LWN.net Weekly Edition for May 29, 2003

MySQL and SAP

Corporate code releases are always an uncertain prospect. The contribution of a large body of code is always welcomed, but only time will tell what sort of development and user community will eventually develop around that code. SAP released its relational database management system (SAP-DB) to great fanfare in October, 2000. Compared to some of that month's other events (Atipa acquires OpenNMS, VA Linux hires the Debian project leader, the PostgreSQL hackers to go work for Great Bridge, EBIZ and the Linux Mall merge, Turbolinux gets $30 million in venture funding, LynuxWorks files for its IPO, Progeny Linux ships its first beta distribution, Linus claims "no show-stopper bugs" in 2.4.0-test10), SAP-DB has been a raging success. Still, relative to the other free database systems (PostgreSQL, MySQL, and perhaps even Interbase/Firebird), SAP-DB has not pulled in a particularly large community.

Nobody can say the same thing about MySQL. This free relational database manager, despite a lingering reputation for lacking the features that "real" database systems have, claims some four million installed systems. MySQL's user community is large and strong, and MySQL AB, the copyright holder for MySQL, is apparently thriving. But MySQL's "fast, reliable, but still a toy" reputation (at least in some circles) is probably not helping MySQL AB win those really big contracts.

So the announcement of a partnership between MySQL AB and SAP makes a fair amount of sense for both sides. Under this deal, MySQL AB gets the right to sell commercial versions of SAP-DB, which will be relicensed entirely under the GPL and renamed. SAP-DB will thus become a product much like the current MySQL offerings, but one aimed at "enterprise" deployments.

MySQL AB gets a new product to sell which has a lengthy large-deployment track record and which should prove easier to market to large companies. SAP's sales force and existing large company customer base should also prove most helpful in that regard. And, of course, MySQL gets to mix together the best of both systems to create "the next-generation MySQL open source enterprise database."

SAP, meanwhile, gets access to a brand with great respect in the free software community. MySQL AB has a proven ability to create an active developer and user community around a free database system; this skill will come to great use in reviving interest in the database formerly known as SAP-DB. More significantly, however, is the fact that MySQL AB has figured out how to sell proprietary licenses to a free software product, pleasing its customers while simultaneously avoiding alienating the developer community. The company's ability to walk that fine line bodes well for SAP-DB's future.

If there is a down side to this deal, it is that the SAP-DB client libraries, which were formerly licensed under the LGPL, will, in the future, only be available under the GPL. That change is crucial to the entire strategy, of course; it is the lever that will force proprietary software vendors to buy a commercial license. But it is a change which will upset users who were making use of the previous LGPL licensing; a look at the sapdb-general mailing list shows a handful of messages from users who are unhappy with the new state of affairs.

Of course, those users have not really lost anything; the current SAP-DB release cannot and will not be taken away from them. They simply will not have the same access to future releases. SAP-DB users have the right to fork the code base and maintain the code independently, and they might just do so. But it is hard to see a forked SAP-DB attracting a larger community than SAP-DB has now, especially when the folks over at MySQL appear to be having all the fun.

Comments (6 posted)

The SCO case gets weirder

We were planning to keep SCO off the front page this week. Really. But no such luck.

This week's fun centers around a press release issued by Novell. But first some background: SCO, recall, has been trumpeting its ownership rights in the Unix source and patents for some time. The main "SCOsource" page states:

The patent claim was effectively debunked by Don Marti back in March, but the ownership claim has gotten an easier ride. Until now. Novell, the company which obtained Unix from ATT, has issued a press release taking issue with SCO's claims. In particular, Novell is asserting that it still owns the copyrights on the Unix code base:

Novell's claim notwithstanding, SCO has been quoted reiterating its claim to the Unix copyright (and threatening to sue Linus Torvalds for patent infringement as well). But SCO's annual report, as filed with the U.S. Securities and Exchange Commission, includes an interesting disclosure:

SCO, it would seem, is not the copyright owner; it is simply the paperwork shuffler, working for a 5% cut. That is not quite the picture that the company has been trying to present.

Whether this turn of events weakens SCO's case against IBM remains to be seen. SCO rushed out a response stating that it doesn't matter:

In fact, the original complaint does talk mostly about trade secrets and breach of contract. It does also, however, assert (once again) ownership of Unix and claim that IBM's actions have caused a reduction in the value of its Unix assets. Novell's claim challenges SCO's standing in the case; it may also be used by IBM's lawyers to question SCO's truthfulness and good faith in general.

Regardless of how the IBM suit goes, however, it now seems clearer than ever that the 1500 or so recipients of SCO's "Letter to Linux customers" can simply file that letter next to their AOL disks. SCO's case is not about patents or copyrights; the company has no standing to go after random Linux users. This letter was pure FUD and possibly libelous.

Novell does not stop with its copyright assertion. The company's press release challenges SCO to produce its evidence, and hints at legal moves to come:

It is also interesting to note that LinuxTag's lawyers have given notice to SCO Group GmbH that SCO must cease its "unfair competitive practices" as embodied in its attacks against Linux. If SCO can't produce some convincing evidence for its claims soon, it may well find itself dealing with lawsuits from the other side of the courtroom.

Comments (24 posted)

Open source content management systems roundup

[This article was contributed by Joe 'Zonker' Brockmeier]

The third Open Source Content Management (OSCOM) Conference this week has all eyes on Open Source Content Management Systems (CMS). Well, maybe not all eyes, but Open Source CMS are certainly getting quite a bit of attention this week.

There are far, far too many Open Source CMS projects under development to touch on all of them here, so consider this an overview of some of the more popular, interesting and/or capable CMS projects being used today. Note that this includes actual CMS systems, not Content Management Framework (CMF) projects like Midgard, Mason or Zope, which typically require significant assembly work before they can be deployed for any particular application.

Almost all Open Source CMS projects support features like RSS feeds, threaded comments, user authentication, templates, integrated search engines or support for external engines, version control, in-browser editing, scheduled publishing, support for multiple languages and so on. Perhaps the most important feature for most developers is which language the project is written in, and how easily extensible it is.

Slashcode, more frequently referred to as just Slash, is arguably the best-known CMS out there. Slash is pretty much aimed at news/Weblog-type sites, so it may not be best for general purpose sites. Slashcode is written in Perl, uses a MySQL backend and is available under the GNU General Public License (GPL). Slashcode is owned by OSDN.

In a similar vein, there's Scoop, the code that powers kuro5hin and a slew of other news sites and weblogs. Like Slashcode, Scoop is written in Perl with a MySQL backend and is available under the GPL. If you're looking to run a news site or Weblog, but prefer PHP to Perl, there's PHP-Nuke, PostNuke and PHPSlash.

For more of a "professional" approach to running a news site, there's Cofax. Cofax ("Content Object Factory") was mostly developed by staff at KnightRidder.com and Philly.com with participation from other Knight Ridder newspapers. Cofax is designed to help simplify the presentation of newspaper content on a Website, and to speed up real-time Web publication. One example of Cofax in action is the Silicon Valley site; it is also used to power more than 30 Knight Ridder newspaper sites. The Cofax CMS is written in Java, uses MySQL or Microsoft SQL Server for data storage, and is licensed under the GNU Lesser General Public License. The instructions on the Cofax site are Windows-specific, but it has also been tested under Sun OS 5.8, and could probably be coaxed to work on a Linux server as well.

There are a number of CMS projects for more general sites. Though Red Hat is best known for its Linux distribution, it also offers an Enterprise Content Management System. Red Hat's CMS is written in Java, requires PostgreSQL or Oracle and a J2EE servlet container and is supported on Red Hat, Solaris, Windows, AIX or HP-UX. Unlike most of Red Hat's offerings, the Red Hat CMS is available under the IBM Public License rather than the GPL.

Another all-purpose CMS is OpenACS. OpenACS is a little different, in that it is written in Tcl rather than Perl, Java or PHP. OpenACS has a number of applications such as bug trackers, chat, e-commerce features and much more. The OpenACS code is distributed under the terms of the GPL, and requires AOLserver and an Oracle or PostgreSQL backend. The Creative Commons site is just one example of a site powered by OpenACS.

Where would we be without Wiki-type sites? There are a number of Wiki-inspired packages out there, but tikiwiki may be the most full-featured. Tiki is PHP-based and offers LDAP authentication, webmail, tasks and notepad features, image galleries, games and a slew of other features not normally found in Wiki implementations. If you'd like to get a feel for Tiki, check out the demo site.

Bricolage is another general purpose content management and publishing system. Bricolage is written in Perl and uses PostgreSQL to store content. Macworld recently announced that it is using Bricolage to power its site. If you'd like to run Bricolage you'll need Apache with mod_perl and Mason. Bricolage is published under a BSD-style license.

The WebGUI folks call their solution a "application framework" rather than a CMS, but it does the job just as well. WebGUI is written in Perl and can use MySQL or PostgreSQL as a data store. It will run on Linux, Solaris, FreeBSD, and Windows with Apache or IIS. The Law Society of Western Australia is using WebGUI for their site. WebGUI is available under the GPL and is developed by Plain Black Software.

OpenCms, is pretty flexible in that it will run on LAMP platforms with Tomcat or on Windows platforms with Oracle and BEA Weblogic. OpenCms is used on a number of sites, including the Tribeca Film Festival site. OpenCms offers a WYSIWYG editor through a Web browser, but only for folks using Internet Explorer. Development for OpenCms is coordinated by Alkacon Software.

This is, of course, just the tip of the iceberg. There are quite a few other Open Source CMS projects out there, curious readers can start with the OSCOM Matrix of CMS projects.

Finally, OpensourceCMS is another site worth visiting if you're shopping for an Open Source CMS. Especially if you're looking to test-drive Open Souce CMS packages before actually messing with installation. The nice thing about Open Source is that you can always "try before you buy" but the installation process for many CMS packages can be a bit painful, or at least very time-consuming. OpensourceCMS does not have every CMS project available, but they have a pretty good list of demos you can try out.

Comments (11 posted)

Page editor: Jonathan Corbet

Security

Brief items

Where are the kernel updates?

On April 5, Florian Weimer sent a note to the linux-kernel mailing list describing a hashing vulnerability in the 2.4 kernel. His assessment:

This problem was also described on this page last week.

We are, in other words, going on two months since this vulnerability was publicly disclosed. A quick look at the LWN Vulnerability Database entry for this problem, however, shows that only two distributors (EnGarde and Red Hat) have updated their kernels to close this hole. So all of the other distributors, many of which have a very good history of quick response to security problems, are leaving their users exposed on this one.

This vulnerability may seem less urgent because it cannot be used to gain root access to a target machine. It can, however, be used to take a system off the net. It allows a remote attacker to obtain the results of a distributed denial of service attack without that attacker having to arrange the "distributed" part. It is a serious problem which will certainly be exploited, with unpleasant results. The distributors owe their users a fix.

