (in 2006)."
Comments (none posted)
Version 1.5 beta 2 of
DVDStyler, a cross-platform DVD (movie) authoring system, is
available. Changes include bug fixes, translation work, and more.
Comments (none posted)
Web Browsers
MozillaZine
has announced the second release candidate of Mozilla Firefox 1.5.
"
Like the first release candidate, Mozilla Firefox 1.5 Release Candidate 2 is intended to allow testers to ensure that there are no last-minute problems with the Firefox 1.5 code."
Comments (none posted)
Languages and Tools
Caml
The November 8-15, 2005 edition of the Caml Weekly News
is out with the latest Caml language articles.
Full Story (comments: none)
Java
Version 2.0 of Jericho HTML Parser, a Java library which supports
the manipulation of HTML documents,
has been announced.
"
Version 2.0 is a complete rewrite of previous versions, including the core parser and caching mechanism.
The major new feature in 2.0, in addition to the HTML form manipulation features added in 1.5-dev, is the ability to easily define new tag types for recognition by the parser. Performance is also greatly improved and the documentation has been expanded significantly."
Comments (none posted)
Lisp
Version 0.9h of Embeddable Common-Lisp has been announced.
"
This version reduces memory usage, improves the FFI, includes new
build scripts, now runs also on OpenBSD, and fixes a few bugs."
Full Story (comments: none)
PHP
Version 0.6.0.0 of XOAD
is out with several new features.
"
XOAD is a PHP based AJAX/XAP object oriented framework that allows you to create richer web applications. Formerly known as NAJAX, XOAD has many benefits: it uses JSON, supports server / client side events, HTML manipulation, Caching and many more."
Comments (none posted)
PostScript
Release 8.53 of
AFPL Ghostscript
has been released.
"
Artifex Software, Inc. and artofcode LLC are pleased to announce the release of AFPL Ghostscript 8.53. This is a maintenance release in the stable 8.5x series."
Changes include bug fixes, performance improvements, and more.
Comments (none posted)
Prolog
Version 1.3.4 of
JLog, a Prolog interpreter written in Java, is available.
"
Version 1.3.4 includes a substantial number of improvements and refinements, introduced throughout the development cycle of the 1.3.0-1.3.3 Developer Preview versions."
Comments (none posted)
Python
The November 16, 2005 edition of Dr. Dobb's Python-URL!
is online with a new collection of Python article links.
Full Story (comments: none)
The 0.1 release of
PySizer has been announced.
"
I'd like to announce the first release of PySizer, a memory usage
profiler for Python code.
PySizer was written as part of Google's Summer of Code."
Comments (none posted)
Ruby
The November 13th, 2005 edition of the
Ruby Weekly News looks at the latest discussions
from the ruby-talk mailing list.
Comments (none posted)
Koen Vervloesem
introduces REXML in an O'Reilly article.
"
REXML (Ruby Electric XML) is the XML processor of choice for Ruby programmers. It comes bundled with the standard Ruby distribution. It's fast, written in Ruby, and can be used in two ways: tree parsing and stream parsing. In this article, we show some basic constructs on how to use REXML for XML processing. We also introduce the use of Ruby's interactive debugger irb for exploring XML documents with the help of REXML."
Comments (none posted)
Tcl/Tk
The November 15, 2005 edition of Dr. Dobb's Tcl-URL!
is available. Take a look for new Tcl/Tk articles and
resources.
Full Story (comments: none)
Miscellaneous
Version 4.21 of aegis, a transaction-based, software
configuration management system, is out with lots of
new features and bug fixes.
Full Story (comments: none)
Page editor: Forrest Cook
Linux in the news
Recommended Reading
Linux.com
looks at package
management tools such as Portage and Conary. "
Traditional Linux
package management systems such as RPM, Debian's dpkg, and Slackware's
pkgtool present several problems for users. Users who want optimized
packages often have problems finding them, different package repositories
have conflicting naming conventions, and binary packages are often not
available for packages in a timely fashion. However, for users willing to
stray from the beaten path, there are alternatives. Two projects have taken
up the challenge of making a package management system that overcomes these
shortcomings."
