LWN.net Weekly Edition for February 20, 2003

The trojaning of mICQ

The story, it seems, is this: Rüdiger Kuhlmann, the maintainer of mICQ, had a disagreement with Martin Loschwitz, the maintainer of the Debian mICQ package, on how that package should be built. Mr. Kuhlmann complained that an old version of mICQ was shipped, that it contained bugs which had been fixed upstream, and that his name had been removed from the copyright file. The disagreement had apparently been going on for a while.

Mr. Kuhlmann decided that enough was enough, and he was going to take some action. As of mICQ 0.4.10.1, the code will, when built for the Debian distribution, print out a message which says some unflattering things about Mr. Loschwitz and encourages use of a different version; the program then exits. In other words, when built for Debian, mICQ thumbs its nose at the user and refuses to run. To help ensure that this code got into the official Debian version, it was written in an obfuscated manner, set to trigger only after February 11, and only if it was not being run by Mr. Loschwitz. For the curious, here is a posting containing the code in question.

In response, Mr. Loschwitz called for the removal of mICQ from the Debian distribution and started a generally impressive flamewar. After some time, the two parties actually started talking to each other; summaries from Mr. Kuhlmann and Mr. Loschwitz have been posted. The resolution involves fixing the packaging issues and the removal of the anti-Debian code. The mICQ package will also be removed from Debian until a security audit is performed and a new maintainer is found. The situation would appear to have been resolved.

The whole thing has, however, left a bad taste in the mouths of many Debian developers. According to some, Debian was subjected to a trojan horse/denial of service attack, and they are not happy about it. Mr. Kuhlmann denies this, of course ("In fact, I only added dead code. It was you who #ifdef'd it in - not knowingly, but anyway."), but this code, even described in more friendly terms ("easter egg," say), is the sort of thing that does not often happen in the free software world. Free software users like to think they have a bit more control over their systems than that. (It's not completely unheard of, though - GNU emacs used to greet Symbolics users with the message "In doing business with Symbolics, you are rewarding a wrong.")

Much of the discussion was concerned with what Mr. Kuhlmann could have done with this piece of stealth code. Such speculation is a bit off-topic, given that, as far as anybody can tell, there are no evil or destructive trojans coded into mICQ. In the context of a wider discussion, however, this episode does raise a scary issue. The mICQ code was slipped into a major distribution, seemingly with great ease. The code was relatively harmless, but, next time, it might not be. Access to source code decreases our vulnerability to this sort of attack; proprietary software, after all, can have anything in it. It is hard to imagine anybody being able to hide a flight simulator inside a free spreadsheet application. But anybody who believes that having the source makes us invulnerable to this kind of trojan is clearly mistaken. With suitably clever coding, great nastiness can be hidden in seemingly innocuous code. The resources to audit all of our code at the level of detail required to find small trojans simply don't exist.

Perhaps, in the future, tools like the Stanford Checker can be turned to the task of finding suspicious code in source distributions. For now, though, we have to remain on our guard. This kind of thing will happen again, and, next time, the results may not be so benign.

Comments (14 posted)

The Embedded Linux Consortium Platform Specification

The Embedded Linux Consortium has announced the launch of the ELC Platform Specification (ELCPS). The ELCPS was developed with input from numerous companies including IBM, LynuxWorks, Panasonic, Samsung, MontaVista, K Computing, Red Hat, WiPro, Hacom, and FSM Labs; its purpose is to encourage interoperability across embedded Linux systems. Those wanting the details can grab a copy of the specification in PDF format; for everybody else, here is a quick summary of what the ELCPS is trying to do.

The ELCPS is heavily influenced by the Linux Standard Base, POSIX, and the Single Unix Specification. However, it restricts itself to the programming environment (and, in particular, to which functions should be available) and is not concerned with the user experience side of things. It is assumed that the user of an embedded system will not be worried about which shells are available.

Of course, not all embedded systems are the same; the capabilities needed by a web-enabled phone handset or point of sale system will be different from, say, an elevator controller. So the ELCPS defines three levels of environment, each of which has different requirements.

• The minimal system environment is the bottom end; systems running in this mode may not deal directly with users, and may not even need a filesystem. ELCPS-compliant systems at this level should provide the basic C environment, signals, basic locking, and threads - but they do not necessarily have to be able to run more than one process.

• The intermediate system environment adds several things, including filesystem support, asynchronous I/O, dynamic libraries, multiple processes, inter-process communication, wide character support, and more.

• The full system environment is "essentially equivalent to a LSB 1.2 system," except that there is still no specification of which programs should be available. At this level, the environment should provide full floating-point math support, job control, networking, basic shell functions, system logging, password functions, and so on.

There are a couple of interesting omissions from the first version of the ELCPS. One is in the area of real-time programming. According to the specification, there is no clear standard for real-time programming in the Linux world. The LSB does not specify real-time functionality, and the POSIX real-time standards are still in flux. The specification makes no mention of the fact that serious real-time Linux programming tends to be done by way of RTLinux or RTAI, neither of which is standard in any way, but that situation has to have discouraged attempts to standardize real-time Linux functionality as well.

The specification also had to punt on thread support, since real POSIX threads implementations for Linux are still hard to come by. That situation should be rectified when the 2.6 kernel, with its greatly improved threading support, becomes available.

The Embedded Linux Consortium will eventually set up a certification program for ELCPS compliance.

The ELCPS is another sign that the embedded Linux community (and Linux in general) is growing up. Embedded Linux, in particular, has been subject to the sort of fragmentation that creates worry among technology pundits and corporate managers; the ELCPS should help those people to worry a bit less. By using embedded Linux, manufacturers are already able to free themselves from proprietary platforms and royalty payments. The ELCPS should make these manufacturers more confident that they will not find themselves locked into a single vendor. And that, of course, should be good for the Embedded Linux market as a whole.

Comments (3 posted)

Lindows sells virus protection

Lindows.com has announced a new offering for its distribution: for $29/year, Lindows users can run the new "VirusSafe" utility which protects the system from viruses. It seems like a reasonable product: other desktop systems have had anti-virus applications for years. And, apparently, virus protection is at the top of the list of features requested by Lindows users.

There's only one problem: Linux viruses are rather hard to find. In fact, the list of "in the wild" Linux viruses that have actually infected systems is short - there are none. The case of SirCam infection via Wine is, if anything, the exception that proves the rule. It demonstrates how far one has to go to infect a Linux system - and, even then, the virus was not able to propagate.

A Linux-based virus is not impossible; one could imagine, say, a hostile email message which, taking advantage of a fetchmail buffer overflow, managed to spread itself over the net. But the fact is that this sort of thing simply does not happen. Linux systems are harder to break into, and they are better at containing the effects of breaches that do occur. When a program is found to allow unpleasant things like arbitrary command execution (as in the recent vim modeline vulnerability), it gets fixed in a hurry rather than being presented as a feature.

So we thought it might be worthwhile to ask Lindows exactly what it is defending its users against. What virus (or other) infections would have been presented by running VirusSafe on a target system? Unfortunately, Lindows did not respond to repeated inquiries, so we are left having to guess.

Lindows, perhaps, is defending its users against the fear of running systems without virus scanners installed. It is difficult to explain to users why they probably do not need explicit virus protection; and, besides, it seems they are willing to pay for that protection whether they need it or not. As a business plan, it may make some sense - as long as you don't mind selling your customers something they almost certainly do not need.

Comments (24 posted)

Page editor: Jonathan Corbet

Security

Brief items

The National Strategy to Secure Cyberspace

[This article was contributed by Tom Owen]

The Friday release of the National Strategy to Secure Cyberspace may have been overshadowed by the recent departure of Richard Clarke, President Bush's Cybersecurity advisor. It certainly didn't get a big build up. But now we have the "final" version of what will doubtless be a continuously evolving strategy.

The draft released in September generated apathy and dismissal after widespread unsourced reports of tech firms lobbying to remove references to insecure "out of the box" configurations and wireless hazards. The biggest change over the draft is external: the Department of Homeland Security (DHS) now exists, with a budget and a head, and by far the majority of the action items fall on it.

The strategic objective is clear:

as is the purpose of the document:

The core of the strategy is the five national priorities

• A security response system
• A threat & vulnerability reduction system
• A Security awareness and training program
• Security within government operations
• National and International security co-operation

Within the strategy, each priority generates five to fifteen actions and recommendations. The actions typically fall on the federal government, typically the DHS or the United States generally, while the recomendations are for the private sector and academia.

Some consistent themes inform the discussion of all priorities:

• The threat is real: the US depends on the integrity of cyberspace, and that integrity can now be undone by enemies.
• Most of what's needed is outside the scope of Government: beyond protecting its own operations and the commons, the work has to be done by corporations, colleges and the public.
• Public and private can, must, work together
• Privacy and liberty must be protected. It's not that prominent, but it's a pleasant surprise to see it at all.

Regarding the called-for national security response system:

The plan appears to be mandating DHS to co-ordinate between Government agencies, and academic and private sector agents. Obvious candidates would include CERT, the AV vendors' labs, disaster recovery providers and perhaps operators like Bugtraq.

The challenge is twofold. Firstly, to co-ordinate their work on attacks and vulnerabilities, before and even -- using fax, conferencing and and voicemail -- during an attack, and secondly, to ensure that the private sector is using the resources created. It appears that there will be an effort to remove antitrust obstacles to this co-operation.

Responding to security incidents is important, but so is preventing those incidents before they happen. The strategy asks private and government agencies to communicate better to find and protect against potential problems. Even before the recent "Slammer" worm, others like Nimda and Code Red had made it clear that threats, once released, spread faster than fixes. So it is important to find and fix vulnerabilities before they are exploited.

One stand out point is a clear intention to use criminal justice more aggressively: this might be a good time to stop writing stupid viruses for fun. The strategy gets more specific here. Examples of the work planned include

• Improving infrastructure: the Commerce Deptartment's review of a national transition to IPv6 and the DHS's intention to bang heads together to get progress on securing DNS and BGP, together with longer term efforts to to add source address verification and secure out-of-band management to the Internet
• Securing plant and equipment control networks to exclude terrorists from air-traffic control, dams and chemical plants.
• Addressing software vulnerabilities: establishing a neutral clearinghouse, with, interestingly, a national policy defining appropriate vulnerability disclosure, central testing for patches to Government systems, and promotion of tools and best practice for patch distribution.

Then, there is the call for a national security awareness and training program. This priority addresses a slightly broader range than most. The traditional targets for security training: users, admins and developers, are there, but the plan goes further:

Getting these people trained is not going to be easy. School curricula, awareness programs and certification and the other plan items can reach professionals and users, but getting informed discussion between corporate policymakers at the country club will take something more -- there may be a role for the insurers here.

Of course, the government must also worry about cleaning up its own act, so it is not surprising to see internal security as an important part of this plan. The plan in this area is blandly conventional, revealing that government practice is no better than the private sector. One of the few mentions of a specific technology, wireless, occurs under this heading.

The last item (national and international security coordination) seems like a bland commitment to improve international co-operation, encouraging foreign countries to achieve effective criminal law and participate in information-sharing programs. But early on comes this jaw-dropper:

The strategy doesn't expand on this point, and responsibility for that action falls on no specific agency, but when it happens, it'll be on the evening news.

Given the source, the document as a whole is at least as good as could have been hoped. Part of the value comes from what's left out:

• Theres no hysteria about encryption or crackers
• No plan to wall off the US and unplug those nasty foreigners
• No dramatic legislative program
• No mandation or prohibition of specific technologies and vendors

High-level strategic planning can be used to hide a lot of vagueness and unreality, as the broad scope needed in the language and objectives makes it hard to visualise what is intended. This hasn't happened here. The Department of Homeland Security's interest in the network comes into clearer focus. Some of the organisations and networks which will protect cyberspace are making their first appearance here. And we can see that some people are asking the right questions.

Comments (1 posted)

February CRYPTO-GRAM Newsletter

Bruce Schneier's CRYPTO-GRAM newsletter for February is out. It looks at Matt Blaze's lock-picking disclosure (and the reaction to it), SQL Slammer worm notes, the importance of authentication, and more. "I'd rather have as much information as I can to make an informed decision about security. I'd rather have the information I need to pressure vendors to improve security. I don't want to live in a world where locksmiths can sell me a master key system that they know doesn't work or where the government can implement security measures without accountability."