Comments (5 posted)

New vulnerabilities

Apache 2 - denial of service

Package(s):	apache	CVE #(s):	CAN-2003-0189 CAN-2003-0245
Created:	May 28, 2003	Updated:	June 16, 2003
Description:	A new set of denial of service vulnerabilities has been found in Apache versions 2.0 through 2.0.45. The potential for a remote code exploit apparently exists as well. See the Apache 2.0.46 announcement for more information.
Alerts:	Conectiva CLA-2003:661 2003-06-16 Yellow Dog YDU-20030603-1 2003-06-03 Mandrake MDKSA-2003:063-1 2003-06-02 Gentoo 200305-13 2003-06-01 Mandrake MDKSA-2003:063 2003-05-30 Red Hat RHSA-2003:186-01 2003-05-28

Comments (none posted)

CUPS: vulnerability in the CUPS IPP implementation

Package(s):	cups	CVE #(s):	CAN-2003-0195
Created:	May 27, 2003	Updated:	July 22, 2003
Description:	Phil D'Amore of Red Hat discovered a vulnerability in the CUPS IPP (Internet Printing Protocol) implementation. The IPP implementation is single-threaded, which means only one request can be serviced at a time. An attacker could make a partial request that does not time out and therefore creates a denial of service. In order to exploit this bug, an attacker must have the ability to make a TCP connection to the IPP port (by default 631).
Alerts:	Conectiva CLA-2003:702 2003-07-22 Gentoo 200306-09 2003-06-14 Debian DSA-317-1 2003-06-11 SuSE SuSE-SA:2003:028 2003-06-06 Yellow Dog YDU-20030602-3 2003-06-02 Mandrake MDKSA-2003:062 2003-05-29 Slackware ssa:2003-149-01 2003-05-29 Red Hat RHSA-2003:171-01 2003-05-27

Comments (none posted)

Nessus NASL scripting engine security issues

Package(s):	nessus	CVE #(s):
Created:	May 27, 2003	Updated:	August 12, 2004
Description:	Some some vulnerabilities exsist in the Nessus NASL scripting engine. To exploit these flaws, an attacker would need to have a valid Nessus account as well as the ability to upload arbitrary Nessus plugins in the Nessus server (this option is disabled by default) or he/she would need to trick a user somehow into running a specially crafted nasl script. Read the full advisory for additional information.
Alerts:	Gentoo 200305-10 2003-05-27

Comments (none posted)

Updated vulnerabilities

bind buffer overflow vulnerability in DNS resolver libraries

Package(s):	bind glibc	CVE #(s):	CAN-2002-0651 CAN-2002-0684
Created:	July 8, 2002	Updated:	October 1, 2003
Description:	The BIND 4.9.8-OW2 patch and BIND 4.9.9 release (and thus 4.9.9-OW1) include fixes for a libc related vulnerability which does not affect Linux. Updates from the Internet Software Consortium (ISC) are available from here. No release or branch of Openwall GNU/*/Linux (Owl) is known to be affected, due to Olaf Kirch's fixes for this problem getting into the GNU C library more than two years ago. Unfortunatly that does not mean that Linux systems are not vulnerable. Similar code, without Olaf Firch's fixes, is in the glibc getnetbyXXX functions. These functions are described in the SuSE alert as " used by very few applications only, such as ifconfig and ifuser, which makes exploits less likely." CERT Advisory: CA-2002-19 Buffer Overflow in Multiple DNS Resolver Libraries CAN-2002-0651 CAN-2002-0684
Alerts:	Mandrake MDKSA-2002:050 2002-08-13 Yellow Dog YDU-20020810-3 2002-08-10 Eridani ERISA-2002:035 2002-08-09 Red Hat RHSA-2002:133-13 2002-08-08 SCO Group CSSA-2002-034.0 2002-08-05 Yellow Dog YDU-20020801-2 2002-08-01 Eridani ERISA-2002:028 2002-07-25 Red Hat RHSA-2002:139-10 2002-07-22 EnGarde ESA-20020724-018 2002-07-24 Mandrake MDKSA-2002:043 2002-07-16 Trustix 2002-0061 2002-07-15 Gentoo glibc-20020713 2002-07-13 Conectiva CLA-2002:507 2002-07-11 SuSE SuSE-SA:2002:026 2002-07-09 OpenPKG OpenPKG-SA-2002.006 2002-07-04

Comments (1 posted)

BitchX - denial of service

Package(s):	BitchX	CVE #(s):
Created:	February 20, 2003	Updated:	May 26, 2003
Description:	From this Bugtraq posting: A denial of service vulnerability exists in BitchX. Sending a malformed RPL_NAMREPLY numeric 353 causes BitchX to segfault. This problem was reported to panasync@efnet#bitchx on Jan 30 2003, as of this writing we are unaware of any patches or workarounds provided by panasync and or any members of #bitchx
Alerts:	Conectiva CLA-2003:655 2003-05-26 Slackware ssa:2003-141-02 2003-05-22 Debian DSA-306-1 2003-05-19 Gentoo 200302-11 2003-02-20

Comments (none posted)

Bugzilla: several vulnerabilities.

Package(s):	bugzilla	CVE #(s):
Created:	April 30, 2003	Updated:	May 21, 2003
Description:	The Bugzilla bug tracking system has a new set of vulnerabilities which can lead to cross-site scripting and symlink attacks. Versions 2.16.3 and 2.17.4 contain the necessary fixes; see this advisory for the details.
Alerts:	Conectiva CLA-2003:653 2003-05-21

Comments (none posted)

Canna server: exploitable buffer overrun

Package(s):	canna	CVE #(s):	CAN-2002-1158 CAN-2002-1159
Created:	December 10, 2002	Updated:	October 1, 2003
Description:	Canna is a kana-kanji conversion server which is necessary for Japanese language character input. A buffer overflow bug in the Canna server up to and including version 3.5b2 allows a local user to gain the privileges of the user 'bin' which could lead to further exploits. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-1158 to this issue. A lack of validation of requests has been found that affects Canna version 3.6 and earlier. A malicious remote user could exploit this vulnerability to leak information, or cause a denial of service attack. (CAN-2002-1159) See also http://canna.sourceforge.jp/sec/Canna-2002-01.txt CAN-2002-1158 CAN-2002-1159
Alerts:	SCO Group CSSA-2003-005.0 2003-01-21 Debian DSA-224-1 2002-01-08 Gentoo 200212-8 2002-12-20 Red Hat RHSA-2002:246-18 2002-12-04

Comments (none posted)

cdrecord: format string vulnerability

Package(s):	cdrecord	CVE #(s):	CAN-2003-0289
Created:	May 16, 2003	Updated:	May 21, 2003
Description:	A format string vulnerability in scsiopen.c of the cdrecord program in cdrtools 2.0 allows local users to gain privileges via format string specifiers in the "dev" parameter.
Alerts:	Mandrake MDKSA-2003:058-1 2003-05-21 Gentoo 200305-06 2003-05-18 Mandrake MDKSA-2003:058 2003-05-15

Comments (none posted)

dvips: command execution vulnerability

Package(s):	dvips	CVE #(s):	CAN-2002-0836
Created:	October 16, 2002	Updated:	June 10, 2003
Description:	The dvips utility uses the system() function improperly when managing fonts. An attacker who can craft the right sort of print job can use this vulnerability to execute commands under the UID used by the print system.
Alerts:	Immunix IMNX-2003-7+-016-01 2003-06-09 OpenPKG OpenPKG-SA-2002.015 2002-12-16 Debian DSA-207-1 2002-12-11 Conectiva CLA-2002:537 2002-10-29 Mandrake MDKSA-2002:071 2002-10-24 Mandrake MDKSA-2002:070 2002-10-23 Gentoo tetex-20021018 2002-10-18 Red Hat RHSA-2002:194-18 2002-10-08

Comments (none posted)

epic4: buffer overflows and arbitrary code execution

Package(s):	epic4	CVE #(s):
Created:	May 2, 2003	Updated:	May 22, 2003
Description:	Timo Sirainen discovered several problems in EPIC4, a popular client for Internet Relay Chat (IRC). A malicious server could craft special reply strings, triggering the client to write beyond buffer boundaries. This could lead to a denial of service if the client only crashes, but may also lead to executing of arbitrary code under the user id of the chatting user.
Alerts:	Slackware SSA:2003-141-01 2003-05-22 Debian DSA-298-1 2002-03-05

Comments (none posted)

ethereal - format string vulnerability

Package(s):	ethereal	CVE #(s):	CAN-2003-0081
Created:	March 10, 2003	Updated:	June 12, 2003
Description:	The SOCKS dissector in Ethereal 0.9.9 is susceptible to a format string overflow. This vulnerability has been present in Ethereal since the SOCKS dissector was introduced in version 0.8.7. It was discovered by Georgi Guninski. Additionally, the NTLMSSP code is susceptible to a heap overflow. All users of Ethereal 0.9.9 and below are encouraged to upgrade. See the full advisory for additional information.
Alerts:	Mandrake MDKSA-2003:051 2003-03-24 Red Hat RHSA-2003:076-01 2003-04-23 Conectiva CLA-2003:627 2003-04-16 SuSE SuSE-SA:2003:019 2003-03-21 Debian DSA-258-1 2003-03-10 Gentoo 200303-10 2003-03-09

Comments (none posted)

Filename disclosure vulnerability in fam

Package(s):	fam	CVE #(s):	CAN-2002-0875
Created:	August 19, 2002	Updated:	January 5, 2005
Description:	"fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible.
Alerts:	Red Hat RHSA-2005:005-01 2005-01-05 Debian DSA-154-1 2002-08-15

Comments (none posted)

fetchmail: buffer overflow

Package(s):	fetchmail	CVE #(s):	CAN-2002-1365
Created:	December 17, 2002	Updated:	October 20, 2003
Description:	Versions of fetchmail prior to 6.2.0 have (yet another) buffer overflow vulnerability which can be exploited remotely via a suitably crafted message. See this advisory for details.
Alerts:	Immunix IMNX-2003-7+-023-01 2003-10-17 Mandrake MDKSA-2003:011 2003-01-27 EnGarde ESA-20030127-002 2003-01-27 SCO Group CSSA-2003-001.0 2003-01-09 SuSE SuSE-SA:2003:001 2003-01-02 Debian DSA-216-1 2002-12-24 Red Hat RHSA-2002:293-09 2002-12-17 Conectiva CLA-2002:554 2002-12-16

Comments (3 posted)

file - memory allocation problem, stack overflow

Package(s):	file	CVE #(s):	CAN-2003-0102
Created:	March 4, 2003	Updated:	June 4, 2003
Description:	Jeff Johnson found a memory allocation problem and David Endler found a stack overflow corruption problem in the file "Automatic File Content Type Recognition Tool" version 3.41. Nalin Dahyabhai improved ELF section and program header handling in file version 3.40. The folks at OpenPKG believe that file versions without those modifications are vulnerable to memory allocation and stack overflow problems which put security at risk.
Alerts:	Immunix IMNX-2003-7+-012-01 2003-06-03 SCO Group CSSA-2003-018.0 2003-04-28 Mandrake MDKSA-2003:030-1 2003-04-17 Conectiva CLA-2003:617 2003-04-04 SuSE SuSE-SA:2003:017 2003-03-21 Debian DSA-260-1 2003-03-13 Gentoo 200303-8 2003-03-08 EnGarde ESA-20030307-008 2003-03-07 Red Hat RHSA-2003:086-07 2003-03-07 Mandrake MDKSA-2003:030 2003-03-06 OpenPKG OpenPKG-SA-2003.017 2003-03-04

Comments (none posted)