Comments (50 posted)
The Linux Journal is running
a lengthy piece by Doc Searls on threats to open networking. "
The carriers are going to lobby for the laws and regulations they need, and they're going to do the deals they need to do. The new system will be theirs, not ours. The NEA principle--Nobody owns it, Everybody can use it, Anybody can improve it--so familiar to the Free Software and Open Source communities will prove to be a temporary ideal, a geek conceit. Code is not Law. Culture is not Free. From the Big Boys' perspective, code and culture are stuff nobody cares about.
That's us: Nobody."
Comments (14 posted)
Wired
reports on some research done by Dan Kaminsky. He queried DNS servers worldwide to see if they had the addresses of Sony's "mother ship" systems cached. "
The results have surprised Kaminsky himself: 568,200 DNS servers knew about the Sony addresses. With no other reason for people to visit them, that points to one or more computers behind those DNS servers that are Sony-compromised. That's one in six DNS servers, across a statistical sampling of one third of the 9 million DNS servers Kaminsky estimates are on the net."
Comments (11 posted)
Trade Shows and Conferences
Doc Searls
has another
report from last month's Geek Cruise. "
This is what I learned
from Andrew [Morton] and Ted [Ts'o]. After sitting in on their sessions
(which ran many hours--the cruise was something of a crash course at sea),
I realized that Linux's nature, as a building material, is akin to that of
a species."
Comments (none posted)
NewsForge has
this
report from Seneca College's fourth annual Open Source Symposium.
"
A fourth speaker, Stephen Downes, a senior researcher with the
National Research Council of Canada, laid out a challenge to not only open
software, but open content. He spoke of the different business models and
different approaches of commercial/proprietary vs. open source. Part of the
distinction is the different distribution models for not only the software,
but the content, he said. The current World Wide Web is somewhere between
closed and open, what he called "never never land, neither here nor
there.""
Comments (none posted)
Andy Oram
reports
on the recent Symposium on Intellectual Property, Creativity, and the
Innovation Process. "
The glow of this conference lingers on in the
shape of a new center that has just been announced by the law school at the
University of North Carolina at Chapel Hill, a conference
sponsor. Conference organizer David Harrison says of the center that
"Leading researchers and practitioners in all areas that depend upon
innovation and creativity will work together to achieve real change through
practical applications. The center is intended to provide applied solutions
to preserving and promoting the creative incentives necessary for social,
cultural, and economic growth." My hope is it will lead to more conferences
of this nature and ultimately, new policy."
Comments (none posted)
Companies
DesktopLinux.com
covers
the resignation of Hubert Mantel from Novell Inc.
"
In the latest bit of personnel-related news from beleaguered Linux software/services provider Novell Inc., Nuremburg, Germany-based SUSE Linux founder Hubert Mantel announced his resignation Tuesday via email to friends and business associates on one of the SUSE mailing lists.
Mantel, chief maintainer of the SUSE Linux kernel, simply said in the brief letter that he could no longer work for the company any longer."
Comments (6 posted)
IT Manager's Journal
looks at the successful business model used by Sleepycat software,
the company that produces the Berkeley DB database.
"
What originally piqued my interest in Sleepycat was the question of why a company that claimed to be as successful as Sleepycat was still private and, to the best of my knowledge, did not have a single venture capitalist on its board of directors, nor is it beholden to one or more venture capital (VC) groups.
To find out the answers, I got in touch with Rex Wang, vice president of marketing for Sleepycat. Wang confirmed that Sleepycat is an extremely profitable concern. Sleepycat employs about 30 people, and is looking to add to that workforce as it expands the company. Moreover, Sleepycat has not just refrained from using venture capital, the company does not even borrow money to finance its development. The company funds itself entirely from the profits it receives from its license fees."
Comments (11 posted)
Linux Adoption
ZDNet
reports on the creation of another Linux-based phone standards effort. "
The Linux Phone Standard (Lips) Forum wants to standardize Linux interfaces so that higher-level software won't have to be customized for each variation of the open-source operating system appearing in different cell phone models. If successful, the allies believe they'll make Linux a better competitor the fast-growing market."