Full Story (comments: none)

New vulnerabilities

mailman: mailman 2.1 cross site scripting vulnerabilities

Package(s):	mailman	CVE #(s):
Created:	February 18, 2003	Updated:	February 19, 2003
Description:	The email variable and the default error page in mailman 2.1 contains cross site scripting vulnerabilities. Read the the full advisory for the details.
Alerts:	Gentoo 200302-05 2003-02-17

Comments (none posted)

nethack: buffer overflow

Package(s):	nethack, slashem, falconseye	CVE #(s):	CAN-2003-0358 CAN-2003-0359
Created:	February 18, 2003	Updated:	July 15, 2003
Description:	Overflowing a buffer in nethack may lead to privilege escalation to games uid. Read the the full advisory for the details. Note that falconseye does not contain the file permission error CAN-2003-0359 which affected some other nethack packages.
Alerts:	Debian DSA-350-1 2003-07-15 Debian DSA-316-3 2003-06-17 Debian DSA-316-2 2003-06-11 Debian DSA-316-1 2003-06-11 Gentoo 200302-08 2003-02-18

Comments (none posted)

OpenSSL: plaintext exposure vulnerability

Package(s):	openssl	CVE #(s):	CAN-2003-0078
Created:	February 19, 2003	Updated:	March 6, 2003
Description:	A vulnerability has been found in OpenSSL that, given the right conditions, could lead to the exposure of transactions in plain text. This problem looks difficult to exploit (it requires a man-in-the-middle attack, among other things), but one can't be too sure, so the OpenSSL project has released versions 0.9.7a (with the fix and some new features) and 0.9.6i (with fixes only). See the announcement for details.
Alerts:	Red Hat RHSA-2003:062-11 2003-03-06 SuSE SuSE-SA:2003:011 2003-02-26 Conectiva CLA-2003:570 2003-02-24 Debian DSA-253-1 2003-02-24 Mandrake MDKSA-2003:020 2003-02-21 Trustix 2003-0005 2003-02-20 Gentoo 200302-10 2003-02-20 EnGarde ESA-20030220-005 2003-02-20 OpenPKG OpenPKG-SA-2003.013 2003-02-19

Comments (none posted)

pam_xauth: root exploit

Package(s):	pam_xauth	CVE #(s):	CAN-2002-1160
Created:	February 13, 2003	Updated:	July 10, 2003
Description:	The pam_xauth module is used to forward xauth information from user to user in applications such as 'su'. Andreas Beck discovered that versions of pam_xauth supplied with Red Hat Linux since version 7.1 would forward authorization information from the root account to unprivileged users. This could be used by a local attacker to gain access to an administrator's X session. In order to exploit this vulnerability, the attacker would have to get the administrator, as root, to use su to the account belonging to the attacker.
Alerts:	Conectiva CLA-2003:693 2003-07-10 Mandrake MDKSA-2003:017-1 2003-04-28 Red Hat RHSA-2003:035-10 2003-02-12

Comments (none posted)

php: arbitrary file access and code execution

Package(s):	php, mod_php	CVE #(s):
Created:	February 18, 2003	Updated:	February 19, 2003
Description:	Kosmas Skiadopoulos discovered a serious security vulnerability [0] in the CGI SAPI of PHP version 4.3.0. PHP [1] contains code for preventing direct access to the CGI binary with configure option "--enable-force-cgi-redirect" and php.ini option "cgi.force_redirect". In PHP 4.3.0 there is a bug which renders these options useless. Please note that this bug does NOT affect any of the other SAPI modules such as the Apache or ISAPI modules. Anyone with access to websites hosted on a web server which employs the CGI module may exploit this vulnerability to gain access to any file readable by the user under which the webserver runs. A remote attacker could also trick PHP into executing arbitrary PHP code if attacker is able to inject the code into files accessible by the CGI. This could be for example the web server access-logs. References: [0] http://www.php.net/release_4_3_1.php [1] http://www.php.net/
Alerts:	Gentoo 200302-09 2003-02-19 OpenPKG OpenPKG-SA-2003.010 2003-02-18

Comments (none posted)

syslinux: security issues in installer

Package(s):	syslinux	CVE #(s):
Created:	February 18, 2003	Updated:	February 19, 2003
Description:	From the syslinux changelog: "Security flaws have been found in the SYSLINUX installer when running setuid root. Rewrite the SYSLINUX installer so it uses mtools instead. It therefore now requires mtools (specifically mcopy and mattrib) to exist on your system, but it will not require root privileges and SHOULD NOT be setuid."
Alerts:	Gentoo 200302-06 2003-02-17

Comments (none posted)

util-linux: predictable mcookie results

Package(s):	util-linux	CVE #(s):
Created:	February 14, 2003	Updated:	February 19, 2003
Description:	The util-linux package provides the mcookie utility, a tool for generating random cookies that can be used for X authentication. The util-linux packages that were distributed with Mandrake Linux 8.2 and 9.0 had a patch that made it use /dev/urandom instead of /dev/random, which resulted in the mcookie being more predictable than it would otherwise be. This patch has been removed in these updates, giving mcookie a better source of entropy and making the generated cookies less predictable. Thanks to Dirk Mueller for pointing this out.
Alerts:	Mandrake MDKSA-2003:016 2003-02-13

Comments (2 posted)

Updated vulnerabilities

Heap corruption vulnerability in at

Package(s):	at at, sudo, xchat	CVE #(s):	CAN-2002-0004
Created:	May 21, 2002	Updated:	May 15, 2003
Description:	The at command has a potentially exploitable heap corruption bug. (First LWN report:  January 17th).
Alerts:	EnGarde ESA-20030515-015 2003-05-15 Yellow Dog YDU-20020127-9 2002-01-27 SuSE SuSE-SA:2002:003 2001-01-16 Slackware sl-1011706104 2002-01-22 Red Hat RHSA-2002:015-15 2002-02-07 Red Hat RHSA-2002:015-13 2002-01-22 Mandrake MDKSA-2002:007 2002-01-18 Debian DSA-102-2 2002-01-18 Debian DSA-102-1 2002-01-16

Comments (none posted)

BIND8: Multiple vulnerabilities

Package(s):	bind	CVE #(s):	CAN-2002-1219 CAN-2002-1220 CAN-2002-1221
Created:	November 13, 2002	Updated:	March 6, 2003
Description:	Three new vulnerabilities have been found in version 8 of the Berkeley Internet Domain Server; see this ISS advisory, the CERT Advisory CA-2002-31, or the November 14 LWN Security Page for details. Red Hat has sent out an alert (not a regular advisory) suggesting that customers apply its previous BIND updates, which upgrade the system to BIND9.
Alerts:	Sorcerer SORCERER2003-03-06 2003-03-06 SCO Group CSSA-2002-059.0 2002-12-19 Trustix 2002-0076 2002-11-15 OpenPKG OpenPKG-SA-2002.011 2002-11-15 Debian DSA-196-1 2002-11-14 Conectiva CLA-2002:546 2002-11-14 Mandrake MDKSA-2002:077 2002-11-14 SuSE SuSE-SA:2002:044 2002-11-13 EnGarde ESA-20021114-029 2002-11-14

Comments (1 posted)

bind buffer overflow vulnerability in DNS resolver libraries

Package(s):	bind glibc	CVE #(s):	CAN-2002-0651 CAN-2002-0684
Created:	July 8, 2002	Updated:	October 1, 2003
Description:	The BIND 4.9.8-OW2 patch and BIND 4.9.9 release (and thus 4.9.9-OW1) include fixes for a libc related vulnerability which does not affect Linux. Updates from the Internet Software Consortium (ISC) are available from here. No release or branch of Openwall GNU/*/Linux (Owl) is known to be affected, due to Olaf Kirch's fixes for this problem getting into the GNU C library more than two years ago. Unfortunatly that does not mean that Linux systems are not vulnerable. Similar code, without Olaf Firch's fixes, is in the glibc getnetbyXXX functions. These functions are described in the SuSE alert as " used by very few applications only, such as ifconfig and ifuser, which makes exploits less likely." CERT Advisory: CA-2002-19 Buffer Overflow in Multiple DNS Resolver Libraries CAN-2002-0651 CAN-2002-0684
Alerts:	Mandrake MDKSA-2002:050 2002-08-13 Yellow Dog YDU-20020810-3 2002-08-10 Eridani ERISA-2002:035 2002-08-09 Red Hat RHSA-2002:133-13 2002-08-08 SCO Group CSSA-2002-034.0 2002-08-05 Yellow Dog YDU-20020801-2 2002-08-01 Eridani ERISA-2002:028 2002-07-25 Red Hat RHSA-2002:139-10 2002-07-22 EnGarde ESA-20020724-018 2002-07-24 Mandrake MDKSA-2002:043 2002-07-16 Trustix 2002-0061 2002-07-15 Gentoo glibc-20020713 2002-07-13 Conectiva CLA-2002:507 2002-07-11 SuSE SuSE-SA:2002:026 2002-07-09 OpenPKG OpenPKG-SA-2002.006 2002-07-04

Comments (1 posted)

Canna server: exploitable buffer overrun

Package(s):	canna	CVE #(s):	CAN-2002-1158 CAN-2002-1159
Created:	December 10, 2002	Updated:	October 1, 2003
Description:	Canna is a kana-kanji conversion server which is necessary for Japanese language character input. A buffer overflow bug in the Canna server up to and including version 3.5b2 allows a local user to gain the privileges of the user 'bin' which could lead to further exploits. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-1158 to this issue. A lack of validation of requests has been found that affects Canna version 3.6 and earlier. A malicious remote user could exploit this vulnerability to leak information, or cause a denial of service attack. (CAN-2002-1159) See also http://canna.sourceforge.jp/sec/Canna-2002-01.txt CAN-2002-1158 CAN-2002-1159
Alerts:	SCO Group CSSA-2003-005.0 2003-01-21 Debian DSA-224-1 2002-01-08 Gentoo 200212-8 2002-12-20 Red Hat RHSA-2002:246-18 2002-12-04

Comments (none posted)

cups - multiple vulnerabilities

Package(s):	cups	CVE #(s):	CAN-2002-1366 CAN-2002-1367 CAN-2002-1368 CAN-2002-1369 CAN-2002-1371 CAN-2002-1372 CAN-2002-1383
Created:	December 30, 2002	Updated:	February 18, 2003
Description:	Exploitation of multiple CUPS vulnerabilities allow local and remote attackers in the worst of the scenarios to gain root privileges. See the iDEFENSE advisory for more information.
Alerts:	Debian DSA-232-2 2003-02-20 SCO Group CSSA-2003-004.0 2003-01-20 Debian DSA-232-1 2003-01-20 Yellow Dog YDU-20030114-1 2002-01-14 Red Hat RHSA-2002:295-07 2003-01-09 Mandrake MDKSA-2003:001 2003-01-09 SuSE SuSE-SA:2003:002 2003-01-02 Gentoo 200212-13 2002-12-29

Comments (none posted)

CVS - exploitable double-free bug in the CVS server

Package(s):	cvs	CVE #(s):	CAN-2003-0015
Created:	January 20, 2003	Updated:	April 7, 2003
Description:	CVS is a version control system frequently used to manage source code repositories. During an audit of the CVS sources, Stefan Esser discovered an exploitable double-free bug in the CVS server. On servers which are configured to allow anonymous read-only access, this bug could be used by anonymous users to gain write privileges. Users with CVS write privileges can then use the Update-prog and Checkin-prog features to execute arbitrary commands on the server. All users of CVS are advised to upgrade to erratum packages which contain patches to correct the double-free bug. See also this CERT advisory
Alerts:	Immunix IMNX-2003-7+-004-01 2003-04-02 SCO Group CSSA-2003-006.0 2003-01-31 Yellow Dog YDU-20030127-6 2003-01-27 Conectiva CLA-2003:561 2003-01-23 SuSE SuSE-SA:2003:0007 2003-01-22 Slackware sl-1043242333 2003-01-22 Conectiva CLA-2003:560 2003-01-21 Debian DSA-233-1 2003-01-21 Gentoo 200301-12 2003-01-21 OpenPKG OpenPKG-SA-2003.004 2003-01-21 Mandrake MDKSA-2003:009 2003-01-20 Red Hat RHSA-2003:012-07 2003-01-20

Comments (none posted)

dhcp3 - ignored counter boundary

Package(s):	dhcp3	CVE #(s):	CAN-2003-0039
Created:	January 28, 2003	Updated:	April 5, 2003
Description:	Florian Lohoff discovered a bug in the dhcrelay causing it to send a continuing packet storm towards the configured DHCP server(s) in case of a malicious BOOTP packet, such as sent from buggy Cisco switches. When the dhcp-relay receives a BOOTP request it forwards the request to the DHCP server using the broadcast MAC address ff:ff:ff:ff:ff:ff which causes the network interface to reflect the packet back into the socket. To prevent loops the dhcrelay checks whether the relay-address is its own, in which case the packet would be dropped. In combination with a missing upper boundary for the hop counter an attacker can force the dhcp-relay to send a continuing packet storm towards the configured dhcp server(s). This patch introduces a new commandline switch ``-c maxcount'' and people are advised to start the dhcp-relay with ``dhcrelay -c 10'' or a smaller number, which will only create that many packets. The dhcrelay program from the ``dhcp'' package does not seem to be affected since DHCP packets are dropped if they were apparently relayed already.
Alerts:	Conectiva CLA-2003:616 2003-04-04 Red Hat RHSA-2003:034-01 2003-03-31 OpenPKG OpenPKG-SA-2003.012 2003-02-19 Debian DSA-245-1 2003-01-28

Comments (none posted)

dvips: command execution vulnerability

Package(s):	dvips	CVE #(s):	CAN-2002-0836
Created:	October 16, 2002	Updated:	June 10, 2003
Description:	The dvips utility uses the system() function improperly when managing fonts. An attacker who can craft the right sort of print job can use this vulnerability to execute commands under the UID used by the print system.
Alerts:	Immunix IMNX-2003-7+-016-01 2003-06-09 OpenPKG OpenPKG-SA-2002.015 2002-12-16 Debian DSA-207-1 2002-12-11 Conectiva CLA-2002:537 2002-10-29 Mandrake MDKSA-2002:071 2002-10-24 Mandrake MDKSA-2002:070 2002-10-23 Gentoo tetex-20021018 2002-10-18 Red Hat RHSA-2002:194-18 2002-10-08

Comments (none posted)

Filename disclosure vulnerability in fam

Package(s):	fam	CVE #(s):	CAN-2002-0875
Created:	August 19, 2002	Updated:	January 5, 2005
Description:	"fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible.
Alerts:	Red Hat RHSA-2005:005-01 2005-01-05 Debian DSA-154-1 2002-08-15

Comments (none posted)

fetchmail: buffer overflow

Package(s):	fetchmail	CVE #(s):	CAN-2002-1365
Created:	December 17, 2002	Updated:	October 20, 2003
Description:	Versions of fetchmail prior to 6.2.0 have (yet another) buffer overflow vulnerability which can be exploited remotely via a suitably crafted message. See this advisory for details.
Alerts:	Immunix IMNX-2003-7+-023-01 2003-10-17 Mandrake MDKSA-2003:011 2003-01-27 EnGarde ESA-20030127-002 2003-01-27 SCO Group CSSA-2003-001.0 2003-01-09 SuSE SuSE-SA:2003:001 2003-01-02 Debian DSA-216-1 2002-12-24 Red Hat RHSA-2002:293-09 2002-12-17 Conectiva CLA-2002:554 2002-12-16

Comments (3 posted)

GNU fileutils race condition

Package(s):	fileutils ucdsnmp	CVE #(s):	CAN-2002-0435
Created:	May 21, 2002	Updated:	May 16, 2003
Description:	A race condition in rm may cause the root user to delete the whole filesystem. The problem exists in the version of rm in fileutils 4.1 stable and 4.1.6 development version. A patch is available. (First LWN report: May 2).
Alerts:	Immunix IMNX-2003-7+-010-01 2003-05-16 Red Hat RHSA-2003:015-05 2003-02-12 Trustix 2002-0052 2002-06-06 SuSE SuSE-SA:2002:012 2002-04-08 Mandrake MDKSA-2002:031 2002-05-16 SCO Group CSSA-2002-018.1 2002-05-13