Potential remote root exploit in glibc

Package(s):	glibc	CVE #(s):	CAN-2002-0391
Created:	August 14, 2002	Updated:	June 30, 2003
Description:	Felix von Leitner, discovered a potential division by zero bug in code derived from the SunRPC library which is used in glibc.This bug could be exploited to gain unauthorized root access to software linking to glibc. Updating as soon as practical is a good idea. Because SunRPC-derived XDR libraries are used by a variety of vendors in a variety of applications, this defect may lead to a number of differing security problems. Exploiting this vulnerability will lead to denial of service, execution of arbitrary code, or the disclosure of sensitive information. CERT/CC Vulnerability Note VU#192995 Integer overflow in xdr_array() function when deserializing the XDR stream
Alerts:	Debian DSA-333-1 2003-06-27 Conectiva CLA-2002:535 2002-10-29 Trustix 2002-0070 2002-10-17 EnGarde ESA-20021003-021 2002-10-03 Gentoo glibc-20020927 2002-09-27 Gentoo dietlibc-20020927 2002-09-27 Debian DSA-149-2 2002-09-26 Mandrake MDKSA-2002:061 2002-09-23 Gentoo glibc-20020905 2002-09-05 SuSE SuSE-SA:2002:031 2002-08-30 Trustix 2002-0067 2002-08-13 Eridani ERISA-2002:036 2002-08-13 Red Hat RHSA-2002:166-07 2002-08-12 Debian DSA-149-1 2002-08-13

Comments (none posted)

glibc: DNS stub resolvers contain buffer overflow vulnerability

Package(s):	glibc	CVE #(s):	CAN-2002-1146
Created:	November 7, 2002	Updated:	February 5, 2004
Description:	DNS stub resolvers from multiple vendors contain a buffer overflow vulnerability. The impact of this vulnerability appears to be limited to denial of service. (See CERT Vulnerability Note VU#738331) The BIND 4 and BIND 8.2.x stub resolver libraries, and other libraries such as glibc 2.2.5 and earlier, libc, and libresolv, uses the maximum buffer size instead of the actual size when processing a DNS response, which causes the stub resolvers to read past the actual boundary ("read buffer overflow"), allowing remote attackers to cause a denial of service (crash).
Alerts:	Mandrake MDKSA-2004:009 2004-02-04 Red Hat RHSA-2002:197-09 2002-11-06 Red Hat RHSA-2002:197-06 2002-10-03

Comments (none posted)

glibc: integer overflow in the xdrmem_getbytes() function

Package(s):	glibc krb5 dietlibc	CVE #(s):	CAN-2003-0028
Created:	March 21, 2003	Updated:	May 27, 2003
Description:	An integer overflow in the xdrmem_getbytes() function, and possibly other functions, of XDR (external data representation) libraries derived from SunRPC, including libnsl, libc, and glibc, allows remote attackers to execute arbitrary code via certain integer values in length fields See CAN-2003-0028 and CERT advisory CA-2003-10 for more information.
Alerts:	SuSE SuSE-SA:2003:027 2003-05-26 Slackware ssa:2003-141-03 2003-05-22 Conectiva CLA-2003:639 2003-05-05 Conectiva CLA-2003:633 2003-04-30 Immunix IMNX-2003-7+-009-01 2003-04-14 Debian DSA-282-1 2003-04-09 Gentoo 200303-29 2003-03-31 Debian DSA-272-1 2003-03-28 Trustix 2003-0014 2003-03-26 Mandrake MDKSA-2003:037 2003-03-25 Gentoo 200303-22 2003-03-25 Debian DSA-266-1 2003-03-17 Red Hat RHSA-2003:089-00 2003-03-19 Sorcerer SORCERER2003-03-20-2 2003-03-20 Sorcerer SORCERER2003-03-20-1 2003-03-20 EnGarde ESA-20030321-010 2003-03-21 SCO Group CSSA-2003-013.0 2003-03-19

Comments (3 posted)

gnupg: key validation

Package(s):	gnupg	CVE #(s):	CAN-2003-0255
Created:	May 16, 2003	Updated:	November 18, 2003
Description:	A key validation bug was discovered in the GNU Privacy Guard (GPG) which would cause keys with more then one user ID to trust all user ID's with the amount of trust given to the most-valid user ID.
Alerts:	SCO Group CSSA-2003-034.0 2003-11-17 Conectiva CLA-2003:694 2003-07-11 Yellow Dog YDU-20030602-4 2003-06-02 Mandrake MDKSA-2003:061 2003-05-22 Slackware ssa:2003-141-04 2003-05-22 Red Hat RHSA-2003:175-01 2003-05-20 Gentoo 200305-04 2003-05-16 OpenPKG OpenPKG-SA-2003.029 2003-05-16 EnGarde ESA-20030515-016 2003-05-15

Comments (none posted)

gtkhtml: malformed messages cause crash

Package(s):	gtkhtml	CVE #(s):	CAN-2003-0133 CAN-2003-0541
Created:	April 14, 2003	Updated:	April 18, 2005
Description:	GtkHTML is the HTML rendering widget used by the Evolution mail reader. GtkHTML supplied with versions of Evolution prior to 1.2.4 contain a bug when handling HTML messages. Alan Cox discovered that certain malformed messages could cause the Evolution mail component to crash.
Alerts:	Debian DSA-710-1 2005-04-18 Mandrake MDKSA-2003:093 2003-09-18 Conectiva CLA-2003:737 2003-09-12 Red Hat RHSA-2003:264-01 2003-09-09 Mandrake MDKSA-2003:046 2003-04-15 Red Hat RHSA-2003:126-01 2003-04-14

Comments (none posted)

IMP - SQL injection vulnerability

Package(s):	imp	CVE #(s):	CAN-2003-0025
Created:	January 15, 2003	Updated:	July 8, 2003
Description:	The IMP IMAP server, versions 2.2.8 and prior, is vulnerable to SQL injection; see this advisory for details. Version 3.x is not vulnerable to this problem.
Alerts:	Conectiva CLA-2003:690 2003-07-08 SuSE SuSE-SA:2003:0008 2003-02-18 Debian DSA-229-2 2003-01-15

Comments (1 posted)

kde: arbitrary code execution

Package(s):	kde	CVE #(s):	CAN-2003-0204
Created:	April 10, 2003	Updated:	June 30, 2003
Description:	The KDE Security team has issued an advisory on a vulnerability present in all versions of KDE that allow a remote attacker to execute arbitrary commands under your account. KDE 3.0.5b and KDE 3.1.1a have been released to address this problem. For KDE 2.2.2 patches to the KDE 2.2.2 sources have been made available. KDE uses Ghostscript software for processing of PostScript (PS) and PDF files in a way that allows for the execution of arbitrary commands that can be contained in such files. An attacker can prepare a malicious PostScript or PDF file which will provide the attacker with access to the victim's account and privileges when the victim opens this malicious file for viewing or when the victim browses a directory containing such malicious file and has file previews enabled. An attacker can provide malicious files remotely to a victim in an e-mail, as part of a webpage, via an ftp server and possible other means.
Alerts:	Conectiva CLA-2003:668 2003-06-30 Red Hat RHSA-2003:002-01 2003-05-12 Debian DSA-296-1 2003-04-30 Mandrake MDKSA-2003:049-1 2003-04-24 SuSE SuSE-SA:2003:0026 2003-04-24 Debian DSA-293-1 2003-04-23 Slackware sl-1050682024 2003-04-18 Mandrake MDKSA-2003:049 2003-04-17 Sorcerer SORCERER2003-04-12 2003-04-12 Debian DSA-284-1 2003-04-12 Gentoo 200304-05 2003-04-11 Gentoo 200304-04 2003-04-10

Comments (none posted)

kerberos - cryptographic weakness

Package(s):	kerberos, heimdal, openafs	CVE #(s):	CAN-2003-0138 CAN-2003-0139
Created:	March 26, 2003	Updated:	May 27, 2003
Description:	Version 4 of the Kerberos protocol contains a cryptographic weakness which enables a chosen-plaintext attack. A suitably equipped attacker can impersonate any principal in the realm. Another weakness allows the creation of false Kerberos tickets. Given the weaknesses in the cryptography, cross-realm authentication cannot be performed in a secure way. OpenAFS kaserver implements version 4 of the Kerberos protocol, and therefore is also vulnerable.
Alerts:	Gentoo 200305-09 2003-05-27 Debian DSA-269-2 2003-04-09 Immunix IMNX-2003-7+-007-01 2003-04-07 Red Hat RHSA-2003:091-01 2003-04-02 Mandrake MDKSA-2003:043 2003-04-01 Gentoo 200303-28 2003-03-31 Gentoo 200303-26 2003-03-30 Debian DSA-273-1 2003-03-28 Red Hat RHSA-2003:051-01 2003-03-26 Debian DSA-269-1 2003-03-26

Comments (none posted)

kernel - ptrace-related vulnerability

Package(s):	kernel	CVE #(s):	CAN-2003-0127
Created:	March 17, 2003	Updated:	June 30, 2003
Description:	Versions 2.2.x and 2.4.x of the Linux kernel contain a vulnerability in ptrace() which may be exploited by a local user to obtain root access. This announcement contains the details and a patch for 2.4.20. For 2.2 users, 2.2.25 has been released which contains the fix.
Alerts:	Debian DSA-336-2 2003-06-29 Debian DSA-336-1 2003-06-29 Debian DSA-332-1 2003-06-27 Red Hat RHSA-2003:098-03 2003-06-02 SCO Group CSSA-2003-020.0 2003-05-09 Mandrake MDKSA-2003:038-1 2003-04-09 Red Hat RHSA-2003:135-00 2003-04-08 Conectiva CLA-2003:618 2003-04-07 Debian DSA-276-1 2003-04-03 Mandrake MDKSA-2003:039 2003-03-27 Mandrake MDKSA-2003:038 2003-03-27 Debian DSA-270-1 2003-03-27 SuSE SuSE-SA:2003:021 2003-03-25 Gentoo 200303-17 2003-03-21 Sorcerer SORCERER2003-03-19 2003-03-20 Red Hat RHSA-2003:088-01 2003-03-20 EnGarde ESA-20030318-009 2003-03-18 Trustix 2003-0007 2003-03-18 Red Hat RHSA-2003:098-00 2003-03-17

Comments (none posted)

kernel 2.4 - two new vulnerabilities

Package(s):	kernel	CVE #(s):	CAN-2003-0244 CAN-2003-0246
Created:	May 14, 2003	Updated:	July 25, 2003
Description:	The 2.4.20 (and prior) kernel contains a couple of vulnerabilities that are worth fixing. The ioperm() system call doesn't perform proper checking, allowing a local user to manipulate arbitrary I/O ports. The networking code contains a remotely exploitable denial of service condition; see the May 24 Security Page for details.
Alerts:	Mandrake MDKSA-2003:066-2 2003-07-25 Conectiva CLA-2003:701 2003-07-22 Mandrake MDKSA-2003:066-1 2003-07-21 Mandrake MDKSA-2003:074 2003-07-15 Slackware SSA:2003-168-01 2003-06-17 Mandrake MDKSA-2003:066 2003-06-11 Debian DSA-312-1 2003-06-09 Debian DSA-311-1 2003-06-08 Red Hat RHSA-2003:187-01 2003-06-03 Red Hat RHSA-2003:145-01 2003-05-27 EnGarde ESA-20030515-017 2003-05-15 Red Hat RHSA-2003:172-00 2003-05-14