Comments (5 posted)
KDE.News
presents
a translated article from Automatiseringsgids magazine about the
use of KDE and Linux at a Dutch record store chain.
"
At first glance, a shop is not a place where you would expect to find KDE in the workplace. Yet the Dutch Free Record Shop is deploying it on a large scale as the operating system for their point of sale systems. According to the supplier Novell, it is one of the application areas where simple and restricted functionality is required, leading to a breakthrough for GNU/Linux on the PC."
Comments (none posted)
Linux at Work
NewsForge
looks
at Linux in supercomputing. "
The last few Top500 Supercomputer
Site lists left little doubt that Linux is the operating system of choice
for these bleeding edge systems, but the latest list highlights the
popularity of Linux in supercomputing and cites it as the OS of choice for
78% of the world's fastest machines. 391 of the systems rely on Linux of
one flavor or another -- far more than Unix (yesterday's supercomputing
king), Mac OS X, Solaris, or any others. Microsoft Windows didn't even turn
up on the list."
Comments (3 posted)
Resources
O'ReillyNet
looks
at security concerns and scripting pitfalls in Greasemonkey.
"
Once upon a time, there was a security hole. (This is not your
standard fairy tale. Stay with me.) Greasemonkey's architecture has changed
substantially since it was first written. Version 0.3, the first version to
gain wide popularity, had a fundamental security flaw: it trusted the
remote page too much when it injected and executed user scripts."
Comments (none posted)
Linux.com
introduces
netcat. "
In the simplest terms, netcat is a utility that reads
and writes data across the network. As you probably know already, you can
write to a file or read from a file on your local machine using the cat
utility. By running cat filename > filename2 , you can write the contents
of a file to another file. By using cat > filename , you can write directly
to a file from standard input."
Comments (3 posted)
O'ReillyNet
uses
Perl to write server-side extensions to PostgreSQL. "
In fact,
PostgreSQL lets you create server-side routines in quite a few languages,
including one called PL/PGSQL that is all its own, and is somewhat similar
to Oracle's PL/SQL. The PostgreSQL core distribution supports and maintains
three other procedural language interfaces to third-party interpreters:
Perl, Python, and Tcl (the first procedural language that PostgreSQL
supported). There are also other languages maintained outside of the core
distribution for various reasons, including PL/Java (or an alternative
flavor, PL/J), Pl/R, PL/Ruby, PL/PHP, and a vastly better PL/Python. If
you, like me, are at home in Perl, you will probably want to write your
server-side functions in Perl, too."
Comments (none posted)
Dave Phillips
covers
music notation software for Linux, on Linux Journal. "
CMN is a
powerful music notation specification language. Although it lacks a
mouse-driven graphical interface, the language elements will be immediately
familiar to users who know the naming conventions for common, and some not
so common, music notation symbols. CMN is capable of handling almost any
scoring requirement, including many 20th century additions to the standard
notation symbol palette."
Comments (none posted)
Reviews
Linux.com has
takes a
look at grsecurity. "
If the prospect of configuring 30+ options
seems daunting, relax. You can choose from predefined low, medium, and high
settings. In fact, it's a good idea to start with the low setting and see
how things go. After rebooting into the grsecurity-enhanced kernel, check
that all of your services are still running. If everything goes okay, try
bumping the security level up to medium and then up to high. There is also
a custom setting that allows you to mix and match options."
Comments (none posted)
O'Reilly's digital media site has
a
review of the Korg OASYS, a high-end digital synthesizer. "
In
fact, Linux's greatest success on the OASYS project may be that it's almost
entirely invisible, letting Korg's designers focus on their proprietary
sound engine. That was a big part of the appeal to Korg. 'You can change
things easily in Linux,' says Phillips. 'There's more granularity when you
compile the kernel.'"
Comments (none posted)
Joe 'Zonker' Brockmeier
reviews PunBB on NewsForge.