Comments (none posted)

Potential remote root exploit in glibc

Package(s):	glibc	CVE #(s):	CAN-2002-0391
Created:	August 14, 2002	Updated:	June 30, 2003
Description:	Felix von Leitner, discovered a potential division by zero bug in code derived from the SunRPC library which is used in glibc.This bug could be exploited to gain unauthorized root access to software linking to glibc. Updating as soon as practical is a good idea. Because SunRPC-derived XDR libraries are used by a variety of vendors in a variety of applications, this defect may lead to a number of differing security problems. Exploiting this vulnerability will lead to denial of service, execution of arbitrary code, or the disclosure of sensitive information. CERT/CC Vulnerability Note VU#192995 Integer overflow in xdr_array() function when deserializing the XDR stream
Alerts:	Debian DSA-333-1 2003-06-27 Conectiva CLA-2002:535 2002-10-29 Trustix 2002-0070 2002-10-17 EnGarde ESA-20021003-021 2002-10-03 Gentoo glibc-20020927 2002-09-27 Gentoo dietlibc-20020927 2002-09-27 Debian DSA-149-2 2002-09-26 Mandrake MDKSA-2002:061 2002-09-23 Gentoo glibc-20020905 2002-09-05 SuSE SuSE-SA:2002:031 2002-08-30 Trustix 2002-0067 2002-08-13 Eridani ERISA-2002:036 2002-08-13 Red Hat RHSA-2002:166-07 2002-08-12 Debian DSA-149-1 2002-08-13

Comments (none posted)

glibc: DNS stub resolvers contain buffer overflow vulnerability

Package(s):	glibc	CVE #(s):	CAN-2002-1146
Created:	November 7, 2002	Updated:	February 5, 2004
Description:	DNS stub resolvers from multiple vendors contain a buffer overflow vulnerability. The impact of this vulnerability appears to be limited to denial of service. (See CERT Vulnerability Note VU#738331) The BIND 4 and BIND 8.2.x stub resolver libraries, and other libraries such as glibc 2.2.5 and earlier, libc, and libresolv, uses the maximum buffer size instead of the actual size when processing a DNS response, which causes the stub resolvers to read past the actual boundary ("read buffer overflow"), allowing remote attackers to cause a denial of service (crash).
Alerts:	Mandrake MDKSA-2004:009 2004-02-04 Red Hat RHSA-2002:197-09 2002-11-06 Red Hat RHSA-2002:197-06 2002-10-03

Comments (none posted)

hypermail - buffer overflows

Package(s):	hypermail	CVE #(s):	CAN-2003-0057
Created:	February 11, 2003	Updated:	February 27, 2003
Description:	Ulf Harnhammar discovered two problems in hypermail, a program to create HTML archives of mailing lists. An attacker could craft a long filename for an attachment that would overflow two buffers when a certain option for interactive use was given, opening the possibility to inject arbitrary code. This code would then be executed under the user id hypermail runs as, mostly as a local user. Automatic and silent use of hypermail does not seem to be affected. The CGI program mail, which is not installed by the Debian package, does a reverse look-up of the user's IP number and copies the resulting hostname into a fixed-size buffer. A specially crafted DNS reply could overflow this buffer, opening the program to an exploit.
Alerts:	SuSE SuSE-SA:2003:0012 2003-02-27 Debian DSA-248-1 2003-01-31

Comments (none posted)

IM: creates temporary files insecurely

Package(s):	im	CVE #(s):	CAN-2002-1395
Created:	December 3, 2002	Updated:	March 6, 2003
Description:	Tatsuya Kinoshita discovered that IM, which contains interface commands and Perl libraries for E-mail and NetNews, creates temporary files insecurely. The impwagent program creates a temporary directory in an insecure manner in /tmp using predictable directory names without checking the return code of mkdir, so it's possible to seize a permission of the temporary directory by local access as another user. The immknmz program creates a temporary file in an insecure manner in /tmp using a predictable filename, so an attacker with local access can easily create and overwrite files as another user.
Alerts:	Red Hat RHSA-2003:039-06 2003-03-06 Debian DSA-202-2 2002-12-06 Debian DSA-202-1 2002-12-03

Comments (none posted)

IMP - SQL injection vulnerability

Package(s):	imp	CVE #(s):	CAN-2003-0025
Created:	January 15, 2003	Updated:	July 8, 2003
Description:	The IMP IMAP server, versions 2.2.8 and prior, is vulnerable to SQL injection; see this advisory for details. Version 3.x is not vulnerable to this problem.
Alerts:	Conectiva CLA-2003:690 2003-07-08 SuSE SuSE-SA:2003:0008 2003-02-18 Debian DSA-229-2 2003-01-15

Comments (1 posted)

KDE - command parameter quoting problems

Package(s):	kde	CVE #(s):	CAN-2002-1393
Created:	December 24, 2002	Updated:	February 21, 2003
Description:	In some instances, KDE (versions 2 and 3) fails to properly quote parameters of instructions passed to a command shell for execution. These parameters may incorporate data such as URLs, filenames and e-mail addresses, and this data may be provided remotely to a victim in an e-mail, a webpage or files on a network filesystem or other untrusted source. By carefully crafting such data an attacker might be able to execute arbitary commands on a vulnerable sytem using the victim's account and privileges. See this announcement for more details.
Alerts:	Conectiva CLA-2003:569 2003-02-20 Debian DSA-243-1 2003-01-24 Debian DSA-242-1 2003-01-24 Debian DSA-241-1 2003-01-24 Debian DSA-239-1 2003-01-23 Debian DSA-240-1 2003-01-23 Debian DSA-237-1 2003-01-22 Debian DSA-238-1 2003-01-23 Debian DSA-236-1 2003-01-22 Debian DSA-235-1 2003-01-22 Debian DSA-234-1 2003-01-22 Gentoo 200301-11 2003-01-18 Mandrake MDKSA-2003:004-1 2003-01-17 Mandrake MDKSA-2003:004 2003-01-13 Gentoo 200212-9 2002-12-22

Comments (none posted)

kdelibs: Vulnerabilities in KIO subsystem support

Package(s):	kdelibs	CVE #(s):	CAN-2002-1281 CAN-2002-1282
Created:	November 22, 2002	Updated:	March 15, 2003
Description:	Vulnerabilities were discovered in the KIO subsystem support for various network protocols. The implementation of the rlogin protocol affects all KDE versions from 2.1 up to 3.0.4, while the flawed implementation of the telnet protocol only affects KDE 2.x. They allow a carefully crafted URL in an HTML page, HTML email, or other KIO-enabled application to execute arbitrary commands as the victim with their privilege. The KDE team provided a patch for KDE3 which has been applied in these packages. No patch was provided for KDE2, however the KDE team recommends disabling both the rlogin and telnet KIO protocols. This can be accomplished by removing, as root, the following files: /usr/share/services/telnet.protocol and /usr/share/services/rlogin.protocol. If either file also exists in a user's ~/.kde/share/services directory, they should likewise be removed. See also: http://www.kde.org/info/security/advisory-20021111-1.txt
Alerts:	SCO Group CSSA-2003-012.0 2003-03-14 Debian DSA-204-1 2002-12-05 Red Hat RHSA-2002:220-40 2002-12-04 Mandrake MDKSA-2002:079 2002-11-21

Comments (none posted)

kernel-utils: setuid vulnerability

Package(s):	kernel-utils	CVE #(s):	CAN-2003-0019
Created:	February 7, 2003	Updated:	January 21, 2005
Description:	The kernel-utils package contains several utilities that can be used to control the kernel or machine hardware. In Red Hat Linux 8.0 this package contains user mode linux (UML) utilities. The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was incorrectly shipped setuid root. This could allow local users to control certain network interfaces, add and remove arp entries and routes, and put interfaces in and out of promiscuous mode. All users of the kernel-utils package should update to these packages that contain a version of uml_net that is not setuid root. Alternatively, as a work-around to this vulnerability issue the following command as root: chmod -s /usr/bin/uml_net
Alerts:	Red Hat RHSA-2003:056-08 2003-02-07

Comments (none posted)

krb5 - vulnerability in Kerberos ftp client

Package(s):	krb5 ftp netkit	CVE #(s):	CAN-2003-0041
Created:	January 31, 2003	Updated:	February 21, 2003
Description:	Kerberos is a network authentication system. A problem has been found in the Kerberos ftp client. When retrieving a file with a filename beginning with a pipe character, the ftp client will pass the filename to the command shell in a system() call. This could allow a malicious ftp server to write to files outside of the current directory or execute commands as the user running the ftp client. The Kerberos ftp client runs as the default ftp client when the Kerberos package krb5-workstation is installed on a Red Hat Linux distribution.
Alerts:	Mandrake MDKSA-2003:021 2003-02-21 Red Hat RHSA-2003:020-10 2003-01-31

Comments (none posted)

libmcrypt: buffer overflows and memory exhaustion

Package(s):	libmcrypt	CVE #(s):	CAN-2003-0031 CAN-2003-0032
Created:	January 6, 2003	Updated:	February 27, 2003
Description:	libmcrypt versions prior to 2.5.5 contain a number of buffer overflow vulnerabilities that stem from improper or lacking input validation. By passing a longer than expected input to a number of functions (multiple functions are affected) the user can successful make libmcrypt crash. Another vulnerability is due to the way libmcrypt loads algorithms via libtool. When the algorithms are loaded dynamically the each time the algorithm is loaded a small (few kilobytes) of memory are leaked. In a persistant enviroment (web server) this could lead to a memory exhaustion attack that will exhaust all avaliable memory by launching repeated requests at an application utilizing the mcrypt library.
Alerts:	SuSE SuSE-SA:2003:0010 2003-02-26 Conectiva CLA-2003:567 2003-02-05 Debian DSA-228-1 2003-01-14 Gentoo 200301-4 2003-01-05

Comments (none posted)

libpng, libpng3: buffer overflow

Package(s):	libpng, libpng3	CVE #(s):	CAN-2002-1363
Created:	December 19, 2002	Updated:	July 14, 2004
Description:	Glenn Randers-Pehrson discovered a problem in connection with 16-bit samples from libpng, an interface for reading and writing PNG (Portable Network Graphics) format files. The starting offsets for the loops are calculated incorrectly which causes a buffer overrun beyond the beginning of the row buffer.
Alerts:	Gentoo 200407-06 2004-07-08 OpenPKG OpenPKG-SA-2004.030 2004-07-06 Mandrake MDKSA-2004:063 2004-06-29 Whitebox WBSA-2004:249-01 2004-06-21 Fedora FEDORA-2004-176 2004-06-18 Fedora FEDORA-2004-174 2004-06-18 Fedora FEDORA-2004-175 2004-06-18 Fedora FEDORA-2004-173 2004-06-18 Red Hat RHSA-2004:249-01 2004-06-18 Conectiva CLA-2003:564 2003-01-23 Mandrake MDKSA-2003:008 2003-01-20 OpenPKG OpenPKG-SA-2003.001 2003-01-15 Yellow Dog YDU-20030114-2 2002-01-14 SuSE SuSE-SA:2003:0004 2003-01-14 Red Hat RHSA-2003:006-06 2003-01-09 Debian DSA-213-1 2002-12-19

Comments (none posted)

lynx: CRLF injection vulnerability

Package(s):	lynx	CVE #(s):	CAN-2002-1405
Created:	November 19, 2002	Updated:	October 1, 2003
Description:	If lynx is given a url with some special characters on the command line, it will include faked headers in the HTTP query. This feature can be used to force scripts (that use Lynx for downloading files) to access the wrong site on a web server with multiple virtual hosts. CAN-2002-1405
Alerts:	Conectiva CLA-2003:720 2003-08-11 Mandrake MDKSA-2003:023 2003-02-24 OpenPKG OpenPKG-SA-2003.011 2003-02-18 Red Hat RHSA-2003:029-06 2003-02-12 Trustix 2002-0085 2002-12-19 Debian DSA-210-1 2002-12-13 SCO Group CSSA-2002-049.0 2002-11-18

Comments (none posted)

perl-MailTools: remote command execution

Package(s):	MailTools	CVE #(s):	CAN-2002-1271
Created:	November 5, 2002	Updated:	September 19, 2003
Description:	The SuSE Security Team reviewed critical Perl modules, including the Mail::Mailer package. This package contains a security hole which allows remote attackers to execute arbitrary commands in certain circumstances. This is due to the usage of mailx as default mailer which allows commands to be embedded in the mail body. Note that mail processing programs which use this package can be affected by this vulnerability; in particular, SpamAssassin is vulnerable if you use the -r or -w flags.
Alerts:	Debian DSA-386-1 2003-09-18 Gentoo 200302-01 2003-02-02 Mandrake MDKSA-2002:076 2002-11-07 Gentoo 200211-001 2002-11-06 SuSE SuSE-SA:2002:041 2002-11-05

Comments (none posted)

micq: Denial of service

Package(s):	micq	CVE #(s):
Created:	December 13, 2002	Updated:	April 24, 2003
Description:	Rüdiger Kuhlmann, upstream developer of mICQ, a text based ICQ client, discovered a problem in mICQ. Receiving certain ICQ message types that do not contain the required 0xFE seperator causes all versions to crash.
Alerts:	Red Hat RHSA-2003:118-01 2003-04-24 Debian DSA-211-1 2002-12-13

Comments (none posted)

mod_dav: Apache mod_dav module format string vulnerability

Package(s):	mod_dav	CVE #(s):
Created:	February 18, 2003	Updated:	February 19, 2003
Description:	The Apache mod_dav module contains a format string vulnerability in the "ap_log_rerror()" function.
Alerts:	(No alerts in the database for this vulnerability)

Comments (1 posted)

PHP Remote Compromise/DOS Vulnerability

Package(s):	mod_php4	CVE #(s):
Created:	July 22, 2002	Updated:	February 18, 2003
Description:	PHP 4.2.0 and 4.2.1 have an error in the handling of POST requests which can lead to the corruption of memory, and the usual bad consequences. According to this alert, the vulnerability can only be used for denial of service on x86 systems - there is no way to get it to run exploit code. SPARC/Solaris systems are apparently vulnerable to full remote compromise. According to the CERT Advisory, almost every Linux distributor, it seems, ships older (and thus not vulnerable) versions of PHP. Note that, sometimes, systems thought to be safe from remote compromise turn out to be vulnerable to a modified attack, so x86 users should not relax too much. The solution, for those systems with PHP 4.2.0 or 4.2.1 installed, is to upgrade to PHP 4.2.2. For more information see the alert from the discover of the vulnerability, Stefan Esser of e-matters GmbH, or the security advisory from the php team. CERT Advisory: CA-2002-21 Vulnerability in PHP
Alerts:	SuSE SuSE-SA:2003:0009 2003-02-18