Comments (2 posted)

kernel-utils: setuid vulnerability

Package(s):	kernel-utils	CVE #(s):	CAN-2003-0019
Created:	February 7, 2003	Updated:	January 21, 2005
Description:	The kernel-utils package contains several utilities that can be used to control the kernel or machine hardware. In Red Hat Linux 8.0 this package contains user mode linux (UML) utilities. The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was incorrectly shipped setuid root. This could allow local users to control certain network interfaces, add and remove arp entries and routes, and put interfaces in and out of promiscuous mode. All users of the kernel-utils package should update to these packages that contain a version of uml_net that is not setuid root. Alternatively, as a work-around to this vulnerability issue the following command as root: chmod -s /usr/bin/uml_net
Alerts:	Red Hat RHSA-2003:056-08 2003-02-07

Comments (none posted)

kopete: vulnerabiliy in GnuPG plugin

Package(s):	kopete	CVE #(s):	CAN-2003-0256
Created:	May 8, 2003	Updated:	June 27, 2003
Description:	A vulnerability was discovered in versions of kopete prior to 0.6.2. Kopete is a KDE instant messenger client. This vulnerabiliy is in the GnuPG plugin that allows for users to send each other GPG-encrypted instant messages. The plugin passes encrypted messages to gpg, but does no checking to sanitize the commandline passed to gpg. This can allow remote users to execute arbitrary code, with the permissions of the user running kopete, on the local system.
Alerts:	Conectiva CLA-2003:665 2003-06-27 Gentoo 200305-03 2003-05-14 Mandrake MDKSA-2003:055 2003-05-08

Comments (none posted)

libpng, libpng3: buffer overflow

Package(s):	libpng, libpng3	CVE #(s):	CAN-2002-1363
Created:	December 19, 2002	Updated:	July 14, 2004
Description:	Glenn Randers-Pehrson discovered a problem in connection with 16-bit samples from libpng, an interface for reading and writing PNG (Portable Network Graphics) format files. The starting offsets for the loops are calculated incorrectly which causes a buffer overrun beyond the beginning of the row buffer.
Alerts:	Gentoo 200407-06 2004-07-08 OpenPKG OpenPKG-SA-2004.030 2004-07-06 Mandrake MDKSA-2004:063 2004-06-29 Whitebox WBSA-2004:249-01 2004-06-21 Fedora FEDORA-2004-176 2004-06-18 Fedora FEDORA-2004-174 2004-06-18 Fedora FEDORA-2004-175 2004-06-18 Fedora FEDORA-2004-173 2004-06-18 Red Hat RHSA-2004:249-01 2004-06-18 Conectiva CLA-2003:564 2003-01-23 Mandrake MDKSA-2003:008 2003-01-20 OpenPKG OpenPKG-SA-2003.001 2003-01-15 Yellow Dog YDU-20030114-2 2002-01-14 SuSE SuSE-SA:2003:0004 2003-01-14 Red Hat RHSA-2003:006-06 2003-01-09 Debian DSA-213-1 2002-12-19

Comments (none posted)

LPRng: insecure temporary file

Package(s):	LPRng	CVE #(s):	CAN-2003-0136
Created:	April 14, 2003	Updated:	June 16, 2003
Description:	Karol Lewandowski discovered that psbanner, a printer filter that creates a PostScript format banner and is part of LPRng, insecurely creates a temporary file for debugging purpose when it is configured as filter. The program does not check whether this file already exists or is linked to another place writes its current environment and called arguments to the file unconditionally with the user id daemon.
Alerts:	Gentoo 200306-04 2003-06-14 Immunix IMNX-2003-7+-013-01 2003-06-04 Yellow Dog YDU-20030602-5 2003-06-02 Mandrake MDKSA-2003:060 2003-05-21 Red Hat RHSA-2003:142-01 2003-04-24 Debian DSA-285-1 2003-04-14

Comments (none posted)

lprold - buffer overflow in lprm

Package(s):	lprold lpd	CVE #(s):	CAN-2003-0144
Created:	March 13, 2003	Updated:	May 28, 2003
Description:	The lprm command of the printing package lprold contains a buffer overflow. This buffer overflow can be exploited by a local user, if the printer system is set up correctly, to gain root privileges.
Alerts:	Mandrake MDKSA-2003:059 2003-05-21 Debian DSA-267-2 2003-04-15 Debian DSA-275-1 2003-04-02 Debian DSA-267-1 2003-03-24 SuSE SuSE-SA:2003:0014 2003-03-13

Comments (none posted)

lv: privilege escalation

Package(s):	lv	CVE #(s):	CAN-2003-0188
Created:	May 16, 2003	Updated:	June 4, 2003
Description:	Leonard Stiles discovered that lv, a multilingual file viewer, would read options from a configuration file in the current directory. Because such a file could be placed there by a malicious user, and lv configuration options can be used to execute commands, this represented a security vulnerability. An attacker could gain the privileges of the user invoking lv, including root.
Alerts:	Yellow Dog YDU-20030602-6 2003-06-02 Gentoo 200305-07 2003-05-19 Red Hat RHSA-2003:169-01 2003-05-16 Debian DSA-304-1 2003-05-15

Comments (none posted)

lynx: CRLF injection vulnerability

Package(s):	lynx	CVE #(s):	CAN-2002-1405
Created:	November 19, 2002	Updated:	October 1, 2003
Description:	If lynx is given a url with some special characters on the command line, it will include faked headers in the HTTP query. This feature can be used to force scripts (that use Lynx for downloading files) to access the wrong site on a web server with multiple virtual hosts. CAN-2002-1405
Alerts:	Conectiva CLA-2003:720 2003-08-11 Mandrake MDKSA-2003:023 2003-02-24 OpenPKG OpenPKG-SA-2003.011 2003-02-18 Red Hat RHSA-2003:029-06 2003-02-12 Trustix 2002-0085 2002-12-19 Debian DSA-210-1 2002-12-13 SCO Group CSSA-2002-049.0 2002-11-18

Comments (none posted)

perl-MailTools: remote command execution

Package(s):	MailTools	CVE #(s):	CAN-2002-1271
Created:	November 5, 2002	Updated:	September 19, 2003
Description:	The SuSE Security Team reviewed critical Perl modules, including the Mail::Mailer package. This package contains a security hole which allows remote attackers to execute arbitrary commands in certain circumstances. This is due to the usage of mailx as default mailer which allows commands to be embedded in the mail body. Note that mail processing programs which use this package can be affected by this vulnerability; in particular, SpamAssassin is vulnerable if you use the -r or -w flags.
Alerts:	Debian DSA-386-1 2003-09-18 Gentoo 200302-01 2003-02-02 Mandrake MDKSA-2002:076 2002-11-07 Gentoo 200211-001 2002-11-06 SuSE SuSE-SA:2002:041 2002-11-05

Comments (none posted)

nethack: buffer overflow

Package(s):	nethack, slashem, falconseye	CVE #(s):	CAN-2003-0358 CAN-2003-0359
Created:	February 18, 2003	Updated:	July 15, 2003
Description:	Overflowing a buffer in nethack may lead to privilege escalation to games uid. Read the the full advisory for the details. Note that falconseye does not contain the file permission error CAN-2003-0359 which affected some other nethack packages.
Alerts:	Debian DSA-350-1 2003-07-15 Debian DSA-316-3 2003-06-17 Debian DSA-316-2 2003-06-11 Debian DSA-316-1 2003-06-11 Gentoo 200302-08 2003-02-18

Comments (none posted)

NetPBM: math overflow errors

Package(s):	NetPBM	CVE #(s):	CAN-2003-0146
Created:	March 17, 2003	Updated:	May 27, 2003
Description:	Al Viro and Alan Cox discovered several maths overflow errors in NetPBM, a set of graphics conversion tools. These programs are not installed setuid root but are often installed to prepare data for processing. These vulnerabilities may allow remote attackers to cause a denial of service or execute arbitrary code.
Alerts:	Conectiva CLA-2003:656 2003-05-27 Red Hat RHSA-2003:060-01 2003-04-03 Mandrake MDKSA-2003:036 2003-03-25 Debian DSA-263-1 2003-03-17

Comments (none posted)

netscape-flash: buffer overflow

Package(s):	netscape-flash	CVE #(s):
Created:	March 10, 2003	Updated:	June 20, 2003
Description:	Potentially exploitable buffer overflows exist in the Macromedia Flash Player. The full advisory is here. "The cumulative security patch is available today and addresses the potential for exploits surrounding buffer overflows (read/write) and sandbox integrity within the player, which might allow malicious users to gain access to a user's computer. The possibility of running native code on a users machine is a theoretical exploit, and extremely difficult to execute in practice. There are no known examples of running such native code from Macromedia Flash movies; however, even though this issue is difficult and theoretical in nature only, we are encouraging users to upgrade."
Alerts:	Red Hat RHSA-2003:026-01 2003-06-20 Gentoo 200303-9 2003-03-09

Comments (none posted)

net-snmp: denial of service vulnerability

Package(s):	net-snmp	CVE #(s):	CAN-2002-1170
Created:	December 17, 2002	Updated:	November 7, 2003
Description:	The SNMP daemon included in the Net-SNMP package versions 5.0.1 through 5.0.4 can be caused to crash if it is sent a specially crafted packet.
Alerts:	Conectiva CLA-2003:778 2003-11-07 Red Hat RHSA-2002:228-11 2002-12-17

Comments (none posted)

openssh: timing attack leads to information disclosure

Package(s):	openssh	CVE #(s):	CAN-2003-0190
Created:	May 2, 2003	Updated:	November 30, 2004
Description:	From the advisory: "During a pen-test we stumbled across a nasty bug in OpenSSH-portable with PAM support enabled (via the --with-pam configure script switch). This bug allows a remote attacker to identify valid users on vulnerable systems, through a simple timing attack. The vulnerability is easy to exploit and may have high severity, if combined with poor password policies and other security problems that allow local privilege escalation."
Alerts:	Ubuntu USN-34-1 2004-11-30 OpenPKG OpenPKG-SA-2003.035 2003-08-06 Red Hat RHSA-2003:222-01 2003-07-29 Gentoo 200305-02 2003-05-13 Gentoo 200305-01 2002-03-05

Comments (1 posted)

openssl: local and remote extraction of RSA private key

Package(s):	openssl, apache, mod_ssl	CVE #(s):	CAN-2003-0147
Created:	March 18, 2003	Updated:	May 22, 2003
Description:	David Brumley and Dan Boneh of Stanford University have researched and documented a timing attack on OpenSSL which allows local and remote attackers to extract the RSA private key of a server. The OpenSSL RSA implementation is generally vulnerable to these type of attacks unless RSA blinding has been turned on. See this paper (pdf format) for additional details. Typically, RSA blinding is not enabled by OpenSSL based applications, mainly because it is not obvious how to do so when using OpenSSL to provide SSL/TLS. This problem affects mostly all applications using OpenSSL and have to be rebuilded against the fixed OpenSSL version (where RSA blinding is now enabled by default) or have to enable RSA blinding explicitly their own. The performance impact of RSA blinding appears to be small (a few percent only) and the RSA functionality is still fully compatible. The Common Vulnerabilities and Exposures (CVE) project assigned the id CAN-2003-0147 to the problem.
Alerts:	Slackware ssa:2003-141-05 2003-05-22 Debian DSA-288-1 2003-04-17 Conectiva CLA-2003:625 2003-04-10 SuSE SuSE-SA:2003:024 2003-04-04 Red Hat RHSA-2003:101-01 2003-04-01 Immunix IMNX-2003-7+-001-01 2003-03-26 Trustix 2003-0013 2003-03-26 Mandrake MDKSA-2003:035 2003-03-25 Gentoo 200303-24 2003-03-25 Gentoo 200303-23 2003-03-25 Gentoo 200303-20 2003-03-24 SCO Group CSSA-2003-014.0 2003-03-21 Sorcerer SORCERER2003-03-21-0 2003-03-21 OpenPKG OpenPKG-SA-2003.026 2003-03-20 EnGarde ESA-20030320-010 2003-03-20 Gentoo 200303-15 2003-03-20 Trustix 2003-0010 2003-03-18 OpenPKG OpenPKG-SA-2003.020 2003-03-18 OpenPKG OpenPKG-SA-2003.019 2003-03-18