"
For some time now, I've been looking for a good, open source bulletin board package to run a discussion board on my Web site. After a lot of searching, I've settled on PunBB because it offers the features that I want, and is available under the GNU General Public License (GPL).
PunBB is extremely easy to set up and configure. The requirements are minimal, and the entire procedure should take only a few minutes for users who are moderately familiar with Linux."
Comments (3 posted)
NewsForge
looks
at managing projects with Trac. "
Trac integrates a capable wiki
engine with a number of project management features. In particular, Trac
provides a Web-based interface to a Subversion source code repository, a
job/bug ticketing system, and basic scheduling features. Each of these is
integrated with the wiki engine. Trac can be readily adapted to nearly any
project management style."
Comments (none posted)
Miscellaneous
ZDNet
covers the launch of the Open Inventions Network. "
Patents owned by OIN will be available without payment of royalties to any company, institution or individual that agrees not to assert its patents against others who have signed a license with OIN, when using certain Linux-related software." This company has been formed by IBM, Sony, Royal Philips Electronics, Red Hat, and Novell.
Comments (2 posted)
Page editor: Forrest Cook
Announcements
Non-Commercial announcements
The Public Patent Foundation has
announced that it has filed a formal challenge to the image compression patent currently being used by Forgent in its shakedown attempts. The full request for reexamination is available
in PDF format.
Comments (5 posted)
One might think that Sony's rootkit-installing CD was bad enough as it was. But the EFF
read the accompanying license agreement and found that it gets worse. "
Sony-BMG can install and use backdoors in the copy protection software or media player to 'enforce their rights' against you, at any time, without notice. And Sony-BMG disclaims any liability if this 'self help' crashes your computer, exposes you to security risks, or any other harm."
Comments (10 posted)
Commercial announcements
IBM has released version 1.0 of the
Cell Broadband Engine Software Development Kit
"
The Cell Broadband Engine (CBE) is a breakthrough microprocessor with unique capabilities for applications requiring video, 3D graphics, or high-performance computation for imaging, security, visualization, healthcare, surveillance and more. Based on the Power ArchitectureTM, a choreographed high-bandwidth memory architecture, and multicore technology, the Cell BE has been shown to accelerate some algorithms to many times the speed of a traditional microprocessor.
Cell Broadband Engine (CBE) Software Development Kit Version 1.0 provides everything Cell software developers need to create, build, simulate, and test Cell applications. The SDK enables a cross development environment which is hosted on fedora 4/x86 platforms."
Comments (17 posted)
IBM and Net Integration Technologies have announced a partnership.
"
Net Integration's Nitix for application servers has obtained "Ready for IBM
DB2 Software for Linux" designation. With IBM DB2 universal database on Net
Integrations Nitix technology, SME's can benefit from affordable autonomic
features such as Linux reliability, affordability, intelligent and quick
installation, and automatic back up of application program files and data."
Full Story (comments: none)
Mercury Computer Systems, Inc. has announced its collaboration with Terra
Soft Solutions to deliver a complete Linux distribution for the Mercury
Dual Cell-Based Blade. The Dual Cell-Based Blade is Mercury's first
product based on the IBM(R) Cell BE (Broadband Engine) processor.
Full Story (comments: none)
It seems we were due for
yet another Microsoft-funded study showing what an expensive pain Linux is. "
To compare reliability and manageability differences between Microsoft
Windows- and Linux-based solutions, SI delved into the true extent that
maintenance, patch application and system failures contribute to IT pain and
cost as business requirements evolve over time. Simulating a real-world
enterprise e-commerce environment over the course of a year, SI compared two
teams of experienced IT administrators as they maintained and enhanced on
Windows Server 2000 and Novell SUSE Enterprise Linux 8, then upgraded to
Windows Server 2003 and Novell SUSE Enterprise Linux 9, respectively." Reading the results, one might wonder how people manage to operate Linux systems at all.
Comments (18 posted)
OpenMFG, LLC has
announced an expansion of its OpenMFG Partner Program.
"
The new program will significantly expand the opportunities for
developers and systems integrators to build software solutions on the OpenMFG
platform.