Comments (1 posted)

mod_php - buffer overflow

Package(s):	mod_php php	CVE #(s):	CAN-2002-1396
Created:	January 13, 2003	Updated:	February 20, 2003
Description:	The wordwrap() function on user-supplied input may allow a specially-crafted input to overflow the allocated buffer and overwrite the heap. There are no known exploits, but an exploit is theoretically possible. Read the full advisory at http://marc.theaimsgroup.com/?l=bugtraq&m=104102689503192&w=2
Alerts:	Mandrake MDKSA-2003:019 2003-02-19 EnGarde ESA-20030219-003 2003-02-19 Red Hat RHSA-2003:017-06 2003-02-04 OpenPKG OpenPKG-SA-2003.005 2003-01-22 Gentoo 200301-8 2003-01-13

Comments (none posted)

Mozilla: Privacy leak and other vulnerabilities

Package(s):	mozilla	CVE #(s):	CAN-2002-1126 CAN-2002-1091
Created:	November 1, 2002	Updated:	February 13, 2003
Description:	Mozilla 1.1 and earlier, and Mozilla-based browsers such as Netscape and Galeon, set the document referrer too quickly in certain situations when a new page is being loaded, which allows web pages to determine the next page that is being visited, including manually entered URLs. Netscape 6.2.3 and earlier, and Mozilla 1.0.1, allow remote attackers to corrupt heap memory and execute arbitrary code via a GIF image with a zero width. See also Mozilla's Recently fixed security issues page. All users are encouraged to upgrade to this latest stable 1.0.x release of Mozilla.
Alerts:	Conectiva CLA-2003:568 2003-02-13 Mandrake MDKSA-2002:075 2002-10-31

Comments (none posted)

MySQL - double free vulnerability

Package(s):	mysql	CVE #(s):	CAN-2003-0073
Created:	January 29, 2003	Updated:	February 21, 2003
Description:	MySQL 3.23.55 fixes a double-free vulnerability which allows a hostile client to crash the server process. Logging into the server is necessary before this vulnerability can be exploited.
Alerts:	Trustix 2003-0003 2003-02-20 EnGarde ESA-20030220-004 2003-02-20 Mandrake MDKSA-2003:013 2003-02-03 OpenPKG OpenPKG-SA-2003.008 2003-01-29

Comments (none posted)

MySQL: multiple vulnerabilities

Package(s):	mysql	CVE #(s):
Created:	December 13, 2002	Updated:	April 10, 2003
Description:	The MySQL database server has several buffer overflow and integer bounds checking vulnerabilities which can lead to denial of service attacks, and, possibily, remote code execution. See this e-matters advisory for details. Version 3.23.54 fixes the problems.
Alerts:	Immunix IMNX-2003-7+-008-01 2003-04-08 EnGarde ESA-20030127-001 2003-01-27 Red Hat RHSA-2002:288-22 2003-01-15 SuSE SuSE-SA:2003:003 2003-01-02 Trustix 2002-0086 2002-12-19 Mandrake MDKSA-2002:087 2002-12-18 Debian DSA-212-1 2002-12-17 Conectiva CLA-2002:555 2002-12-17 OpenPKG OpenPKG-SA-2002.013 2002-12-16 Gentoo 200212-2 2002-12-15 EnGarde ESA-20021213-033 2002-12-13

Comments (none posted)

net-snmp: denial of service vulnerability

Package(s):	net-snmp	CVE #(s):	CAN-2002-1170
Created:	December 17, 2002	Updated:	November 7, 2003
Description:	The SNMP daemon included in the Net-SNMP package versions 5.0.1 through 5.0.4 can be caused to crash if it is sent a specially crafted packet.
Alerts:	Conectiva CLA-2003:778 2003-11-07 Red Hat RHSA-2002:228-11 2002-12-17

Comments (none posted)

OpenLDAP2: remote command execution

Package(s):	OpenLDAP2	CVE #(s):	CAN-2002-1378 CAN-2002-1379
Created:	December 6, 2002	Updated:	February 21, 2003
Description:	OpenLDAP is the Open Source implementation of the Lightweight Directory Access Protocol (LDAP) and is used in network environments for distributing certain information such as X.509 certificates or login information. The SuSE Security Team reviewed critical parts of that package and found several buffer overflows and other bugs remote attackers could exploit to gain access on systems running vulnerable LDAP servers. In addition to these bugs, various local exploitable bugs within the OpenLDAP2 libraries (openldap2-devel package) have been fixed. Since there is no workaround possible except shutting down the LDAP server, an update is strongly recommended.
Alerts:	Trustix 2003-0002 2003-02-20 Red Hat RHSA-2003:040-07 2003-02-05 Mandrake MDKSA-2003:006 2003-01-14 Debian DSA-227-1 2003-01-13 Gentoo 200212-12 2002-12-28 Conectiva CLA-2002:556 2002-12-19 SuSE SuSE-SA:2002:047 2002-12-06

Comments (1 posted)

PHP: vulnerability in mail function

Package(s):	php	CVE #(s):	CAN-2002-0985 CAN-2002-0986
Created:	November 13, 2002	Updated:	October 1, 2003
Description:	Two vulnerabilities exists in the mail() PHP function. The first one allows the execution of any program/script bypassing safe_mode restriction, the second one may give an open-relay script if the mail() function is not carefully used in PHP scripts. See this Bugtraq report for more details. Note that this is a different vulnerability than the previous PHP mail() problem, which affected versions through 4.1.0. CAN-2002-0985 CAN-2002-0986
Alerts:	SCO Group CSSA-2003-008.0 2003-03-04 Gentoo 200211-005 2002-11-20 EnGarde ESA-20021122-031 2002-11-22 Conectiva CLA-2002:545 2002-11-13 Red Hat RHSA-2002:213-06 2002-11-11

Comments (none posted)

PostgreSQL - more buffer overflows

Package(s):	postgresql	CVE #(s):
Created:	February 12, 2003	Updated:	November 7, 2003
Description:	A new set of buffer overflows has been discovered in PostgreSQL 7.2.2; they affect the circle_poly(), path_encode(), and path_addr() functions. Exploiting these overflows requires that the attacker first obtain a connection to the PostgreSQL server.
Alerts:	Debian DSA-397-1 2003-11-07 Immunix IMNX-2003-7+-005-01 2003-04-08 Trustix 2003-0004 2003-02-20 Mandrake MDKSA-2002:062-1 2003-02-11

Comments (1 posted)

Local arbitrary code execution vulnerability in Python

Package(s):	python	CVE #(s):	CAN-2002-1119
Created:	August 28, 2002	Updated:	October 1, 2003
Description:	Zack Weinberg discovered that os._execvpe from os.py uses a predictable name which could lead to execution of arbitrary code. According to the Debian advisory, the problem was present in Python versions 1.5, 2.1 and 2.2. CAN-2002-1119
Alerts:	Red Hat RHSA-2002:202-33 2003-02-12 OpenPKG OpenPKG-SA-2003.006 2003-01-23 Red Hat RHSA-2002:202-25 2003-01-21 Mandrake MDKSA-2002:082-1 2002-12-09 Mandrake MDKSA-2002:082 2002-11-25 SCO Group CSSA-2002-045.0 2002-11-14 Trustix 2002-0073 2002-10-17 Gentoo python-20021003 2002-10-03 Conectiva CLA-2002:527 2002-10-01 Debian DSA-159-2 2002-09-09 Debian DSA-159-1 2002-08-28

Comments (none posted)

Multiple-use vulnerability in Safe.pm

Package(s):	Safe.pm	CVE #(s):	CAN-2002-1323
Created:	October 9, 2002	Updated:	February 20, 2004
Description:	usePerl has a description of a vulnerability in the Safe.pm Perl module. It seems that if a Safe compartment is used more than once, it ceases to be safe. The problem is fixed in Safe 2.08.
Alerts:	SCO Group CSSA-2004-007.0 2004-02-20 Gentoo 200212-6 2002-12-20 Trustix 2002-0087 2002-12-19 OpenPKG OpenPKG-SA-2002.014 2002-12-16 Debian DSA-208-1 2002-12-12

Comments (none posted)

slocate - buffer overflow

Package(s):	slocate	CVE #(s):	CAN-2003-0056
Created:	February 5, 2003	Updated:	May 8, 2003
Description:	version 2.6 (at least) of slocate contains a buffer overflow vulnerability which could lead to a local exploit; see this advisory for the details.
Alerts:	Conectiva CLA-2003:643 2003-05-08 SCO Group CSSA-2003-009.0 2003-03-06 Debian DSA-252-1 2003-02-21 Mandrake MDKSA-2003:015 2003-02-05 Gentoo 200302-02 2003-02-02

Comments (none posted)

File overwrite vulnerability in tar and unzip

Package(s):	tar unzip	CVE #(s):	CAN-2001-1267 CAN-2001-1268 CAN-2001-1269 CAN-2002-0399
Created:	October 1, 2002	Updated:	April 10, 2006
Description:	The tar utility does not properly filter file names containing "../", meaning that a hostile archive can, if unpacked by an unsuspecting user, overwrite any file that is writable by that user. GNU tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42 has the same vulnerability.
Alerts:	Fedora-Legacy FLSA:183571-1 2006-04-04 Red Hat RHSA-2006:0195-01 2006-02-21 Conectiva CLA-2002:538 2002-10-29 Mandrake MDKSA-2002:066 2002-10-10 Mandrake MDKSA-2002:065 2002-10-10 EnGarde ESA-20021003-022 2002-10-03 Gentoo unzip-20021001 2002-10-01 Gentoo tar-20021001 2002-10-01 Red Hat RHSA-2002:096-24 2002-09-18

Comments (1 posted)

Multiple vendor telnetd vulnerability

Package(s):	telnet Telnet netkit-telnet-ssl kerberos telnetd netkit-telnet nkitb/nkitserv/telnetd krb5	CVE #(s):
Created:	May 21, 2002	Updated:	October 5, 2004
Description:	This vulnerability, originally thought to be confined to BSD-derived systems, was first covered in the July 26th Security Summary. It is now known that Linux telnet daemons are vulnerable as well.
Alerts:	Gentoo 200410-03 2004-10-05 Yellow Dog YDU-20010810-2 2001-08-10 Yellow Dog YDU-20010810-1 2001-08-10 SuSE SuSE-SA:2001:029 2001-09-03 Slackware sl-997726350 2001-08-09 Red Hat RHSA-2001:100-02 2001-08-09 Red Hat RHSA-2001:099-09 2002-02-07 Red Hat RHSA-2001:099-06 2001-08-09 Progeny PROGENY-SA-2001-27 2001-08-14 Mandrake MDKSA-2001:093 2001-12-17 Mandrake MDKSA-2001:068 2001-08-13 HP HPSBTL0202-023 2002-02-12 Debian DSA-075-2 2001-08-14 Debian DSA-075-1 2001-08-14 Conectiva CLA-2001:413 2001-08-24 SCO Group CSSA-2001-030.0 2001-08-10

Comments (none posted)

traceroute-nanog: buffer overflow and root exploit

Package(s):	traceroute-nanog/nkitb	CVE #(s):
Created:	November 12, 2002	Updated:	February 27, 2003
Description:	Traceroute is a tool that can be used to track packets in a TCP/IP network to determine it's route or to find out about not working routers. Traceroute-nanog requires root privilege to open a raw socket. It does not relinquish these privileges after doing so. This allows a malicious user to gain root access by exploiting a buffer overflow at a later point.
Alerts:	Debian DSA-254-1 2003-02-27 SuSE SuSE-SA:2002:043 2002-11-12

Comments (none posted)

typespeed: buffer overflow

Package(s):	typespeed	CVE #(s):
Created:	January 1, 2003	Updated:	June 17, 2003
Description:	A problem has been discovered in the typespeed, a game that lets you measure your typematic speed. By overflowing a buffer a local attacker could execute arbitrary commands under the group id games.
Alerts:	Debian DSA-322-1 2003-06-16 Debian DSA-217-1 2002-12-27

Comments (none posted)

vim - modeline vulnerability

Package(s):	vim	CVE #(s):	CAN-2002-1377
Created:	January 16, 2003	Updated:	February 10, 2004
Description:	VIM allows a user to set the modeline differently for each edited text file by placing special comments in the files. Georgi Guninski found that these comments can be carefully crafted in order to call external programs. This could allow an attacker to create a text file such that when it is opened arbitrary commands are executed.
Alerts:	Conectiva CLA-2004:812 2004-02-10 Mandrake MDKSA-2003:012 2003-02-03 Yellow Dog YDU-20030127-3 2003-01-27 Gentoo 200301-13 2003-01-22 OpenPKG OpenPKG-SA-2003.003 2003-01-21 Red Hat RHSA-2002:297-17 2003-01-15

Comments (4 posted)

w3m - cross-site scripting vulnerabilities

Package(s):	w3m	CVE #(s):	CAN-2002-1335 CAN-2002-1348
Created:	February 7, 2003	Updated:	February 18, 2003
Description:	w3m is a pager with Web browsing capabilities. Two cross-site scripting (XSS) issues have been found in w3m. An XSS vulnerability in w3m 0.3.2 allows remote attackers to insert arbitrary HTML and web script into frames. Frames are disabled by default in the version of w3m shipped with Red Hat Linux. Therefore, this problem will not appear as long as users do not use w3m with the -F option, or enable frame support in either the /etc/w3m/w3mconfig or ~/.w3m/config configuration files. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-1335 to this issue. An XSS vulnerability in versions of w3m before 0.3.2.2 allows attackers to insert arbitrary HTML and web script into image attributes. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-1348 to this issue
Alerts:	OpenPKG OpenPKG-SA-2003.009 2003-02-18 Gentoo 200302-07 2003-02-17 Debian DSA-251-1 2003-02-14 Debian DSA-250-1 2003-02-12 Debian DSA-249-1 2003-02-11 Red Hat RHSA-2003:044-20 2003-02-06