Comments (none posted)

pam_xauth: root exploit

Package(s):	pam_xauth	CVE #(s):	CAN-2002-1160
Created:	February 13, 2003	Updated:	July 10, 2003
Description:	The pam_xauth module is used to forward xauth information from user to user in applications such as 'su'. Andreas Beck discovered that versions of pam_xauth supplied with Red Hat Linux since version 7.1 would forward authorization information from the root account to unprivileged users. This could be used by a local attacker to gain access to an administrator's X session. In order to exploit this vulnerability, the attacker would have to get the administrator, as root, to use su to the account belonging to the attacker.
Alerts:	Conectiva CLA-2003:693 2003-07-10 Mandrake MDKSA-2003:017-1 2003-04-28 Red Hat RHSA-2003:035-10 2003-02-12

Comments (none posted)

PHP: vulnerability in mail function

Package(s):	php	CVE #(s):	CAN-2002-0985 CAN-2002-0986
Created:	November 13, 2002	Updated:	October 1, 2003
Description:	Two vulnerabilities exists in the mail() PHP function. The first one allows the execution of any program/script bypassing safe_mode restriction, the second one may give an open-relay script if the mail() function is not carefully used in PHP scripts. See this Bugtraq report for more details. Note that this is a different vulnerability than the previous PHP mail() problem, which affected versions through 4.1.0. CAN-2002-0985 CAN-2002-0986
Alerts:	SCO Group CSSA-2003-008.0 2003-03-04 Gentoo 200211-005 2002-11-20 EnGarde ESA-20021122-031 2002-11-22 Conectiva CLA-2002:545 2002-11-13 Red Hat RHSA-2002:213-06 2002-11-11

Comments (none posted)

PostgreSQL - more buffer overflows

Package(s):	postgresql	CVE #(s):
Created:	February 12, 2003	Updated:	November 7, 2003
Description:	A new set of buffer overflows has been discovered in PostgreSQL 7.2.2; they affect the circle_poly(), path_encode(), and path_addr() functions. Exploiting these overflows requires that the attacker first obtain a connection to the PostgreSQL server.
Alerts:	Debian DSA-397-1 2003-11-07 Immunix IMNX-2003-7+-005-01 2003-04-08 Trustix 2003-0004 2003-02-20 Mandrake MDKSA-2002:062-1 2003-02-11

Comments (1 posted)

PoPTop: remotely exploitable buffer overflow

Package(s):	pptpd	CVE #(s):	CAN-2003-0213
Created:	April 28, 2003	Updated:	June 6, 2003
Description:	The PoPToP PPTP server contains a remotely exploitable buffer overflow; read the full advisory for more information.
Alerts:	SuSE SuSE-SA:2003:029 2003-06-06 Debian DSA-295-1 2003-04-30 Gentoo 200304-08 2003-04-28

Comments (none posted)

Local arbitrary code execution vulnerability in Python

Package(s):	python	CVE #(s):	CAN-2002-1119
Created:	August 28, 2002	Updated:	October 1, 2003
Description:	Zack Weinberg discovered that os._execvpe from os.py uses a predictable name which could lead to execution of arbitrary code. According to the Debian advisory, the problem was present in Python versions 1.5, 2.1 and 2.2. CAN-2002-1119
Alerts:	Red Hat RHSA-2002:202-33 2003-02-12 OpenPKG OpenPKG-SA-2003.006 2003-01-23 Red Hat RHSA-2002:202-25 2003-01-21 Mandrake MDKSA-2002:082-1 2002-12-09 Mandrake MDKSA-2002:082 2002-11-25 SCO Group CSSA-2002-045.0 2002-11-14 Trustix 2002-0073 2002-10-17 Gentoo python-20021003 2002-10-03 Conectiva CLA-2002:527 2002-10-01 Debian DSA-159-2 2002-09-09 Debian DSA-159-1 2002-08-28

Comments (none posted)

Multiple-use vulnerability in Safe.pm

Package(s):	Safe.pm	CVE #(s):	CAN-2002-1323
Created:	October 9, 2002	Updated:	February 20, 2004
Description:	usePerl has a description of a vulnerability in the Safe.pm Perl module. It seems that if a Safe compartment is used more than once, it ceases to be safe. The problem is fixed in Safe 2.08.
Alerts:	SCO Group CSSA-2004-007.0 2004-02-20 Gentoo 200212-6 2002-12-20 Trustix 2002-0087 2002-12-19 OpenPKG OpenPKG-SA-2002.014 2002-12-16 Debian DSA-208-1 2002-12-12

Comments (none posted)

sendmail: insecure temporary files

Package(s):	sendmail	CVE #(s):
Created:	May 16, 2003	Updated:	May 20, 2003
Description:	Paul Szabo discovered bugs in three scripts included in the sendmail package where temporary files were created insecurely (expn, checksendmail and doublebounce.pl). These bugs could allow an attacker to gain the privileges of a user invoking the script (including root).
Alerts:	Debian DSA-305-1 2003-05-15

Comments (none posted)

squirrelmail: more cross-site scripting vulnerabilities

Package(s):	squirrelmail	CVE #(s):	CAN-2003-0160
Created:	April 24, 2003	Updated:	June 4, 2003
Description:	SquirrelMail is a webmail package written in PHP. Multiple vulnerabilities have been found which affect versions of SquirrelMail shipped with Red Hat Linux 8.0 and Red Hat Linux 9. Cross-site scripting vulnerabilities in SquirrelMail version 1.2.10 and earlier allow remote attackers to execute script as other Web users via mailbox displays, message displays, or search results displays. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0160 to these issues. All users are advised to upgrade to these errata packages containing SquirrelMail version 1.2.11, which is not vulnerable to these issues.
Alerts:	Yellow Dog YDU-20030602-2 2003-06-02 Red Hat RHSA-2003:112-01 2003-04-24

Comments (none posted)

File overwrite vulnerability in tar and unzip

Package(s):	tar unzip	CVE #(s):	CAN-2001-1267 CAN-2001-1268 CAN-2001-1269 CAN-2002-0399
Created:	October 1, 2002	Updated:	April 10, 2006
Description:	The tar utility does not properly filter file names containing "../", meaning that a hostile archive can, if unpacked by an unsuspecting user, overwrite any file that is writable by that user. GNU tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42 has the same vulnerability.
Alerts:	Fedora-Legacy FLSA:183571-1 2006-04-04 Red Hat RHSA-2006:0195-01 2006-02-21 Conectiva CLA-2002:538 2002-10-29 Mandrake MDKSA-2002:066 2002-10-10 Mandrake MDKSA-2002:065 2002-10-10 EnGarde ESA-20021003-022 2002-10-03 Gentoo unzip-20021001 2002-10-01 Gentoo tar-20021001 2002-10-01 Red Hat RHSA-2002:096-24 2002-09-18

Comments (1 posted)

TCP/IP: inconsistent flag handling

Package(s):	TCP/IP	CVE #(s):
Created:	May 5, 2003	Updated:	May 20, 2003
Description:	Various vendors' TCP/IP implementations handle packets containing unusual flag combinations in different ways, which may lead to a violation of implicit or explicit security policies. See CERT VU#464113 and this BugTraq post for more information.
Alerts:	SCO Group CSSA-2003-019.0 2003-05-05

Comments (none posted)

Multiple vendor telnetd vulnerability

Package(s):	telnet Telnet netkit-telnet-ssl kerberos telnetd netkit-telnet nkitb/nkitserv/telnetd krb5	CVE #(s):
Created:	May 21, 2002	Updated:	October 5, 2004
Description:	This vulnerability, originally thought to be confined to BSD-derived systems, was first covered in the July 26th Security Summary. It is now known that Linux telnet daemons are vulnerable as well.
Alerts:	Gentoo 200410-03 2004-10-05 Yellow Dog YDU-20010810-2 2001-08-10 Yellow Dog YDU-20010810-1 2001-08-10 SuSE SuSE-SA:2001:029 2001-09-03 Slackware sl-997726350 2001-08-09 Red Hat RHSA-2001:100-02 2001-08-09 Red Hat RHSA-2001:099-09 2002-02-07 Red Hat RHSA-2001:099-06 2001-08-09 Progeny PROGENY-SA-2001-27 2001-08-14 Mandrake MDKSA-2001:093 2001-12-17 Mandrake MDKSA-2001:068 2001-08-13 HP HPSBTL0202-023 2002-02-12 Debian DSA-075-2 2001-08-14 Debian DSA-075-1 2001-08-14 Conectiva CLA-2001:413 2001-08-24 SCO Group CSSA-2001-030.0 2001-08-10

Comments (none posted)

typespeed: buffer overflow

Package(s):	typespeed	CVE #(s):
Created:	January 1, 2003	Updated:	June 17, 2003
Description:	A problem has been discovered in the typespeed, a game that lets you measure your typematic speed. By overflowing a buffer a local attacker could execute arbitrary commands under the group id games.
Alerts:	Debian DSA-322-1 2003-06-16 Debian DSA-217-1 2002-12-27

Comments (none posted)

vim - modeline vulnerability

Package(s):	vim	CVE #(s):	CAN-2002-1377
Created:	January 16, 2003	Updated:	February 10, 2004
Description:	VIM allows a user to set the modeline differently for each edited text file by placing special comments in the files. Georgi Guninski found that these comments can be carefully crafted in order to call external programs. This could allow an attacker to create a text file such that when it is opened arbitrary commands are executed.
Alerts:	Conectiva CLA-2004:812 2004-02-10 Mandrake MDKSA-2003:012 2003-02-03 Yellow Dog YDU-20030127-3 2003-01-27 Gentoo 200301-13 2003-01-22 OpenPKG OpenPKG-SA-2003.003 2003-01-21 Red Hat RHSA-2002:297-17 2003-01-15

Comments (4 posted)

vixie-cron: Local vulnerability

Package(s):	vixie-cron	CVE #(s):	CVE-2001-0559
Created:	April 17, 2003	Updated:	October 3, 2003
Description:	From the ISS advisory: "Vixie Cron is a scheduling daemon that ships with several Linux distributions. Vixie Cron version 3.0pl1 could allow a local attacker to gain root privileges. Crontab fails to properly drop privileges in certain cases after a crontab modification operation. A local attacker could exploit this vulnerability to gain root privileges on the system since crontab is installed setuid root." Note: this vulnerability is dated May 07 2001, and was first mentioned in LWN on the May 10, 2001 security page.
Alerts:	Conectiva CLA-2003:758 2003-10-03 Conectiva CLA-2003:757 2003-10-03 Conectiva CLA-2003:628 2003-04-17