OpenMFG's flagship product is an advanced Enterprise Resource Planning
(ERP) software solution built with open source components, such as the Linux operating system, the PostgreSQL database, and the OpenRPT report writer."
Comments (none posted)
PalmSource, Inc. has
announced its membership in the the Linux Phone Standards (LiPS) Forum.
"
The LiPS Forum, a
consortium of leading companies, has come together to accelerate the adoption
of Linux in fixed, mobile and converged devices by standardizing Linux-based
services and APIs that most directly influence the development, deployment and
interoperability of applications and user-level services. Alongside
PalmSource, the founding members include France Telecom/Orange, FSM Labs,
Huawei, Jaluna, MontaVista Software, MIZI Research, Open Plug, Arm, Cellon and
Esmertec."
Comments (none posted)
Pentek has announced their Software Radio Development Platform with SCA
Compliance.
"
Pentek, Inc., the industry pioneer of
VME board-level technology, today released a development platform
containing all hardware and tools required for software-defined radio
development compliant with the Software Communication Architecture (SCA)
mandated for all future U.S. military radios."
Full Story (comments: none)
Rocketcalc has announced a new line of personal clusters that use
Dual-Core AMD Opteron Processors and run SuSE Linux.
"
Rocketcalc announced today the Saturn
270 HE personal cluster with sixteen AMD Opteron(TM) processor cores.
Available with up to 64 GB total RAM and 8 Gbps total network bandwidth,
Saturn brings serious 64-bit cluster computing power to your desk in a
compact, quiet and affordable package."
Full Story (comments: none)
Safesnaps has launched an online photo archive service.
"
Unix kernel veterans recently
launched a new digital photo archive service for individuals and
commercial clients who need to know their snapshots are secure.
Safe Snaps (www.safesnaps.com) stores pictures, allows for easy
retrieval by subscribers and can backup work on demand."
Full Story (comments: none)
SGI, Linux Networx and Penguin Computing have announced new hardware at
SuperComputing 2005 (November
12 - 18, in Seattle, Washington). Here is a
press
release from SGI on the new Altix 4000 platform. eWeek
looks at new
releases from Linux Networx and Penguin Computing.
Comments (none posted)
Terra Soft Solutions has launched its Y-Bio Bioinformatics Package for Linux.
"
Built upon the RPM Linux standard
for package management, Y-Bio offers industry standards NCBI BLAST, EMBOSS,
Glimmer, ClustalW, HMMER, Wise, and FastA -- tools which help bioinformatics
researchers conduct genetic sequence analysis."
Full Story (comments: none)
Thyme Software Ltd has acquired the Linux Emporium.
"
Steve Whitehouse, who has been running the well known Linux Emporium for
the past two years has transferred the business to Thyme Software Ltd,
in a seamless move facilitated by Steve's involvement in training the
people at Thyme.
John Pinner, Managing Director of Thyme Software: At Thyme we have
great plans for expanding the repertoire of the Linux Emporium, adding
appropriate hardware and applications to its list offerings, plus a lot
of other great stuff besides, to build on its role as the one-stop
buy-on-line shop for everything Linux."
Full Story (comments: none)
New Books
IBM Press has published the book
Apache Derby--Off to the Races by Paul Zikopoulos, Dan Scott, and George Baklarz.
Full Story (comments: none)
O'Reilly has published the book
Creating Web Sites: The Missing Manual by Matthew MacDonald.
Full Story (comments: none)
Charles River Media has published the book
Digital Design From Gates to Intelligent Machines
by Bruce F. Katz.
Full Story (comments: none)
O'Reilly has published the book
PHP in a Nutshell by Paul Hudson.
Full Story (comments: none)
O'Reilly has published the book
Unix in a Nutshell, Fourth Edition by Arnold Robbins.
Full Story (comments: none)
No Starch Press has published the book
Wicked Cool Java by Brian D. Eubanks.
Full Story (comments: none)
Resources
The first edition of the Moodle Newsletter
is available as a PDF download.