Comments (none posted)

wget:directory traversal bug

Package(s):	wget	CVE #(s):	CAN-2002-1344
Created:	December 10, 2002	Updated:	October 1, 2003
Description:	Versions of wget prior to 1.8.2-4 contain a bug that permits a malicious FTP server to create or overwrite files anywhere on the local file system. FTP clients must check to see if an FTP server's response to the NLST command includes any directory information along with the list of filenames required by the FTP protocol (RFC 959, section 4.1.3). If the FTP client fails to do so, a malicious FTP server can send filenames beginning with '/' or containing '/../' which can be used to direct a vulnerable FTP client to write files (such as .forward, .rhosts, .shosts, etc.) that can then be used for later attacks against the client machine. See also this Bugtraq article from 1997. CAN-2002-1344
Alerts:	Immunix IMNX-2003-7+-011-01 2003-06-03 OpenPKG OpenPKG-SA-2003.007 2003-01-23 SCO Group CSSA-2003-003.0 2003-01-16 Gentoo 200212-7 2002-12-20 Trustix 2002-0089 2002-12-19 Conectiva CLA-2002:552 2002-12-13 Debian DSA-209-1 2002-12-12 Mandrake MDKSA-2002:086 2002-12-11 Red Hat RHSA-2002:229-10 2002-12-04

Comments (none posted)

Problems with libgtop_daemon

Package(s):	wuftpd libgtop	CVE #(s):
Created:	May 21, 2002	Updated:	May 7, 2003
Description:	The libgtop_daemon package is a GNOME program which makes system information available remotely. LWN reported the remotely exploitable format string and buffer overflow vulnerabilities in that package on December 6th. On November 28th disabling the libgtop_daemon on systems where it is running until an update is available. Many Linux systems do not run libgtop by default, but applying the update is a good idea anyway.
Alerts:	Debian DSA-301-1 2003-05-07 Mandrake MDKSA-2001:094 2001-12-19 Debian DSA-098-1 2002-01-09 Conectiva CLA-2002:448 2002-01-03

Comments (1 posted)

Wwwoffle remote privilege escalation vulnerability

Package(s):	wwwoffle	CVE #(s):	CAN-2002-0818
Created:	August 14, 2002	Updated:	October 1, 2003
Description:	The wwwoffle web proxy incorrectly processes HTTP PUT and POST requests with negative Content Length values. "It is believed that an attacker could exploit this bug to gain remote wwwrun access to the system wwwoffled is running on." CAN-2002-0818
Alerts:	SCO Group CSSA-2002-048.0 2002-11-18 Debian DSA-144-1 2002-08-06 SuSE SuSE-SA:2002:029 2002-08-01

Comments (none posted)

Resources

Egress filtering for a healthier Internet.

This issue of "Linux Security: Tips, Tricks, and Hackery" looks at egress filtering as a way of protecting the net against mass attacks.

Full Story (comments: 1)

Events

The First Honeyd Challenge

The first Honeyd Challenge has been announced along with the 0.5 release of the Honeyd virtual honeypot system. "The goal of this challenge is to develop interesting feature additions to Honeyd. Possible improvements are forensic analysis tools for Honeyd log files, passive fingerprinting of connections, realistic routing topologies, etc."

Full Story (comments: none)

ACNS 2003

The first MiAn International Conference on Applied Cryptography and Network Security will be held October 16 to 19 in Kunming, China. The submission deadline is May 1 for those who would like to present there.

Full Story (comments: none)

NSPW 2003 Call For Papers

The New Security Paradigms Workshop 2003 will be held August 18 to 21 in Ascona, Switzerland. The Call For Papers has gone out, with a submission deadline of April 4.

Full Story (comments: none)

Page editor: Jonathan Corbet

Kernel development

Brief items

Kernel release status

The current development kernel is 2.5.62, which was released by Linus on February 17. It included a new version of the dentry cache which uses read-copy-update for lockless file lookups, a number of architecture updates, some kbuild fixes (including module alias and device table support), more signal cleanup work, and (a classic sign that the freeze is progressing) lots of spelling fixes. The long-format changelog has the details.

2.5.61 was released on February 14. Changes in this release include a number of SCSI driver fixes, an x86-64 merge, a new set of AGP changes, some ACPI work, an SCTP update, and, of course, numerous other fixes. Once again, see the long-format changelog for the details.

Linus's (pre-2.5.63) BitKeeper tree contains, as of this writing, the longstanding POSIX timers patch (but without the high-resolution timers), a new set of IDE changes (see below), updates for obscure architectures (Visual Workstation, v850, m68k-nommu), an ACPI update (including the license change to dual BSD/GPL), and another big set of spelling fixes.

The current stable kernel is 2.4.20; there have been no 2.4.21 prepatches issued over the last week.

Alan Cox has released the fourth 2.2.24 release candidate.

Comments (12 posted)

Kernel development news

Synchronous signal handling

While fixing various problems in the signal handling code of recent kernels, Linus evidently decided to take a stab at the issue of signal handling races. The result was this patch implementing a prototype of a new signal handling mechanism. The idea needs some fleshing out before it might be merged into the kernel, but it has attracted a certain amount of interest among the developers.

The patch adds a new sigfd() system call:

    int sigfd(sigset_t *mask, unsigned long flags);

The system call returns a file descriptor which will report on the set of signals found in the given mask (the flags argument is not used for now). A process reading from the file descriptor will receive a structure describing one signal which was delivered to the process; it will block if there are no outstanding signals.

This approach offers some advantages. Since signals are queued up and read one at a time, they can be dealt with in an orderly manner. The user-space application need not worry about races between signal handlers and other code. The signal file descriptor can also be used with the select() and poll() system calls, allowing signal handling to be folded into application event processing loops. An application can even pass the file descriptor to another process, should there be, for some reason, a desire to let that other process listen in on the first process's signals.

There was some immediate discussion of expanding this interface into a more generic event-handling mechanism. For example, timer events, asychronous I/O events, etc. could also be delivered via the same file descriptor. Linus stated that, to an extent, expanding the interface is what the flags argument was intended for. He doesn't want to put too much into this interface, however:

Looking at the patch, a few developers commented on how much of it is really just boilerplate filesystem and inode code. It has to be there to make the file descriptor work, but really has little to do with the task at hand. Much of that code is duplicated with other subsystems which have to make "virtual" file descriptors. Davide Libenzi responded to this observation with a patch implementing a new, shared, "virtual filesystem" capability. If some variant of that patch goes in, it has the potential of ridding the kernel of a fair amount of tedious and error-prone code duplication.

Comments (none posted)

A new round of IDE patches

After a long pause, a new set of IDE patches has found its way into Linus's pre-2.5.63 BitKeeper tree. Most of these patches have been around for a while (in the 2.4-ac tree), but Alan Cox has not felt that 2.5.x was stable enough to attempt new IDE work. Now that things are working a little better, the patches are flowing again.

The new generation of IDE changes is rather more restrained than last year's "cleanup" effort. Changes that have gone in this time around include cleaning out some old data structures that were either unused or did not suit the purpose to which they were being put. Some improved locking has been put in place, and the handling of missing drives (i.e. PCMCIA drives which are removed by the user) has been improved - though work remains to be done in that area. There is also a new ide_execute_command() function which is meant to be the way commands are passed down to drives in the future. For now, though, it is only used for CD drives ("As with 2.4 I want it to run for a bit on read only media first.")

The IDE work is one of the more prominent entries remaining on the "todo" list for 2.5. Given the need to proceed slowly (it really is no fun to ship a kernel with broken IDE), this work may take some time yet. So it's good to see the patches finding their way into Linus's tree again.

Comments (3 posted)

GFP_KERNEL or SLAB_KERNEL?

The low-level kernel memory allocation functions take a set of flags describing how that allocation is to be performed. Among other things, these GFP_ ("get free page") flags control whether the allocation process can sleep and wait for memory, whether high memory can be used, and so on. See this article for the full set.

The kernel slab allocator is an additional layer built on top of the low-level code; it handles situations where numerous objects of the same size are frequently allocated and freed. The slab code, too, has a set of flags describing how memory allocation is to happen. They look suspiciously like the low-level flags, but they have different names; instead of GFP_KERNEL, for example, user of the slab code are expected to say SLAB_KERNEL.

Underneath it all, however, the two sets of flags are the same. As a result, many calls to the slab code just use the GFP_ flags, rather than the SLAB_ flags. William Lee Irwin decided it was time to fix that; he posted a patch converting several slab users over to the SLAB_ flags. It looked like a fairly standard, freeze-stage kernel cleanup.

The question came up, however: why bother? Not everybody, it seems, thinks that the separate SLAB_ flags are worth the trouble. William responded with another patch which gets rid of the SLAB_ flags altogether. So far, neither patch has been merged. But they do raise a worthwhile question: why do we need a separate set of flags if the callers have nothing different to say?

Comments (none posted)

Driver porting

New additions to the driver porting series

The LWN.net series on porting drivers (and other kernel code) to the 2.5 kernel continues this week with three new articles. Two of them (on low-level memory allocation and per-CPU variables) appear below; the third (an updated description of the seqlock mechanism) is available but won't be included inline here. As always, the full series can be found at http://lwn.net/Articles/driver-porting/.

Comments (none posted)

Driver porting: low-level memory allocation

This article is part of the LWN Porting Drivers to 2.6 series.

The 2.5 development series has brought relatively few changes to the way device drivers will allocate and manage memory. In fact, most drivers should work with no changes in this regard. There are a few improvements that have been made, however, that are worth a mention. These include some changes to page allocation, and the new "mempool" interface. Note that the allocation and management of per-CPU data is described in a separate article.

Allocation flags

The old <linux/malloc.h> include file is gone; it is now necessary to include <linux/slab.h> instead.

The GFP_BUFFER allocation flag is gone (it was actually removed in 2.4.6). That will bother few people, since almost nobody used it. There are two new flags which have replaced it: GFP_NOIO and GFP_NOFS. The GFP_NOIO flag allows sleeping, but no I/O operations will be started to help satisfy the request. GFP_NOFS is a bit less restrictive; some I/O operations can be started (writing to a swap area, for example), but no filesystem operations will be performed.

For reference, here is the full set of allocation flags, from the most restrictive to the least::

• GFP_ATOMIC: a high-priority allocation which will not sleep; this is the flag to use in interrupt handlers and other non-blocking situations.

• GFP_NOIO: blocking is possible, but no I/O will be performed.

• GFP_NOFS: no filesystem operations will be performed.

• GFP_KERNEL: a regular, blocking allocation.

• GFP_USER: a blocking allocation for user-space pages.

• GFP_HIGHUSER: for allocating user-space pages where high memory may be used.

The __GFP_DMA and __GFP_HIGHMEM flags still exist and may be added to the above to direct an allocation to a particular memory zone. In addition, 2.5.69 added some new modifiers:

• __GFP_REPEAT This flag tells the page allocater to "try harder," repeating failed allocation attempts if need be. Allocations can still fail, but failure should be less likely.

• __GFP_NOFAIL Try even harder; allocations with this flag must not fail. Needless to say, such an allocation could take a long time to satisfy.

• __GFP_NORETRY Failed allocations should not be retried; instead, a failure status will be returned to the caller immediately.

The __GFP_NOFAIL flag is sure to be tempting to programmers who would rather not code failure paths, but that temptation should be resisted most of the time. Only allocations which truly cannot be allowed to fail should use this flag.

Page-level allocation

For page-level allocations, the alloc_pages() and get_free_page() functions (and variants) exist as always. They are now defined in <linux/gfp.h>, however, and there are a few new ones as well. On NUMA systems, the allocator will do its best to allocate pages on the same node as the caller. To explicitly allocate pages on a different NUMA node, use:

    struct page *alloc_pages_node(int node_id, 
                                  unsigned int gfp_mask, 
				  unsigned int order);

The memory allocator now distinguishes between "hot" and "cold" pages. A hot page is one that is likely to be represented in the processor's cache; cold pages, instead, must be fetched from RAM. In general, it is preferable to use hot pages whenever possible, since they are already cached. Even if the page is to be overwritten immediately (usually the case with memory allocations, after all), hot pages are better - overwriting them will not push some other, perhaps useful, data from the cache. So alloc_pages() and friends will return hot pages when they are available.

On occasion, however, a cold page is preferable. In particular, pages which will be overwritten via a DMA read from a device might as well be cold, since their cache data will be invalidated anyway. In this sort of situation, the __GFP_COLD flag should be passed into the allocation.

Of course, this whole scheme depends on the memory allocator knowing which pages are likely to be hot. Normally, order-zero allocations (i.e. single pages) are assumed to be hot. If you know the state of a page you are freeing, you can tell the allocator explicitly with one of the following:

    void free_hot_page(struct page *page);
    void free_cold_page(struct page *page);

These functions only work with order-zero allocations; the hot/cold status of larger blocks is not tracked.

Memory pools

Memory pools were one of the very first changes in the 2.5 series - they were added to 2.5.1 to support the new block I/O layer. The purpose of mempools is to help out in situations where a memory allocation must succeed, but sleeping is not an option. To that end, mempools pre-allocate a pool of memory and reserve it until it is needed. Mempools make life easier in some situations, but they should be used with restraint; each mempool takes a chunk of kernel memory out of circulation and raises the minimum amount of memory the kernel needs to run effectively.

To work with mempools, your code should include <linux/mempool.h>. A mempool is created with mempool_create():

    mempool_t *mempool_create(int min_nr, 
                              mempool_alloc_t *alloc_fn,
    			      mempool_free_t *free_fn,
			      void *pool_data);

Here, min_nr is the minimum number of pre-allocated objects that the mempool tries to keep around. The mempool defers the actual allocation and deallocation of objects to user-supplied routines, which have the following prototypes:

    typedef void *(mempool_alloc_t)(int gfp_mask, void *pool_data);
    typedef void (mempool_free_t)(void *element, void *pool_data);

The allocation function should take care not to sleep unless __GFP_WAIT is set in the given gfp_mask. In all of the above cases, pool_data is a private pointer that may be used by the allocation and deallocation functions.

Creators of mempools will often want to use the slab allocator to do the actual object allocation and deallocation. To do that, create the slab, pass it in to mempool_create() as the pool_data value, and give mempool_alloc_slab and mempool_free_slab as the allocation and deallocation functions.