Comments (none posted)

wget:directory traversal bug

Package(s):	wget	CVE #(s):	CAN-2002-1344
Created:	December 10, 2002	Updated:	October 1, 2003
Description:	Versions of wget prior to 1.8.2-4 contain a bug that permits a malicious FTP server to create or overwrite files anywhere on the local file system. FTP clients must check to see if an FTP server's response to the NLST command includes any directory information along with the list of filenames required by the FTP protocol (RFC 959, section 4.1.3). If the FTP client fails to do so, a malicious FTP server can send filenames beginning with '/' or containing '/../' which can be used to direct a vulnerable FTP client to write files (such as .forward, .rhosts, .shosts, etc.) that can then be used for later attacks against the client machine. See also this Bugtraq article from 1997. CAN-2002-1344
Alerts:	Immunix IMNX-2003-7+-011-01 2003-06-03 OpenPKG OpenPKG-SA-2003.007 2003-01-23 SCO Group CSSA-2003-003.0 2003-01-16 Gentoo 200212-7 2002-12-20 Trustix 2002-0089 2002-12-19 Conectiva CLA-2002:552 2002-12-13 Debian DSA-209-1 2002-12-12 Mandrake MDKSA-2002:086 2002-12-11 Red Hat RHSA-2002:229-10 2002-12-04

Comments (none posted)

Wwwoffle remote privilege escalation vulnerability

Package(s):	wwwoffle	CVE #(s):	CAN-2002-0818
Created:	August 14, 2002	Updated:	October 1, 2003
Description:	The wwwoffle web proxy incorrectly processes HTTP PUT and POST requests with negative Content Length values. "It is believed that an attacker could exploit this bug to gain remote wwwrun access to the system wwwoffled is running on." CAN-2002-0818
Alerts:	SCO Group CSSA-2002-048.0 2002-11-18 Debian DSA-144-1 2002-08-06 SuSE SuSE-SA:2002:029 2002-08-01

Comments (none posted)

xinetd: Memory leak in xinetd 2.3.10

Package(s):	xinetd	CVE #(s):	CAN-2003-0211
Created:	May 13, 2003	Updated:	November 13, 2003
Description:	Xinetd is a 'master server' that is used to to accept service connection requests and start the appropriate servers. Because of a programming error, memory was allocated and never freed if a connection was refused for any reason. An attacker could exploit this flaw to crash the xinetd server, rendering all services it controls unavailable. In addition, other flaws in xinetd could cause incorrect operation in certain unusual server configurations. All users of xinetd are advised to update to xinetd-2.3.11 which is not vulnerable to these issues.
Alerts:	Conectiva CLA-2003:782 2003-11-12 Yellow Dog YDU-20030602-1 2003-06-02 Gentoo 200305-08 2003-05-19 Mandrake MDKSA-2003:056 2003-05-14 Red Hat RHSA-2003:160-01 2003-05-13

Comments (none posted)

Resources

Linux Advisory Watch

The May 23 Linux Advisory Watch newsletter from LinuxSecurity.com is available.

Full Story (comments: none)

Page editor: Jonathan Corbet

Kernel development

Brief items

Kernel release status

The current development kernel is 2.5.70, which was released, at long last, on May 26. This massive patch includes the beginning of Alexander Viro's character device rework for a larger dev_t type (see below), some NFS fixes, sysfs support for network devices, an XFS update, some scheduler fixes, a change to the request_module() prototype, some framebuffer fixes, more annotations of user-space pointers and makefile support for Linus's kernel source analyzer, 48-bit IDE addressing support, a (hopefully) working IDE tagged command queueing implementation, the BIO "walking" and splitting APIs, more devfs cleanups (devfs_register() is gone), the USB "gadget" subsystem, a wireless networking update (and quite a bit of networking work in general), dynamic block I/O request allocation, a fair amount of SCSI cleanup work, a generic x86 subarchitecture, a number of TTY layer cleanups, a USB update, several architecture updates, and a vast number of other fixes. See the announcement from Linus for the details, or long-format changlog for lots of really gory details.

As of this writing, Linus's BitKeeper repository contains a FAT filesystem rework (if you have been waiting to be able to create FAT partitions greater than 128GB, this patch is for you), a v850 subarchitecture merge, a RAID update, the removal of the long-deprecated callout TTY device (/dev/cua) support, and several other fixes and updates.

Andrew Morton's -mm tree is currently even more interesting than usual in that it contains a major rework of the ext3 filesystem and generic journaling code. ext3 now uses fine-grained locking - the big kernel lock is no longer used there. "These are major changes to a major filesystem. I would ask that interested parties now subject these patches to stresstesting and to performance testing. The performance gains on SMP will be significant."

For those who are curious about the source checking program that Linus has been working on, a preliminary version is now available via BitKeeper. "It's unfinished enough that I'm a bit embarrassed about some of it, but I've gotten the permission from Transmeta to make it open source."

The current stable kernel is 2.4.20, though 2.4.21 may be out by the time you read this. As of this writing, the fifth 2.4.21 release candidate is available with a small set of fixes. This release has an issue with pauses related to the block subsystem; a small patch exists (and is merged into 2.4.21-rc5-ac1) which fixes this problem.

Comments (1 posted)

Kernel development news

Release management issues

Is the 2.5 kernel ready to move to the next stage? Linus, in the 2.5.70 announcement, talked about his plans to start the pre-2.6 series of releases. That remark drew a complaint: with all that remains broken in 2.5, how could any plan to create a pre-2.6 release be taken seriously? Linus is unsympathetic, however:

This issue comes up over and over again in free software development, of course. Truly getting the bugs fixed requires a very broad base of testers. But most of those testers will not show up until you present them with something billed as "stable" or close to it. Of course, there are dangers in presenting an "almost stable" release too soon; a kernel with too many problems could simply drive those testers away for a long time.

The decision on when to jump into the pre-2.6 series will be a hard one. Quite a few kernel developers seem to think that the time has not yet come. Linus may be ready to make his move sooner rather than later, however. (It is worth noting, incidentally, that the various bureaucratic obstacles to having Andrew Morton work with Linus on the 2.6 release, and eventually take it over, appear to have been overcome. That bodes well for the whole process.)

On the 2.4 front, the official 2.4.21 kernel may be out by the time you read this. No doubt many will be happy to see this long-delayed kernel; 2.4.20 was released on November 28 - a full six months ago. Even so, there are a few complaints, particularly about the omission of a new set of driver fixes. David Miller was one of a few who spoke out:

A few developers seconded this complaint, with one or two, perhaps somewhat prematurely, throwing their hats into the ring to be Marcelo's replacement. Marcelo has responded by saying that things will change - 2.4.22 will come out much more quickly. He has also offered to pass on the 2.4.x responsibility should the community think he is not up to the job. There have not been a whole lot of complaints about the kernels that Marcelo has released, however; the only problem is the frequency with which they are produced. Nobody really wants to see him hand the job off to somebody else. But there will be a lot of eyes on the 2.4.22 release process.

Comments (5 posted)

How should interrupts be balanced?

The programmable interrupt controller on modern (SMP) hardware can be set up to route different interrupts to different processors. When properly programmed, the APIC can help system performance by having each interrupt be handled by the processor which is best suited to the job. At the moment, however, there is not much agreement on how the kernel should be programming the APIC.

The 2.5 kernel contains (for the x86 architecture, at least) an in-kernel interrupt balancing routine. It runs as a separate kernel thread ("kirqd") which wakes up every so often and tries to arrange things so that each processor handles approximately the same interrupt rate. If that can't be done (if, for example, most interrupts come from a single source), interrupts are slowly rotated between the processors. This approach works reasonably well much of the time, but it can fail badly for certain loads.

In particular, the interrupt balancer has trouble with networking loads. The networking code goes out of its way to avoid hardware interrupts - when thousands of packets per second are passing through the system, you don't want the network interface bugging you for every one of them. So a great deal of kernel work may result from a single network interface interrupt. To a simple interrupt balancer, which tries to equalize interrupt counts across a system, a processor handling a heavy networking load may look relatively idle. That processor may find that it gets to deal with a SCSI interface as well, even though it is already overloaded. Even worse, a router could end up with multiple interfaces being handled by a single processor, which still looks lightly loaded.

One can certainly imagine ways to tweak the in-kernel interrupt balancer to make it deal properly with the networking case. But many developers believe that IRQ balancing belongs in user space. A user-space solution can contain whatever complexity is needed to make the right sort of decisions; it also, of course, allows site administrators to set their own policies.

A user-space interrupt balancing daemon exists now; it can be downloaded from Arjan van de Ven's web site. The current implementation is relatively simple, depending mostly on interrupt counts like the in-kernel balancer. It does, however, take pains to distribute interrupts from each type of device across processors. That technique will help network routers, since it will at least keep different interfaces on different processors. But the real point is that this policy can be enhanced and customized as needed.

There is some disagreement about moving interrupt balancing to user space. According to some, only the kernel has the knowledge and the ability to react quickly enough to create optimal interrupt routings. But, chances are that user space will be the eventual home for this task. The real question may be whether the in-kernel interrupt balancer is removed before 2.6.0 comes out.

Comments (none posted)

Another new character device infrastructure

Alexander Viro is definitely back, and he has made good on his promises to rework the character device infrastructure to pave the way for the dev_t transition. A set of patches merged into 2.5.70 shows where things are headed.

Character devices are now represented by their own structure:

	struct cdev {
		struct kobject kobj;
		struct module *owner;
		struct file_operations *ops;
		struct list_head list;
	};

It is expected that a cdev structure will be embedded within larger, subsystem-specific structures. An infrastructure has been set up which lets drivers register character devices with a CIDR-like scheme - any range of device numbers, starting with an arbitrary major and minor number, can be allocated, with more specific allocations overriding wider ranges. It is, in other words, the same scheme that was implemented some time ago for block devices (and which is described in this Driver Porting Series article).

In this scheme, the classic register_chrdev() function is unchanged; it allocates a cdev structure and registers it with minor numbers 0-255. So unmodified char drivers will continue to work - and will not be presented with larger device numbers than before. It expected that, over time, drivers will move away from the register_chrdev() interface and toward working with cdev structures directly.

We'll put out a detailed description of the new interface (as part of the Driver Porting series) once it has had a chance to stabilize a bit.

Comments (none posted)

strlcpy()

Years of buffer overflow problems have made it clear that the classic C string functions - strcpy() and friends - are unsafe. Functions like strncpy(), which take a length argument, have been presented as the safe alternatives. But strncpy() has always been poorly suited to the task; it wastes time by zero-filling the destination string, and, if the string to be copied must be truncated, the result is no longer NULL-terminated. A non-terminated string can lead to overflows and bugs in its own right. So Linus finally got fed up and put together a new copy_string() function which does what most strncpy() users really wanted in the first place.

As is often the case with this sort of security-related improvement, OpenBSD got there first. In fact, back in 1996, the OpenBSD team came up with a new string API which avoids the problems of both strcpy() and strncpy(). The resulting functions, with names like strlcpy(), have been spreading beyond OpenBSD. The basic function is simple:

    size_t strlcpy(char *dest, const char *src, size_t size);

The source string is copied to the destination and properly terminated; the return value is the length of the source. If that length is greater than the destination string, the caller knows that the string has been truncated.

Linus agreed that following OpenBSD's lead was the right way forward, and strlcpy() is in his BitKeeper repository, waiting for 2.5.71. There has also been a flurry of activity to convert kernel code over to the new function. By the time 2.6.0 comes out, strncpy() may no longer have a place in the Linux kernel.