Moodle is:
"
a course management system (CMS) - a free, Open Source software package designed using sound pedagogical principles, to help educators create effective online learning communities. You can download and use it on any computer you have handy (including webhosts), yet it can scale from a single-teacher site to a 40,000-student University."
Comments (none posted)
David A. Wheeler has announced an updated publication of his document
Why OSS/FS? Look at the Numbers!.
"
The big change is that a much shorter, simpler version
of the report is available as a presentation, in both
PDF and OpenDocument formats. Currently only English is
available, but the author hopes that many will
translate it into a variety of languages."
Full Story (comments: none)
Event Reports
The U.S. Department of Energy's (DOE) National Nuclear Security
Administration (NNSA) and Silicon Graphics (SGI) have
announced
that an open-source version of the SGI SpeedShop performance analysis tool
is now available to developers.
HPCwire Publisher Tom Tabor presented
four 2005 HPCwire Innovation Awards to SGI's Graphics Prism.
Penguin Computing has released
the Penguin Application-Ready Cluster Portfolio, a new line of integrated
hardware/software Linux-based cluster systems.
Platform Computing has announced
that Platform Rocks Standard Edition (SE) will be available as a cluster
management solution for the HP Cluster Platform 3000.
PathScale has announced the release of
version 1.1 of its InfiniPath software. This latest InfiniPath software
release fully supports the OpenIB Gen 2 software stack and is designed to
maximize application scaling and performance on InfiniBand-based Linux
clusters.
Comments (none posted)
The Gelato Federation has published a press release that covers
a recent Gelato Federation meeting.
"
Ninety scientists, developers, and engineers convened from all
around the globe for the October 2005 meeting of the Gelato Federation, an
international technical organization dedicated to advancing Linux on the Intel® Itanium® processor.
In attendance were delegates from more than 25 research and enterprise institutions, including
Gelato members and sponsors, HP, Intel, and SGI. The event was hosted by the Pontifical Catholic
University of Rio Grande do Sul (PUCRS) at their campus in Porto Alegre, Brazil."
Full Story (comments: none)
Upcoming Events
The conference program for Linux.Conf.Au is online.
The event takes place in Dunedin, New Zealand on
January 23-28, 2005.
Full Story (comments: none)
Early bird registrations for linux.conf.au 2006 are available
until November 18.
"
Hi folks, Just a quick reminder that early bird registrations for
linux.conf.au 2006 close in just over three days, at midnight on Friday
the 18th of November. Please be aware that this date and time is in
NZDT, which is currently equivalent to UTC +1300."
Full Story (comments: none)
LinuxMedNews has
an announcement for the fourth seminar of Medical Open Source
Software Council in Japan. The event will take place in
Kobayashi, Kyushu, Japan on November 26, 2005.
Comments (none posted)
A Call for Tutorials has gone out for PyCon 2006.
"
Enjoy teaching classes or tutorials? PyCon 2006 is looking for
proposals for a pre-conference tutorials day. PyCon 2006 will be held
February 24-26 in Addison, Texas (near Dallas). Tutorials will be held
on February 23, at the same location."
Full Story (comments: none)
The next PyPy sprint (Python-in-Python)
has been announced.
"
The next PyPy sprint is scheduled to be in December 2005 in Gothenborg,
Sweden. Its main focus is heading towards phase 2, which means JIT
work, alternate threading models and logic programming (but there are
also other possible topics). We'll give newcomer-friendly
introductions."