A mempool may be returned to the system by passing it to mempool_destroy(). You must have returned all items to the pool before destroying it, or the mempool code will get upset and oops the system.

Allocating and freeing objects from the mempool is done with:

    void *mempool_alloc(mempool_t *pool, int gfp_mask);
    void mempool_free(void *element, mempool_t *pool);

mempool_alloc() will first call the pool's allocation function to satisfy the request; the pre-allocated pool will only be used if the allocation function fails. The allocation may sleep if the given gfp_mask allows it; it can also fail if memory is tight and the preallocated pool has been exhausted.

Finally, a pool can be resized, if necessary, with:

    int mempool_resize(mempool_t *pool, int new_min_nr, int gfp_mask);

This function will change the size of the pre-allocated pool, using the given gfp_mask to allocate more memory if need be. Note that, as of 2.5.60, mempool_resize() is disabled in the source, since nobody is actually using it.

Comments (none posted)

Driver porting: per-CPU variables

This article is part of the LWN Porting Drivers to 2.6 series.

The 2.6 kernel makes extensive use of per-CPU data - arrays containing one object for each processor on the system. Per-CPU variables are not suitable for every task, but, in situations where they can be used, they do offer a couple of advantages:

• Per-CPU variables have fewer locking requirements since they are (normally) only accessed by a single processor. There is nothing other than convention that keeps processors from digging around in other processors' per-CPU data, however, so the programmer must remain aware of what is going on.

• Nothing destroys cache performance as quickly as accessing the same data from multiple processors. Restricting each processor to its own area eliminates cache line bouncing and improves performance.

Examples of per-CPU data in the 2.6 kernel include lists of buffer heads, lists of hot and cold pages, various kernel and networking statistics (which are occasionally summed together into the full system values), timer queues, and so on. There are currently no drivers using per-CPU values, but some applications (i.e. networking statistics for high-bandwidth adapters) might benefit from their use.

The normal way of creating per-CPU variables at compile time is with this macro (defined in <linux/percpu.h>):

    DEFINE_PER_CPU(type, name);

This sort of definition will create name, which will hold one object of the given type for each processor on the system. If the variables are to be exported to modules, use:

    EXPORT_PER_CPU_SYMBOL(name);
    EXPORT_PER_CPU_SYMBOL_GPL(name);

If you need to link to a per-CPU variable defined elsewhere, a similar macro may be used:

    DECLARE_PER_CPU(type, name);

Variables defined in this way are actually an array of values. To get at a particular processor's value, the per_cpu() macro may be used; it works as an lvalue, so so code like the following works:

    DEFINE_PER_CPU(int, mypcint);

    per_cpu(mypcint, smp_processor_id()) = 0;

The above code can be dangerous, however. Accessing per-CPU variables can often be done without locking, since each processor has its own private area to work in. The 2.6 kernel is preemptible, however, and that adds a couple of challenges. Since kernel code can be preempted, it is possible to encounter race conditions with other kernel threads running on the same processor. Also, accessing a per-CPU variable requires knowing which processor you are running on; it would not do to be preempted and moved to a different CPU between looking up the processor ID and accessing a per-CPU variable.

For both of the above reasons, kernel preemption usually must be disabled when working with per-CPU data. The usual way of doing this is with the get_cpu_var and put_cpu_var macros. get_cpu_var works as an lvalue, so it can be assigned to, have its address taken, etc. Perhaps the simplest example of the use of these macros can be found in net/socket.c:

	get_cpu_var(sockets_in_use)++;
	put_cpu_var(sockets_in_use);

Of course, since preemption is disabled between the calls, the code should take care not to sleep. Note that there is no version of these macros for access to another CPU's data; cross-processor access to per-CPU data requires explicit locking arrangements.

It is also possible to allocate per-CPU variables dynamically. Simply use these functions:

    void *alloc_percpu(type);
    void free_percpu(const void *);

alloc_percpu() will allocate one object (of the given type) for each CPU on the system; the allocated storage will be zeroed before being returned to the caller.

There is another set of macros which may be used to access per-CPU data obtained with kmalloc_percpu(). At the lowest level, you may use:

    per_cpu_ptr(void *ptr, int cpu)

which returns (without any concurrency control) a pointer to the per-CPU data for the given cpu. For access to a local processor's data, with preemption disabled, use:

    get_cpu_ptr(ptr)
    put_cpu_ptr(ptr)

With the usual proviso that you do not sleep between the two.

Comments (none posted)

Patches and updates

Kernel trees

• Martin J. Bligh: 2.5.61-mjb1 (scalability / NUMA patchset). (February 18, 2003)

• Martin J. Bligh: 2.5.62-mjb1 (scalability / NUMA patchset). (February 18, 2003)

• Stephen Hemminger: 2.5.62-dcl2. (February 19, 2003)

• Alan Cox: Linux 2.2.24-rc3. (February 14, 2003)

• Andrea Arcangeli: 2.4.21pre4aa2. (February 14, 2003)

• Andrea Arcangeli: 2.4.21pre4aa3. (February 15, 2003)

Core kernel code

• Dominik Brodowski: cpufreq: move frequency table helpers to extra module. (February 13, 2003)

• Dominik Brodowski: cpufreq: move frequency table helpers to extra module. (February 13, 2003)

• Ed Tomlinson: (0-2) governors for 60-bk. (February 13, 2003)

• Ed Tomlinson: (1-2) governors for 60-bk. (February 13, 2003)

• Ed Tomlinson: (2-2) governors for 60-bk. (February 13, 2003)

• Linus Torvalds: Synchronous signal delivery... (February 14, 2003)

• Martin J. Bligh: percpu load avererages / *real* load averages. (February 14, 2003)

• Rusty Russell: Per-CPU variables for modules. (February 18, 2003)

• Zwane Mwaikambo: RCU callback offload queue. (February 18, 2003)

• Andy Pfiffer: [KEXEC][2.5.61][2.5.62] Untested patches available. (February 18, 2003)

Development tools

• Tim Schmielau: make jiffies wrap 5 min after boot. (February 16, 2003)

• Con Kolivas: contest v0.61 benchmark. (February 18, 2003)

• Tomas Szepe: morse code panics for 2.5.62. (February 18, 2003)

• Paul Larson: 2.5 kernel errata list. (February 18, 2003)

• Pavel Machek: accessing bitkeeper without bitkeeper. (February 19, 2003)

• Linus Torvalds: doublefault debugging . (February 20, 2003)

Device drivers

• Rusty Lynch: Proposal for a new watchdog interface using sysfs. (February 13, 2003)

• David Dillow: 3Com 3cr990 driver release. (February 18, 2003)

• Greg KH: USB changes for 2.5.62. (February 19, 2003)

Filesystems and block I/O

• Jens Axboe: CFQ scheduler, #2. (February 14, 2003)

• Hans Reiser: ReiserFS CPU efficient large writes for 2.5. (February 18, 2003)

• Davide Libenzi: Virtual filesystem support. (February 18, 2003)

Janitorial

• William Lee Irwin III: clean up SLAB_KERNEL non-usage. (February 18, 2003)

• William Lee Irwin III: Kill SLAB_KERNEL and SLAB_ATOMIC.. (February 18, 2003)

Memory management

• Andrew Morton: 2.5.60-mm2. (February 14, 2003)

• Andrew Morton: 2.5.61-mm1. (February 15, 2003)

• Andrew Morton: 2.5.62-mm1. (February 18, 2003)

Networking

• YOSHIFUJI Hideaki / USAGI Project: USAGI STABLE RELEASE 4.1. (February 14, 2003)

• Bruce Allan: subset of RFC2553. (February 18, 2003)

• Shirley Ma: new release for dhcpv6 is available (ver 0.2). (February 18, 2003)

• Kazunori MIyazawa: IPv6 IPsec support. (February 19, 2003)

Architecture-specific

• Suparna Bhattacharya: Modified (smaller) x86 kexec hwfixes patch. (February 13, 2003)

• Dave Hansen: x86 early boot ioremap. (February 13, 2003)

Security-related

• Greg KH: LSM changes for 2.5.62. (February 20, 2003)

Benchmarks and bugs

• Aniruddha M Marathe: 2.5.60 Lmbench performance. (February 13, 2003)

• Aniruddha M Marathe: TIObench 2.5.60 performance. (February 13, 2003)

• Sowmya Adiga: AIM9 benchmark result for kernel 2.5.60.. (February 13, 2003)

• Sowmya Adiga: AIM9 benchmark result for kernel 2.5.62.. (February 18, 2003)

• Sowmya Adiga: unixbench result for kernel 2.5.60.. (February 13, 2003)

• Sowmya Adiga: unixbench result for kernel 2.5.62.. (February 18, 2003)

• Con Kolivas: 2.5.61 with contest. (February 15, 2003)

• Con Kolivas: cfq3a i/o scheduler with contest. (February 15, 2003)

• Con Kolivas: 2.5.61-mm1 +/- as or cfq with contest. (February 18, 2003)

Miscellaneous

• Matthias Andree: lk-changelog.pl 0.73. (February 14, 2003)

• Greg KH: klibc for 2.5.62. (February 19, 2003)

Page editor: Jonathan Corbet

Distributions

News and Editorials

A Knoppix for the masses FAQ

Karsten M. Self has burned a spool of CDs with the v3.1 1-2003-20-EN Knoppix release, and he's been passing them out to masses. Now he would like some input on packaging and especially on a FAQ to go with the CD. There is a version of the FAQ in the story below, and an updated FAQ here.

Full Story (comments: none)

Distribution News

Debian GNU/Linux

Here is the Debian Weekly News for February 11, 2003. This issue covers GNOME and KDE participation in the Free Desktop Project, the Turbo Desktop Environment aimed at users with older computers who still want to run a proper desktop, and much more.

Four candidates have been nominated for Debian Project Leader; Moshe Zadka, Bdale Garbee, Martin Michlmayr and Branden Robinson. Platforms for these candidates can be found here. The campaigning period will last until March 7, when voting will begin.

Here's a note about the Debian Project's participation in the Desktop Linux Summit, February 20 - 21, 2003.

The results of the Debian security survey (which tried to get a handle on how long Debian 'potato' users needed security updates) have been released. The end result seems to be that potato will continue to have security updates through the end of June.

The Debian Weekly News for February 17, 2003 is available. In addition to the FLOSS report sponsored by the European Commission, researchers at Stanford University's Institute for Economic Policy Research designed another survey and asked the community for its assistance. If you have ever wondered whether (GNU/)Linux was the only new and free operating system recently begun, take a look at ReactOS, which aims to implement a free version of NT.

Comments (none posted)

Gentoo Linux

Here's the Gentoo Weekly Newsletter for February 17, 2003. This week: Catch Gentoo Zetagrid fever; New rsync mirrors; Gnome 2.2 now in Portage; and more.

If you've had trouble installing the latest KDE packages you'll be interested in this fix (bug #15593).

Comments (none posted)

Lycoris Linux available at Walmart

Lycoris has sent out an announcement stating that a boxed set with the Lycoris Desktop/LX distribution is now available via Walmart.com. The "ProductivityPak" and "GamePak" packages are also available.

Full Story (comments: none)

Red Hat Linux

Red Hat has released an updated version of Phoebe, the latest Red Hat Linux beta. The release updates the kernel and glibc. Phoebe also has GNOME 2.2, KDE 3.1 and "many many many many bugfixes".

Full Story (comments: 2)

Slackware Linux

The slackware-current change log shows an upgrade to linux-2.4.20, and a few installer changes, among many others.

Comments (none posted)

Trustix Secure Linux

Trustix has released Trustix Secure Linux 2.0 Techology Preview 2 nicknamed Forecast. "Being a technology preview it is not suitable for production use nor to be considered maintained regarding security. We release this distribution to give you a chance to test and comment on it before it evolves into TSL 2.0. We also wish to thank those who tested and gave us valuable feedback on the previous technology preview."

Full Story (comments: none)

SCO Linux

The SCO Group has announced that SCO Linux 4.0, powered by UnitedLinux, has been certified with the latest edition of IBM DB2, Version 8.1.

Comments (none posted)

New Distributions

Freeduc

The Organization for Free Software in Education and Teaching (OFSET) has produced Freeduc, a Knoppix/Debian-based Linux system with educational software, all on one bootable CD-ROM. Version 1.1 of the Freeduc CD-ROM was released November 5, 2002. Freeduc has joined the Education section of the Distributions list.

Comments (none posted)

Minor distribution updates

2-Disk Xwindow embedded Linux

2-Disk Xwindow embedded Linux has released v1.0.0 (Source code). This is the first source release.

Comments (none posted)

Astaro Security Linux

Astaro Security Linux has released stable 4.000 with major feature enhancements. "Changes: The key features of this release are heuristic spam protection, PPPoE and PPPoA DSL dial-up, faster and enhanced WebAdmin, LDAP user authentication, NAT traversal for IPSec, dynamic filtering per VPN tunnel, a transparent POP3 Proxy with optional virus protection, VLAN (802.1q), and wireless LAN (802.11b)."

Comments (none posted)

LEAF

LEAF (Linux Embedded Appliance Firewall) has released Bering 1.1 with minor feature enhancements. "Changes: Includes a 2.4.20 kernel patched with grsecurity 1.9.9c, the latest version of Shorewall (1.3.14), and a patched version of IPSec (Freeswan 1.99) with x509 support, NAT-Traversal, and Notify/delete. Shorewall output is now logged through the ulogd netfilter daemon."

Comments (none posted)

Fli4l (Floppy ISDN/DSL)

Fli4l (Floppy ISDN/DSL) has released development version 2.1.2 with minor bugfixes. "Changes: The kernel is now compiled with GCC 2.95.4, removing the incompatibilities which resulted when it was compiled with GCC 2.96 (RedHat). Several minor bugfixes were also made."

Comments (none posted)

floppyfw

floppyfw has released development version 2.9.1 with major feature enhancements. "Changes: This version now uses uClibc. Traffic shaping and bridging utilities are now in the base package, and the PPP(oE) version fits on a 1.44MB floppy."

Comments (none posted)

LRs-Linux

LRs-Linux has released v0.3.1-rc2 with minor bugfixes.

Comments (none posted)

uClinux

uClinux has released v2.5.61-uc0 with minor feature enhancements. "Changes: Many small fixes to the latest development kernel."