Comments (21 posted)

Patches and updates

Kernel trees

• Linus Torvalds: Linux 2.5.70. (May 27, 2003)

• Andrew Morton: 2.5.70-mm1. (May 27, 2003)

• Stephen Hemminger: 2.5.70-osdl1. (May 28, 2003)

• Andrew Morton: 2.5.69-mm8. (May 22, 2003)

• Andrew Morton: 2.5.69-mm9. "<span>2.5.69-mm9 is not for the timid.</span>" (May 26, 2003)

• Marcelo Tosatti: Linux 2.4.21-rc5. (May 27, 2003)

• Alan Cox: Linux 2.4.21-rc5-ac1. (May 28, 2003)

• Marcelo Tosatti: Linux 2.4.21-rc4. (May 27, 2003)

• Alan Cox: Linux 2.4.21-rc4-ac1. (May 27, 2003)

• Andrea Arcangeli: 2.4.21rc4aa1. (May 27, 2003)

• Hanno: laptopkernel-2.4.21-rc4-laptop1 released. (May 27, 2003)

• Marcelo Tosatti: Linux 2.4.21-rc3. (May 23, 2003)

• Alan Cox: Linux 2.4.21rc2-ac3. (May 22, 2003)

• Disconnect: [ANN} 2.4.21-rc3-dis2 - ACPI-only laptop users, you'll like this one. (May 26, 2003)

• Con Kolivas: 2.4.20-ck7. (May 26, 2003)

Core kernel code

• Rusty Russell: per-cpu support inside modules (minimal). (May 22, 2003)

• Ingo Molnar: signal-latency-2.5.69-B0. (May 26, 2003)

• Erich Focht: Node affine NUMA scheduler extension. (May 27, 2003)

Development tools

• Carl Spalletta: 'fscope': a new debugging tool. (May 27, 2003)

Device drivers

• Greg KH: Again, more USB changes for 2.5.69. (May 26, 2003)

• Greg KH: PCI changes for 2.5.69. (May 26, 2003)

• Grover, Andrew: ACPI updates. (May 26, 2003)

• Jim Keniston: [PATCH] Net device error logging (revised). (May 26, 2003)

• Jeff Garzik: a new SCSI driver. (May 26, 2003)

• Jeff Garzik: add ata scsi driver. (May 26, 2003)

• Jeff Garzik: net driver merges. (May 26, 2003)

• Jeff Garzik: more net driver merges. (May 26, 2003)

• Manuel Estrada Sainz: request_firmware() backport to 2.4 kernels. (May 26, 2003)

• James Bottomley: Round II on sysfs attributes. (May 27, 2003)

• Christoph Hellwig: driver model for scsi upper drivers, take 2. (May 27, 2003)

• Hanna Linder: Input class hook up to driver model/sysfs. (May 28, 2003)

Filesystems and block I/O

• Trond Myklebust: Optimize NFS open() calls by means of 'intents'.... (May 26, 2003)

• Trond Myklebust: Optimize NFS open() calls by means of 'intents'.... (May 26, 2003)

• Trond Myklebust: Optimize NFS open() calls by means of 'intents'.... (May 26, 2003)

• Trond Myklebust: Optimize NFS open() calls by means of 'intents'.... (May 26, 2003)

• Trond Myklebust: Optimize NFS open() calls by means of 'intents'.... (May 26, 2003)

• Jeff Dike: UML filesystems. (May 27, 2003)

Memory management

• William Lee Irwin III: pgcl-2.5.70-1. (May 27, 2003)

Networking

• Jeff Garzik: irda merges. (May 26, 2003)

Architecture-specific

• James Bottomley: 1/2 Add exposure of the irq delivery mask on x86. (May 22, 2003)

• James Bottomley: [PATCH] 2/2 Add exposure of the irq delivery mask on x86 [voyager piece]. (May 22, 2003)

• Jeff Dike: UML updates. (May 27, 2003)

• Greg Ungerer: linux-2.5.70-uc0 (MMU-less fix ups). (May 28, 2003)

Miscellaneous

• Robert Love: procps 2.0.13 with NPTL enhancements. (May 28, 2003)

Page editor: Jonathan Corbet

Distributions

News and Editorials

SuSE Conquers Munich

[This article was contributed by Ladislav Bodnar]

According to this story in Heise Online (in German), the city of Munich is likely to vote this week in favor of migrating its 14,000 PC systems and notebooks and over 16,000 personnel from Windows NT to Linux. Assuming that the transition goes ahead and completes successfully, we will be seeing one of the most significant moments in the history of the Linux operating system. [Ed. update: the vote is in and Linux is in. See this note from SuSE for additional details.]

It is not hard to elaborate on reasons for Munich's intention to move to Linux. The cost of Microsoft licenses, compared to Linux is often cited as a decisive factor, especially from the long term point of view, but the Munich city officials are adamant that cost is only one of the many factors. Flexibility of the open source software as well as the availability of local expertise are equally important.

The article does not specifically mention any Linux distribution by name, but informed sources and common sense all point to the local Linux experts known as SuSE Linux, AG. SuSE's headquarters are in Nürnberg, only about one hour's drive north of Munich. The company offers a range of products from workstations to advanced servers, as well as specialist applications, such as mail servers. They also have a major sponsor and partner in IBM, which will no doubt throw its weight behind the deal.

SuSE's Linux products have frequently received favorable coverage in the computing media, but the recently released version 8.2 has probably seen the largest number of compliments ever given to a Linux product. In its review entitled SuSE 8.2 approaches computing Nirvana, The Register writes: "It appears the company is serious about tempting a mixed-species shop of Linux servers and Windows desktops to harmonize in favor of Linux and thus save considerably on administration costs. Microsoft should worry about the strides SuSE is making in this area."

This NewsForge review agrees: "I have been using SuSE Linux 8.2 Professional for two weeks now, and it is as close to Linux desktop perfection as I have found so far." Many users on various public forums have echoed the sentiment.

One other product, which might come handy during the transition is SuSE Linux Office Desktop. Released in January this year and based on SuSE Linux 8.1, the Office Desktop was specifically designed to ease migration of Windows-based offices to Linux with a selection of useful applications. These include Acronis OS Selector for NTFS partition resizing, StarOffice 6.0, and most importantly, CrossOver Office and its ability to run Microsoft Office 97/2000 applications. This will be especially important to those environments that make extensive use of VBA macros in their office documents. SuSE's Office Desktop has been reviewed by Extreme Tech and MadPenguin.

On the server side of things, the Oracle9i compatible SuSE Linux Enterprise Server 8 (available for i386, AMD64 and Itanium2 processors) and SuSE Linux Openexchange Server 4 are two main enterprise class products from the company. They complement the usual array of support, consultation and certification services, as well as routine security advisory and product update services.

Will the transition be successful? The road will be full of bumps and pot holes, and some users will no doubt resist the change. But SuSE and IBM will make sure that the process is as painless as possible. This will be a valuable experience that will pave a much smoother way for further transitions in other German government and academic institutions. Before we know it, a tidal wave of defections to Linux will be on the way in many parts of the world.

Our warm congratulations to Germany's third largest city for being brave enough to resist Microsoft's earlier cajoling and go where no one has ventured before. Munich is once again making history...

Comments (2 posted)

Distribution News

Debian GNU/Linux

The Debian Weekly News for May 27, 2003 is available, with a look at GNOME 2.3.2 which is now available for testing; a donations wishlist; a proposal to remove Mosix; more MIME improvements to the BTS; and much more.

Anand Kumria reports on some new mailing lists and new documentaion.

Bill Allombert reports on changes to the Debian menu system. Many bugs have been fixed, i18n support is underway, new features have been added, and much more.

Comments (none posted)

Gentoo Weekly Newsletter -- Volume 2, Issue 21

The Gentoo Weekly Newsletter for the week of May 26th, 2003 is out. This week the newsletter looks at hardware failures on the Oregon State mirror, Gentoo Linux is seeking developers for the GNOME team, and Gentoo Linux in the news.

Full Story (comments: none)

Mandrake Linux

Mandrake Linux 9.1 shipped with Mozilla 1.3. Now Mozilla 1.3.1 is available, fixing a number of bugs and added some missing locals.

The lsb packages provided with Mandrake Linux 9.1 were missing the /lib/lsb/init-functions script required by LSB-aware applications. This update provides the missing file.

Comments (none posted)

Slackware Linux

Slackware Linux has several security fixes noted in the stable changelog, and even more changes in the current changelog. Slackware current has a new GCC 3.2.3, KDE 3.1.2, GNU Emacs 21.3, and other fixes and upgrades.

Comments (1 posted)

Setting up SuSE for wireless networking (NewsForge)

Here's a NewsForge article on setting up SuSE Linux 8.2 for wireless networking. "I was excited to set up my brand-spanking-new copy of SuSE Linux Professional 8.2 on a machine I'm planning to use for testing and review. Everything went smoothly except for installation of the Orinoco Silver PC Card network adapter. Several hours and unsuccessful tacks later, I can claim victory, and maybe save you time if you tackle the same task."

Comments (1 posted)

New Distributions

Compledge Sentinel

Compledge Sentinel is a Linux distribution designed for monitoring, auditing and intrusion detection. - a complete solution to solve as many monitoring needs and aspects as possible. A wide variety of open source software is included, such as: Nagios, Nagat, Nessus, Snort, ACID, openMosix, Apache /w OpenSSL, PHP and MySQL. The whole package is distributed on one CD, ready to install on any x86-based computer. Version RC2.1 was released May 22, 2003.

Comments (none posted)

Pingwinek GNU/Linux

Pingwinek GNU/Linux is a Linux distribution made in Poland. The main desktop is GNOME 2.2. It supports only Polish and English languages. Version 0.23 was released May 22, 2003.

Comments (none posted)

Minor distribution updates

AbulEdu

AbulEdu has released stable v1.0.7-II with major feature enhancements. "Changes: This release includes OpenOffice 1.0.3 fr, Mozilla 1.2 fr, Ted 2.13, and Gimp 1.2.3. Booting for X-terminals is now very fast. Lots of abuledu-soft updates were made. Applications from LeTerrier were added. Samba 2.2.8a is used in order to support WinXP-Pro. Lots of new applications were added."

Comments (none posted)

Caixa Mágica

Caixa Mágica has released v8.01 with several bug fixes and improvements.

Comments (none posted)

DietLinux

DietLinux has released v0.1.1 with minor feature enhancements. "Changes: This release features an integrated process for burning a bootable Dietlinux CDROM."

Comments (none posted)

Mindi Linux

Mindi Linux has released v0.85 with code cleanup. "Changes: The failsafe kernel and its modules have been moved to mindi-kernel, an auxiliary package. Mandrake 9.1 is now supported. Support for Debian has been improved."

Comments (none posted)

Phayoune Secure Linux

Phayoune Secure Linux has released v0.3.6 with minor feature enhancements. "Changes: This version updates iptables-1.2.8 and squid-2.5-stable2. The user can choose to use proxy transaparent features with the hard disk (storing cache to save bandwidth) or without the hard disk (filtering URLs for virii without storing cache). It now includes easy installation scripts which allow the user to run the firewall after answering a few questions. It also stores its configuration on a floppy disk."

Comments (none posted)

RedHawk Linux Real-Time Operating System

Concurrent Computer Corporation has announced the release RedHawk Linux real-time operating system, version 1.3.

Comments (3 posted)

Rock Linux

Rock Linux has announced v2.0.0-beta3 of dRock (desktop Rock Linux), with minor feature enhancements. "Changes: This release fixes the next bunch of broken packages, fixes a kernel .config generation bug, includes many package updates (including KDE-3.1.2), and adds some new packages. Each included window manager now registers itself for proper gdm/kdm support. Some of the init scripts were improved, and some initial support for gcc-3.3 was implemented." The main Rock Linux branch has also released v2.0.0-beta3.