Comments (none posted)
| Date | Event | Location |
| November 17 - 18, 2005 | Embedded
Technology 2005(ET2005) | Yokohama, Japan |
| November 17, 2005 | LinuxWorld
Germany | Frankfurt, Germany |
| November 17 - 18, 2005 | SC|05 | (Washington State Convention and Trade
Center)Seattle, WA |
| November 18, 2005 | European Gentoo
developer meeting | Schloss Kransberg, Germany |
| November 20 - 23, 2005 | 5tas Jornadas
Regionales de Software Libre | Rosario, Santa Fe, Argentina |
| November 29 - December 2, 2005 | FOSS.IN/2005 | (Bangalore Palace)Bangalore, India |
| December 4 - 9, 2005 | Large Installation
System Administration Conf.(LISA) | San Diego, CA |
| December 5 - 7, 2005 | Open Source Developers'
Conference(OSDC) | (Monash University's Caulfield campus)Melbourne, Australia |
| December 10 - 14, 2005 | ApacheCon 2005 | (Sheraton San
Diego Hotel and Marina)San Diego, CA |
| December 27 - 30, 2005 | 22nd Chaos
Communication Congress | Berlin, Germany |
Comments (none posted)
Web sites
OSDL has
announced the creation of an online "patent commons reference library," found at
patentcommons.org. "
The Patent Commons website will catalogue existing patent commitments from
companies and individuals who wish to retain ownership of their patents, and
will provide information about different types of pledges and covenants and
how they work. In the coming months, the site will expand to include other
legal solutions that benefit the open source community, including open source
licenses, indemnification programs and information for organizations and
individuals who wish to contribute to the commons."
Comments (none posted)
Miscellaneous
For the sheer fun of it: if you were thinking of heading off to the stars,
be careful you don't infringe on
patent
#6,960,975, being for a "space vehicle propelled by the pressure of
inflationary vacuum state." "
A cooled hollow superconductive shield
is energized by an electromagnetic field resulting in the quantized
vortices of lattice ions projecting a gravitomagnetic field that forms a
spacetime curvature anomaly outside the space vehicle. The spacetime
curvature imbalance, the spacetime curvature being the same as gravity,
provides for the space vehicle's propulsion."
Comments (19 posted)
Page editor: Forrest Cook
Letters to the editor
| From: |
| Sebastien Loisel <sloisel-AT-gmail.com> |
| To: |
| letters-AT-lwn.net |
| Subject: |
| Linux boots fast? |
| Date: |
| Thu, 10 Nov 2005 22:05:34 +0100 |
>
> ...one of the fastest Linux distributions available today. Can you imagine
> a complete Linux OS booting into text console in 22 seconds and into full
> KDE in 45 seconds?
You call that fast?
45 seconds on a 2GHz cpu is 90,000,000,000 clock cycles. In each clock
cycle, you can execute one meaningful instruction. In 5,000 clock cycles,
you can completely rewrite the text screen. In a 100 clock cycle, you can
set up a DMA transfer, read or write a short message on the PCI bus, change
the video mode, etc...
You could do a million such thing and still not have used 1 billion clock
cycles, half a second. Or, you could write your kernel in python, which is
200 times slower than C, and you could still do 10,000 such things in a
second.
Where is it all going? Can you imagine waiting 25 hours for a commodore 64
to boot? Because that's how long it takes a commodore 64 to run through 90
billion cycles. And yet the commodore 64 boots in about one second, one
million cycles. So by my count, modern computers should boot in half a
millisecond.
One could argue that reading off the disk takes a long time. However, I just
now copied a 238MB file from one directory to another on the same disk
(which is a lot harder than reading 238MB, which the kernel and windowing
environment should under no circumstance ever get close to reading) and that
took less than 15 seconds. 15 seconds of I/O, plus half a second of
computing is 15.5 seconds and 1 billion cycles. What else could you need?
Before someone argues that some real work is going on, I say bullocks. I
know you don't need 45 seconds to boot a computer because my Windows laptop
can wake up in about 10 seconds after I hibernate it, most of which is
probably I/O. In that time, I have my complete desktop, and Matlab, Lyx,
Maple, Word, Excel, Firefox, Thunderbird, Cygwin and Adobe Illustrator are
all up and running and ready to use. Another half second and the network is
up too (which is also an outrage: electrons don't need half a second to
travel to the ethernet.)
Hell, the linuxbios people boot so fast the hdd hasn't even spun up yet.
The time it takes to shut down is equally inexcusable. The people
responsible should be given a spreadsheet with 90 billion lines and required
to document in detail how each cycle is being used, one cycle per line.
Sébastien Loisel
Comments (32 posted)
Page editor: Jonathan Corbet