Comments (none posted)

Distribution reviews

Lindows at the Showdown (OfB.biz)

Open for Business continues the Penguin Shootout with a look at Lindows. "Lindows is a rather polarizing distribution in many ways. For the most part, people either love it or hate it, both for the company's attitude and the distribution itself. We'll consider that in a bit, but first comes the question of how it stacks up to other distributions technically."

Comments (none posted)

Mandrake PPC 9.1 Beta 2 review (DistroWatch)

Distrowatch.com has a series of reviews of Mandrake 9.1 beta releases. Here is the review for Mandrake PPC 9.1 Beta 2. "The iMac did not feel slow at any time during my testing (this is a totally subjective opinion, but I have low tolerance for unresponsive systems). Sure, my 1.4GHz Athlon XP with DDR 333 SDRAM feels faster, but the difference in performance was much less than I expected. To me, this was a good surprise: I thought I had a computer destined to my private electronic cemetery, but I have changed my mind. I'll have a fully functional backup GNU/Linux workstation when Mandrake releases the final version of Mandrake PPC 9.1."

Comments (none posted)

Page editor: Rebecca Sobol

Development

The Plone Information Management System

Version 1.0 of the Plone Information Management System has been announced, Version 1.0.1 was released on February 17, 2003.

Plone is built on top of the Zope web application server and Zope's content management system. According to the Plone web site: "Plone is ideal as an intranet server, as a document publishing system and as a groupware tool for collaboration between separately located entities. A versatile software product like Plone can be used in a myriad of ways." Plone works on top of Linux, Windows, Mac OSX, and other Unix varients.

Plone has administrative workflow, multimedia, metadata, integrated search, and a standards-compliant templating system. Add-ons to plone provide integration with Microsoft Word, OpenOffice, PDF generation, and versioning.

One important emphasis in the design of Plone has been to achieve a quick and easy installation experience. Also, "the focus of Plone is to provide value at every level of an organization." To see what people are doing with Plone, take a look at the Plone Sites page. The main Plone Site is also running under Plone.

Plone is being developed by the non-profit organization, Plone International. The software is dual-licensed, it is available under the GPL and a commercial license.

More information can be found on the Plone Documentation page, and in the The Plone Book. If you are interested in helping out with Plone, the Development Overview is a good place to start.

Comments (4 posted)

System Applications

Audio Projects

Ogg Traffic

The February 17, 2003 edition of Ogg Traffic is out with the latest Ogg Vorbis audio compression software news. Discussion topics include: Vorbis on Playstation 2, Speex ACM Codec, Recent Developments, Icecast Goodies, application/ogg blessed by IANA, and New Software.

Comments (none posted)

Electronics

gEDA News

The latest new software from the gEDA project includes GTKWave 2.0.0pre3-20030217, Icarus Verilog 20030216, and Gerber Viewer 0.12.

Comments (none posted)

Printing

OMNI version 0.7.3 released

Version 0.7.3 of the OMNI printer driver is available. Features include support for 461 printers, better CUPS integration, more XMLDevice fixes, unified jop properties specification on the command line, initial debian package building support, and more. See the Changelog file for details.

Comments (none posted)

PyKota 0.95 released

Version 0.95 of PyKota has been released. "PyKota is a complete Print Quota system for the Common UNIX Printing System (aka CUPS), which works by directly querying the printers for the number of pages they have printed."

Comments (none posted)

LinuxPrinting.org news

The latest headlines on LinuxPrinting.org include: More than 1000 printers on linuxprinting.org!, HPIJS 1.3.1 is released!, and new support for the Epson Stylus Photo 900 and several Kyocera printers.

Comments (none posted)

Web Site Development

Nemein.Net 1.8.4 released

Version 1.8.4 of Nemein.Net, a browser-based Professional Services Automation solution, is available. "The new release makes major functionality additions to the Project tracking system. These additions include automatic generation of reference lists based on project data, mileage and expense reporting and new configurable reporting engine."

Full Story (comments: none)

Zope Corporation Releases Zope 2.6.1

Zope Corporation has announced the release of Zope 2.6.1, the latest version of the open source application server. The new release represents the successful global collaboration of community developers, as it is the first to contain a majority of enhancements from the Zope community.

Full Story (comments: none)

Zope Members News

The most recent headlines on the Zope Members News include: DocmaServer 0.2 released, ZAttachmentAttribute released - Word, PDF, files into your own type, Plone Minimal Product released, Group User Folder Released, ZCybermut 1.0 Release, The Plone Team Releases Plone 1.0 - Professional Open Source System For Managing Content, French Zope Hosting, FDFToolkit for Adobe e-forms released, Pholder 1.0 beta3 released, and NZO pre-alpha and Call for volunteers.

Comments (none posted)

Miscellaneous

Twisted 1.0.3 released

Version 1.0.3 of the Twisted networking framework is available with a number of new features and bug fixes.

Full Story (comments: none)

Experienced-Based Language Acquisition

Brian E. Pangburn has announced an interesting open-source computer language acquisition project known as EBLA. "Experience-Based Language Acquisition (EBLA) is an open source software system that enables a computer to learn simple language from scratch based on visual perception. It is the first "grounded" language system capable of learning both nouns and verbs. Moreover, once EBLA has established a vocabulary, it can perform basic scene analysis to generate descriptions of novel videos."

Full Story (comments: none)

Desktop Applications

Audio Applications

Ardour developments

The latest developments to the Ardour multi-track audio hard disk recorder include: support for multichannel regions, a much better BBT ruler, improvements to the internal selection mode code, pan automation, a greatly improved algorithm for automation curve display, and mostly-working automation line editing.

Comments (none posted)

ecasound 2.2.1 released

Version 2.2.1 of ecasound, a multi-track audio processor utility, has been released. "The JACK slave mode code has been completely rewritten. As a new feature it is now possible to use libsamplerate for resampling. Using JACK has been made more user-friendly as ecasound can now automatically configure the runtime parameters to match the current server settings. And thanks to build system and signal handling updates, it's now possible to compile ecasound for win32 under Cygwin."

Full Story (comments: none)

JACK Rack 1.4.0 released

Version 1.4.0 of Jack Rack is out. This version adds the ability to right click on some of the controls.

Full Story (comments: none)

Desktop Environments

FootNotes

Headlines on the GNOME desktop FootNotes site include: GNOME 2.2 backport for Debian Woody available for download, Announcing GU4DEC - June 16th-18th Dublin, Ireland., Bitstream Vera Fonts 1.0 beta released, An epiphany in browsing, MrProject 0.9 released, gNumExp 0.6 released, Drop shadow madness, GNOME 2.2 Desktop Accessibility Guide, GNOME Users And Developers Italian Conference, Last GFileRunner Release - v0.3.5, Gnome Remote Connection Manager, and more.

Comments (none posted)

KDE-CVS-Digest

The February 14, 2003 edition of the KDE-CVS-Digest is out with the following topic summary: "Many improvements in the development tools this week. In Kdevelop, work continues on code completion and new code templates. Quanta gets ktips and finishing polishes. Kate, Cervisia, KBabel and Umbrello continue to get better. Support for new XFree86 features are being implemented. And nothing like a gathering of developers to improve the games!"

Comments (none posted)

Graphics

Gimp 1.3.12 released

Development version 1.3.12 of the Gimp, a powerful image editing package, has been released. "This release features lots of cleanups to GIMP internals such as the undo system and the tools framework. New plug-ins (psd-save and spheredesigner) have been added along with a display filter that simulates color-deficient vision. The text tool has been improved and support for large swap files (>2GB) was added."

Comments (none posted)

GUI Packages

FLTK Developments

The latest new software for FLTK, the Fast, Light ToolKit includes: Fltk 1.1.XX utf-8 patch, flxine 0.6.1, fl_connect 1.0, and FLTK 1.1.3.

Comments (none posted)

Interoperability

Wine Weekly News

Issue #157 of the Wine Weekly News is out. Topics include: News: Linux Desktop Consortium, Code to Test / Learn With, Clipboard Implementation, Smatch, and Testing for Unimplemented Functionality.

Comments (none posted)

Office Applications

Kernel Cousin GNUe

Issue #68 of Kernel Cousin GNUe is out with the latest GNU Enterprise development news. Topics include: The eGovOS conference and Microsoft "Shared Source", Generating PDF output from GNUe Reports, Business Objects in Application Server, Getting started with GNUe Forms, GNUe and Double Chocco Latte, and Breaking CVS HEAD to add new UI support to Forms.

Comments (none posted)

AbiWord Weekly News

Issue #131 of the AbiWord Weekly News is out, with the latest AbiWord word processor development news. "Raphael Finkel pops in with a HowTo on translating AbiWord into other languages. Sam tells us a fix for people experiencing weird fonts where they weren't expected. The wrapper script used in POSIX compliant operating systems may finally be on its way to retirement. On a unixy note, Frank's put together a special package OS X users might be interested (you could help take over for Hub and his busted laptop if you prove your worth), and.... Johnny Lee whoops some buggy A*"

Comments (none posted)

Web Browsers

Galeon 1.2.8 and 1.3.2 released!

Versions 1.2.8 and 1.3.2 of Galeon, a minimalist web browser, have been released. "They both support Mozilla 1.3b, the latest release (and Galeon 1.3.x requires at least Mozilla 1.3a) and feature bug fixes and 1.3.x also has some nice new features. In the interest of brevity, the release notes can be found with the files in our sourceforge area; just click on the stable and development links in the top right of the website. We currently have source tarballs up with rpms on the way. Enjoy!"

Comments (none posted)

Netscape 7.02 released

Version 7.02 of Netscape is available. According to Mozilla.org: "Netscape Communications Corporation has released Netscape 7.02, a minor update with security and stability fixes. This new version, is based on Mozilla 1.0.2, also features updated Java and Flash plug-ins for Windows."

Comments (none posted)

mozillaZine

The latest mozillaZine topics include: Former Galeon Maintainer Starts New Epiphany Browser Project, MozillaZine Readers Tell Us Which Mozilla Components They Use, Netscape 7.02 Released, Galeon 1.2.8 and 1.3.2 Released, Help Keep MozillaZine in Business, Geneva Tax Authorities Distribute Mozilla 1.2.1 to Taxpayers, Marc Andreessen Praises Mozilla, and Performance Comparison of Mozilla 1.3 Beta and Safari v60.

Comments (none posted)

Miscellaneous

Bluefish 0.9 released

Version 0.9 of the Bluefish HTML editor has been released. "Many bugfixes are fixed; several segfaults, and many small annoying bugs. Major performance improvements; highlighting performance improvements up to 50X faster in some cases, file loading times are faster, and loading and closing of many documents is much faster (tested with 3500 documents opened simultaneously). Many improvements for the user interface; much more compliant to the Gnome usability guidelines. And new features! Finally line number support, a new spell checker, and many more."

Comments (none posted)

Languages and Tools

Caml

Caml Weekly News

The February 11-18, 2003 edition of the Caml Weekly News is out. Topics include: CamlAgent 0.1, Optimizing false polymorphic local functions, and Any idea about Ocaml 3.07 release date?.

Full Story (comments: none)

Java

Blackdown J2SE 1.4.1-01 for i386 and SPARC

The Blackdown Java-Linux Team has announced the availability of the Java 2 Standard Edition v1.4.1-01 for Linux on ix86 and SPARC.

Full Story (comments: 4)

Static Analysis with PMD (O'Reilly)

Tom Copeland looks at PMD on O'Reilly. "PMD is a utility for finding problems in Java code. PMD does this using static analysis; that is, analyzing the source code without actually running the program. PMD comes with a number of ready-to-run rules that you can run on your own source code to find unused variables, unnecessary object creation, empty catch blocks, and so forth."

Comments (none posted)

Lisp

Maxima 5.9.0 released

Version 5.9.0 of Maxima, a Common Lisp system for performing computer algebra, has been released: "this version provides ANSI Common Lisp compatibility, a new build system, a new user manual, an enhanced command line interface, improved (X)Emacs modes, enhanced numerical precision of some functions, several bug fixes, and more."

Full Story (comments: none)

Perl

This Week on perl5-porters (use Perl)

The February 10-16, 2003 edition of This Week on perl5-porters is out. Topics include: lvalue length, Unexpected scientific notation, gzipped modules, The -C Unicode switch, and Namespace pollution.

Comments (none posted)

This week on Perl 6 (O'Reilly)

The February 6, 2003 edition of This week on Perl 6 is out with the latest Perl 6 news. Topics include: The 2004 Performance challenge, More Parrot Objects, Bytecode Metadata, Multi programming language questions, Random questions, A Scheme for extending core.ops, Week of the alternative runloops, Shortcut ?=, Language Discussion Summaries, Newline as a statement terminator, Arrays vs. Lists, and Announcements, Acknowledgements and Trip Planning.

Comments (none posted)

Module::Build (O'Reilly)

Dave Rolsky writes about Module::Build and ExtUtils::MakeMaker on O'Reilly. "If you've ever created a Perl module for distribution on CPAN, you've used the ExtUtils::MakeMaker module. This venerable module goes back to the dawn of modern Perl, which began with the release of Perl 5.000. Recently, Ken Williams has created a potential replacement for ExtUtils::MakeMaker called Module::Build, which was first released in August of 2002."

Comments (none posted)

PHP

PHP Weekly Summary

Topics on this week's PHP Weekly Summary include: sybase_ct batch query, Full list of PHP functions, File IO with Solaris, Building from CVS, MySQL for PHP 5, Filterless Apache 2, and file() extended.

Comments (none posted)

Python

Dr. Dobb's Python-URL! - weekly Python news and links (Feb 17)

The Dr. Dobb's Python-URL! for February 17, 2003 is out with the latest Python news.

Full Story (comments: none)

The Daily Python-URL

This week's Daily Python-URL article topics include: Python Package Index (PyPI) now on python.org, twander, FDFToolkit for Python, Qt and PyQt, Python - Scripting power for Java, Zope is a Jolt finalist, A conversation with Guido van Rossum, part VI: Designing with the Python community, xfmllib, Can Parrot run Python code faster than Python itself?, XML Matters: reStructuredText, and more.

Comments (none posted)

Qt and PyQt (IBM developerWorks)

Boudewijn Rempt and David Mertz write about Qt and PyQT. "The Qt toolkit is a widely-used cross-platform GUI toolkit, available for Windows, Linux, Mac OSX, and handheld platforms. QT has a well-structured, but flexible, object-oriented organization, clear documentation, and an intuitive API. In this article, David Mertz and Boudewijn Rempt look at the Qt library, with a focus on the PyQt bindings that let Python programmers access Qt functionality."

Comments (none posted)

Ruby

The Ruby Weekly News

Topics on this week's Ruby Weekly News include: Supporting windows through C extensions, and Lexical scope and closures.

New Ruby software includes: Ruby-freedb 0.5. FreeType2-Ruby 0.1.0, MusicBrainz-Ruby 0.1.0, FormValidator 0.1.0, Test::Unit 0.1.8, Flash and Ruby GUI prototype, DBD-Google-Ruby, PLRuby 0.3.3, Joystick-Ruby 0.1.0, sys-cpu 0.2.0, net-pingsimple 0.2.0, and REXML 2.5.4.

Comments (none posted)

The Ruby Garden

New topics on the Ruby Garden include: Extension of thread scheduling in rb_thread_schedule(), and Require quirks.

Comments (none posted)

Scheme

Scheme Weekly News

The February 17, 2003 edition of the Scheme Weekly News is out with lots of Scheme language news.

Full Story (comments: none)

Tcl/Tk

Dr. Dobb's Tcl-URL! - weekly Tcl news and links (Feb 17)

The February 17, 2003 edition of Dr. Dobb's Tcl-URL! is out with the latest Tcl/Tk development news.

Full Story (comments: none)

XML

Simple XML Processing With elementtree (O'Reilly)

Uche Ogbuji introduces elementree on O'Reilly. "Fredrik Lundh, well known in Python circles as "the effbot", has been an important contributor to Python and to PyXML. He has also developed a variety of useful tools, many of which involve Python and XML. One of these is elementtree, a collection of lightweight utilities for XML processing."

Comments (none posted)

Building Metadata Applications with RDF (O'Reilly)

Bob DuCharme talks about the Python RDFlib on O'Reilly. "The first time I tried the RDFLib Python libraries, the lightbulb finally flashed on. RDFLib lets you generate, store, and query RDF triples without requiring you to ever deal directly with the dreaded RDF/XML syntax. And you can do all this with a minimal knowledge of Python."

Comments (none posted)

XML at Five (O'Reilly)

Edd Dumbill writes about five years of XML development. "To celebrate this auspicious anniversary, I asked some XML old-hands and friends of XML.com to comment on their experience with XML over the last five years. Read on for their entertaining, illuminating and thought-provoking comments."

Comments (none posted)

EXSLT by example

Uche Ogbuji explains EXSLT on IBM's developerWorks. "Community standards have had a very important role in XML technology, from SAX to RDDL. The most important community standard for XSLT is the EXSLT initiative for standard extension functions and elements. In this article, Uche Ogbuji uses practical examples to introduce and demonstrate some useful EXSLT functions."

Comments (none posted)

Miscellaneous

Jext Linux Screenshots

A number of new screenshots showing the Jext programmer's editor running on Linux, are now available.

Comments (none posted)

Page editor: Forrest Cook

Linux in the news

Recommended Reading

Data Flood Feeds Need for Speed (Wired)

Wired covers an international team of physicists who set a world record for the amount and speed of data transferred over a broadband network. "Data was transmitted by packets called jumbo frames, which are 9,000 bytes -- six times as big as the packets normally sent over the Internet. The team used PCs running Debian GNU/Linux in Amsterdam and RedHat Linux in Sunnyvale."

Comments (none posted)

Asian Open Source Centre launched (Bioinformatics.org)

Bioinformatics.org has an announcement for a new Asian open-source software site. "Asian Open Source Centre is promoting free software and open source use in Asia, especially related to the locale. The centre focuses on open source issues specific to Asia, such as localization of software, open source for creating local content, and the use of open source to bridge the 'digital divide'. AsiaOSC also has a Wiki on open source."

Comments (none posted)

Xbox Linux group seeks Microsoft seal (News.com)

News.com reports on an open letter to Microsoft from the Xbox Linux Project. "'Because of Microsoft's deliberate design choices in terms of restricting the software that may run on an unmodified Xbox to 'Microsoft approved only,' coming to ask Microsoft, and presumably paying Microsoft, is currently the only way we can get our port of the GNU/Linux OS to interoperate with an unmodified box,' the letter says."

Comments (14 posted)

Trade Shows and Conferences

It's Time for CodeCon 2.0 (Linux Journal)

Linux Journal plugs CodeCon 2.0. "CodeCon is back. CodeCon 2.0, brought to you by San Francisco Bay Area technologists Bram Cohen and Len Sassaman, is a unique conference that showcases active, working software development projects, presented by the actual code developers at the very sensible hour of 12 noon."

Comments (none posted)

About Fosdem (Linux Journal)

Here is Linux Journal's wrap-up of FOSDEM. "The event itself typically is developer-centric. People speak about the innerworkings of their software, offer a presentation on how to use it in other products or sit behind a table all day answering thousands of questions from the crowd. For this reason, I wouldn't recommend complete newbies come to Fosdem, as the technical level is quite high. Most of the sessions, though, are fairly comprehensible even by non-developers."

Comments (none posted)

Companies

IBM taps suite for Linux PDA designs (News.com)

News.com reports that IBM has licensed Trolltech's Qtopia software suite for use in a new Linux PDA design kit due next month. "The design kit will include the blueprints and software necessary to help individuals or companies create several different kinds of personal digital assistants based on the Linux operating system. The kit can also be used by software makers interested in creating applications for the PDAs. It will be available for $1,000 from IBM Microelectronics and a few partners in March, the company has said."

Comments (none posted)

Linux Backers To Put OS Through Security Certification (TechWeb)

TechWeb looks at security certification plans. "Oracle, Red Hat, and IBM have all announced plans to put Linux through its security paces -- specifically through the Common Criteria certification process -- in an effort to win approval for using Linux among both government and private-sector clients." Here is IBM's press release.

Comments (1 posted)

Linux Adoption

Ten Good Reasons for a DBMS Strategy Re-Think (Open)

Open gives ten good reasons to consider using open-source database systems. "In a go-slow economy, CIOs are under pressure to leave no old assumptions unexamined, including their choice of database systems. As ubiquitous, 24 x7 e-business and demand for instantly updated information only heighten the focus on good database planning, CEOs and CFOs are questioning if it's worth paying steep licensing fees and support costs."

Comments (1 posted)

Interviews

Grid guru: An interview with Argonne's Steve Tuecke (IBM developerWorks)

IBM's developerWorks features an interview with Steve Tuecke on the topic of grid computing. "Although scientists have been using Grid technologies since the Condor project began scavenging up idle computer cycles at the University of Wisconsin in the mid-1980s, the really exciting vision of Grid computing -- a set of open and ubiquitous standards that real world developers will use for distributed computing -- remains a vision of the future. One of the people most actively involved in making that vision a reality is Steve Tuecke, lead software architect in the Distributed Systems Laboratory at Argonne National Laboratory and lead architect of the Globus Toolkit, the popular implementation of the OGSA (Open Grid Services Architecture) middleware standards that are the basis of Grid computing."

Comments (none posted)

Resources

Jay Beale - Linux Guru (Information Security Magazine)

Jay Beale has a new column called Linux Guru in Information Security Magazine. The first one attempts to answer the questions, "How can I determine if my Linux server has been hacked? How can I be sure that I haven't been hacked?" "Really, the secret is to avoid compromise. Harden systems before deployment, keep up with patches, and design a strong host and network architecture. Then start building your own digital and human baselines to make intrusion detection easier. It's a bit of upfront work, but it's less hassle than recovering from a bad compromise later."

Comments (none posted)

BASIC programming with Unix (LinuxFocus)

Linux Focus looks at BASIC programming. "If we try to make an inventory of the number of BASIC available for Linux, we can find about half a dozen of projects, more or less advanced. There is a "Basic Foundry" in sourceforge to give a classification on the number of downloads..." Thanks to Ashwin N

Comments (none posted)

Reviews

Colorful KDE 3.1 Performance On Low-End Hardware (LinuxPlanet)

LinuxPlanet reviews KDE 3.1, using a very old computer. "People have become accustomed to the convenience and beauty of the modern desktop. However, some people shy away from packages like KDE 3.1 because they think it's going to run like frozen molasses on their six-year-old Pentium machine. Let me put your fears at ease and tell you how it works on ancient iron."

Comments (1 posted)

Miscellaneous

Dave Stutz is a free man (Doc Searls' blog)

Doc Searls looks at the retirement of Microsoft employee Dave Stutz. "This is a serious development. Dave has been the bearded open source community insider at Microsoft for a long time: a good and honorable man who for years did an amazing job of bridging two worlds -- commercial and noncommercial, Microsoft and everybody else." Thanks to Jay R. Ashworth

Comments (none posted)

Page editor: Forrest Cook

Announcements

Non-Commercial announcements

Lisp guru makes awards finalist list

Bruno Haible was among the top three finalists for the 2002 Free Software Awards. Thanks to Paolo Amoroso.

Full Story (comments: none)

Commercial announcements

Eridani Star Systems MailStripper Pro 0.93 released

Eridani Star Systems has announced a new version of MailStripper, an anti-spam mail scanner with anti-virus capability. MailStripper is intended to be Mail Transfer Agent (MTA) independent and aims to work with any SMTP-based MTA as it works by filtering the incoming SMTP stream.

Full Story (comments: none)

Motorola announces Linux handset

Motorola has announced what it claims is the first handset running Java and Linux. "The A760 is Motorola's first handset demonstrating the company's commitment to making the Linux operating system a key pillar of its handset software strategy. The strategy fosters innovative applications, which helps lead to increased revenue and differentiation opportunities for operators around the globe." Unless you live in the Asia/Pacific region, however, you will have to wait a while before you can get your hands on one.

Comments (3 posted)

Sourcefire gets $11 Million investment

Perhaps some money is slowly flowing back into the tech industry; SourceFire, which is selling a product built around the free Snort intrusion detection system, has announced the receipt of $11 million in venture funding.

Comments (none posted)

Sun Microsystems Laboratories Contributes XACML Security Standard

Sun Microsystems, Inc. has announced the release of its implementation of the new XACML OASIS Open Standard for security under an open source (BSD-style) license.

The OASIS interoperability consortium has announced that its members have approved the Extensible Access Control Markup Language (XACML) as an OASIS Open Standard.

Comments (none posted)

Resources

3-in-1: Mini Book Reviews (Linux Journal)

Linux Journal reviews three books: "Extending and Embedding Perl", "LDAP Programming, Management and Integration", and "An Introduction to Programming in Emacs Lisp, 2nd Edition".

Comments (none posted)

Upcoming Events

Linux Summit 2003 and press conference

The Linux Summit 2003 happens February 27 - 28, 2003 in Espoo Finland. At the Summit, attendees will learn why Linux has become a hot topic within the IT industry.  Using examples from real life, the Linux Summit 2003 will demonstrate why businesses are increasingly embracing Linux and Open Source software.

Full Story (comments: none)

PyCon 2003

PyCon 2003, a community-oriented Python conference, will be held in Washington, DC on March 26-28, 2003.

Full Story (comments: none)

First OpenOffice.org Conference

The First OpenOffice.org Conference will be held in Hamburgh, Germany on March 20-21, 2003.

Full Story (comments: none)

KDE at Paris Solutions Linux 2003

KDE.org reports on the KDE activity at the Solutions Linux 2003 show which was held in Paris.

Comments (none posted)

GUADEC 2003 to Attract Global Audience of GNOME Developers and Enthusiasts

Here is an announcement for the fourth annual GNOME User and Developer European Conference (GUADEC), to be held at Trinity College in Dublin, Ireland, June 16 - 18, 2003.

Comments (none posted)

CFP Stockholm Perl Mongers (use Perl)

Use Perl mentions the resurrection of the Stockholm Perl Mongers group.

Comments (none posted)

New Security Paradigms Workshop 2003 CFP

A Call For Papers has been sent out for the New Security Paradigms Workshop 2003, to be held in Ascona, Switzerland on August 18-21, 2003. Papers are due in by June 10.

Full Story (comments: none)

Events: February 20 - April 17, 2003

Date	Event	Location
February 20 - 21, 2003	Desktop Linux Summit	(Vivendi Universal Building)San Diego, CA
February 22 - 24, 2003	CodeCon 2.0	(Club NV)San Francisco CA, USA
February 27 - 28, 2003	Linux Summit 2003	(Dipoli Conference Center)Espoo, Finland
March 17 - 19, 2003	Open Source for National and Local eGovernment Programs in the U.S. and EU	(The Marvin Center Grand Ballroom, George Washington University)Washington, DC
March 20 - 21, 2003	First OpenOffice.org Conference(OOoCon2003)	(University of Hamburg)Hamburg, Germany
March 20 - 21, 2003	Conference PHP 2003	(École Polytechnique de Montréal)Montreal, Quebec, Canada
March 26 - 28, 2003	PyCon DC 2003	(George Washington University)Washington DC
March 31 - April 2, 2003	2nd USENIX Conference on File and Storage Technologies(FAST '03)	(Cathedral Hill Hotel)San Francisco, CA
April 2 - 3, 2003	The UK Python Conference	(Holiday Inn Oxford)Oxford, England
April 10 - 12, 2003	MySQL Users Conference & Expo 2003	(Doubletree Hotel)San Jose, California
April 13 - 17, 2003	RSA Conference 2003	(Moscone Center)San Francisco, CA
April 14 - 15, 2003	Samba eXPerience 2003	(Hotel Freizeit)Göttingen, Germany
April 15 - 16, 2003	LinuxUser & Developer Expo 2003	Birmingham, UK

Comments (none posted)

Software announcements

This week's software announcements

Here are the software announcements, courtesy of Freshmeat.net. They are available in two formats:

• Sorted alphabetically,
• Sorted by license.

Comments (none posted)

Miscellaneous

WiFi Caravan to Prove Extreme Mobile Connectivity

If you're interested in wireless, Linux, security, digital music, or the off-the-shelf hardware and software that enable the freedom of a mobile wireless network which can maintain an uninterrupted connection even at highway speeds, then read on...

Full Story (comments: 2)

Page editor: Forrest Cook