Comments (none posted)

ThinStation

ThinStation has released v0.92.cr1 with major feature enhancements. "Changes: This release adds samba-server and samba-client packages, a patch to allow the X server to be started with an XDMCP indirect query, the ability to get thinstation-HOSTNAME.conf as a config file, used in conjunction with thinstation.hosts to simplify custom hosts configuration, the ability to select which nsp-package to build directly inside build.conf, and an lpr package which can be used with samba for printing locally. UPX is now used to compact all executables, to reduce the overall footprint."

Comments (none posted)

uClinux

uClinux has released 20030522 with minor feature enhancements. "Changes: This release adds quite a few new board targets, the Motorola M5282EVB, Hitachi/EDOSK2674, Triscend A7DB and DevA7, and more."

Comments (none posted)

Page editor: Rebecca Sobol

Development

ZWarehouse Shopping Cart

ZWarehouse shopping cart is an online e-commerce system that has been built on the Zope web development platform, the MySQL database, and the Python language. It has been developed by an organization called the Halogen Group.

Some of the ZWarehouse features include:

• Support for multiple languages.
• User-defined currencies.
• Editable regional settings.
• Support for manual and automatic exchange rate calculations.
• Tax configuration by country and region.
• Configurable product attributes.
• Modules for order payment and shipment.
• An administrative interface which requires no programming knowledge.
• A Customer searchable order database.
• Real-time order tracking.
• Editable product attributes.
• Support for multiple payment gateways and credit card processing.

See the ZWarehouse feature list for the full story, or the screenshots page to see ZWarehouse in action.

Version 0.6 Alpha 1 of ZWarehouse shopping cart was recently announced on the Zope Members News. "Among other e-commerce solutions, ZWarehouse has a optimal set of features - allowing Your business to grow without a worry. Zope scalability and perfomance, open-source platform, well-documented interfaces for extensions and several years experience of development team gives You a chance to concentrate on sales and marketing policy." A more detailed list of changes is also available for this version.

ZWarehouse shopping cart includes a RedHat Toaster page which offers the installer step-by-step installation procedures for RedHat versions 8 and 9.

Comments (1 posted)

System Applications

Audio Projects

OggCarton Home Jukebox goes beta (SourceForge)

There's an announcement on SourceForge for the OggCarton project. "OggCarton is a cross-platform CD ripper, database, and web server for Ogg and MP3 files. OggCarton needs no external database or web server. With this release, the OggCarton Home Jukebox software moves from the alpha to the beta stage. Accordingly, binaries and installers for Linux, Mac OS X, and Windows are now available for those who prefer to not roll their own. Full source is still available for those who do. Enjoy!"

Comments (none posted)

Database Software

PostgreSQL Weekly News - May 21st 2003

Here's the latest PostgreSQL Weekly News. This week's big news is the release of 7.3.3.

Full Story (comments: none)

PostgreSQL v7.3.3 available

Version 7.3.3 of the PostgreSQL database is available. "It has been almost three(3) months now since the last release on the v7.3 branch, and there have been several fixes back patched, suitable for production release."

Full Story (comments: none)

Practical database design, Part 1 (IBM developerWorks)

Philipp K. Janert explains database design on IBM's developerWorks. "What are the best choices when designing the schema for a relational database? What is the rationale in deciding in favor of one and against some other alternative? Given the amount of vendor-specific recommendations, it is all too easy to overlook basic relational database fundamentals. In this first of two parts, author Philipp K. Janert talks about simple and complex datatypes, and about primary and foreign keys -- the plumbing that holds the entire database together."

Comments (3 posted)

Electronics

New gEDA software

The latest new software releases from the gEDA (GPL Electronic Design Automation) site include new versions of the Icarus Verilog compiler and gaf (Gschem and Friends).

Comments (none posted)

Xcircuit version 3.1.15 available

Development continues on xcircuit, an electronic schematic drawing program. Version 3.1.15 is available. Change information is in the source code.

Comments (none posted)

Mail Software

Command-Line Email (O'Reilly)

Robert Bernier discusses some email foundations on O'Reilly. "The mid-1990's was a time of evolution. The ordinary person discovered the Internet and the Internet discovered a new purpose. The first RFCs (Requests For Comments) were coming out, describing a standard for email transmissions of images, sounds, and binaries that would overcome the 7-bit ASCII limitations that had been adopted all those years before. MIME or Multipurpose Internet Mail Extensions, was a new standard meant to succeed the patchwork of binary-to-ASCII solutions."

Comments (2 posted)

Printing

Common UNIX Printing System 1.1.19

Version 1.1.19 of CUPS, the Common UNIX Printing System 1.1.19, has been announced. "CUPS 1.1.19 fixes a denial-of-service attack vulnerability and adds support for fast reconfiguration, option retension and defaulting when adding and modifying printers, binary PostScript printing, fax device features, custom web applications via CGI, PHP, Java, and Python, and simple scripting support for Java, Perl, and PHP. The new release also contains bug fixes including the LPD printing and Solaris signal handling bugs."

Comments (none posted)

LinuxPrinting.org news

This week's changes on LinuxPrinting.org include new printer database entries for the the HP DeskJet 450, HP 2500C, 2500CM, and DesignJet ColorPro CAD printers.

Comments (none posted)

Web Site Development

Testing mod_perl 2.0 (O'Reilly)

Geoffrey Young talks about testing mod_perl 2.0 on O'Reilly. "Writing a series of tests that executes against a live Apache server has become much simpler since the advent of Apache-Test. Although Apache-Test, as part of the Apache HTTP Test Project, is generic enough to be used with virtually any version of Apache (with or without mod_perl enabled), it comes bundled with mod_perl 2.0, making it the tool of choice for writing tests for your mod_perl 2.0 modules. "

Comments (none posted)

WebGUI 5.3 (SourceForge)

Version 5.3 of WebGUI, a perl-based content management system, has been released. "WebGUI 5.3 is here and packed with new goodies. It includes a new theme management system that will easily enable you to transport your designs and templates from one site to another with the click of a mouse. 5.3 also includes a new Data Form wobject that allows content managers to build simple data entry applications on the fly. The default rich editor has been upgraded to include direct integration with the collateral manager, spell checking, and emoticons. There is also a brand new trash and clipboard management system which makes it even easier to move your content around. Among dozens of other features there are also over 10 new macros to make your content mangement experience faster and easier."

Comments (2 posted)

ZOPE RPMs Announced (ZopeMembers)

Zope has been packaged in RPM and deb format packages. The Redhat 7.3, 8.0, 9, SuSE 8.0, 8.1, 8.2, and Debian/woody platforms are supported.

Comments (none posted)

ZopeTestCase 0.7.0 Released (ZopeMembers)

Zope Members News has an announcement for version 0.7.0 of ZopeTestCase. "ZopeTestCase is a unit testing framework and TestCase for Zope testing. It is built on PyUnit and the Testing package coming with Zope. Version 0.7.0 includes two bugfixes, a refactored fixture implementation, and better interfaces."

Comments (none posted)

Desktop Applications

Audio Applications

Hydrogen 0.8.0 released

Version 0.80 of Hydrogen, a Gnu/Linux drum machine, has been released with numerous improvements and bug fixes.

Full Story (comments: none)

Tkeca 1.4.0 Released!

Version 1.4.0 of Tkeca, a GUI front-end for the Ecasound audio utility, is available and features a number of new capabilities.

Full Story (comments: none)

Desktop Environments

GNOME Development Series Desktop 2.3.2 (GnomeDesktop)

Gnomedesktop.org has an announcement for version 2.3.2 of the GNOME Development Series Desktop. "This release is an UNSTABLE development series snapshot. It is intended for testing and hacking purposes ONLY. Like the Linux kernel, GNOME uses odd minor version numbers to indicate development status, so this 2.3.x series will eventually become the official 2.4 release." See the GNOME 2.3.2 Changelog for more details.

Comments (none posted)

KDE-CVS-Digest

The May 23, 2003 edition of the KDE-CVS-Digest is out: "Menu usability gets improved. KDE Print gets printer capability access and quite a few bug fixes. Kate now has command line access to variables, similar to Vim commands or Emacs local variables. Plus numerous fixes to keyboard handling, KSpread and Konqueror. All this and more in the latest KDE-CVS-Digest."

Comments (none posted)

KDE Traffic #52

Issue #52 of KDE Traffic is out. Topics include: KDE 3.1.2, KSSL based S/MIME plugin available, Change file permissions using octal numbers, and KDE CVS Commit Policy.

Comments (none posted)

Financial Applications

Release of GnuCash stable version 1.8.4

Version 1.84 of the GnuCash stable series has been released with a long list of additions and fixes.

Full Story (comments: none)

GUI Packages

FLTK 1.1.4rc1 Now Available for Testing

Version 1.1.4rc1 of FLTK, the Fast, Light ToolKit is available. "The FLTK 1.1.4 release is primarily a bug-fix release including fixes to FLUID and the Fl_File_Chooser, Fl_Help_View, Fl_Text_Display, and Fl_Text_Editor widgets. The new release also adds a find method to Fl_Help_View."

Comments (none posted)

Interoperability

Wine Traffic

Issue #171 of Wine Traffic is online. Topics include: TransGaming Product Update, CrossOver Office Review Wine Tech Meeting, Bugzilla Upgraded, Making Mono's Winforms Work, and More BiDi Work?

Comments (none posted)

Office Applications

AbiWord Weekly News

Issue #145 of the AbiWord Weekly News is out. Here's the summary: "Quite a bit of bug squishing, some noteworthy work on Windows and Footnotes and Endnotes exporting to the HTML format await you. Some HIGrrrification? work was done, but no one sent me pretty screen shots :*( Well, maybe next week!"

Comments (none posted)

Evolution 1.4 Release Candidate 1 has been liberated. (GnomeDesktop)

GnomeDesktop.org reports on the release of the Evolution 1.3.92 personal and workgroup information management application. See the release notes for change information.

Comments (none posted)

GNUe Traffic

Issue #82 of GNUe Traffic has been published. Take a look for the latest GNU Enterprise news.

Comments (none posted)

OpenOffice.org 1.1 Beta 2 released

Version 1.1 Beta2 of the OpenOffice.org office suite has been released. "Openoffice.org 1.1 Beta2 represents a significant advance in the application and incorporates the features and changes introduced in the developer builds over the past year. The release includes a massive amount of new and exciting functionality, features and bugfixes compared to the OpenOffice.org 1.0.x releases".

Full Story (comments: none)

Web Browsers

Jazilla Milestone 1 Released (MozillaZine)

According to MozillaZine, the Jazilla project has announced the release of its first milestone. "The Jazilla project aims to rewrite Mozilla in Java. It started shortly after the release of the Netscape Communicator 5.0 source code in 1998 but development petered out in 2000. It was revived by Mathew McBride last year has been completely rewritten to follow a more Mozilla-like architecture (Jazilla Classic was closer to the old Netscape Communicator)."

Comments (none posted)

Tree Branches for Mozilla 1.4 (MozillaZine)

MozillaZine has an announcement for a Mozilla 1.4 branch. "Checkins to this branch require approval from drivers@mozilla.org. Meanwhile, the trunk has been reopened for 1.5 Alpha development. See tinderbox for the latest tree status."

Comments (none posted)

Mozilla Status Update

The May 23, 2003 Mozilla Status Update is out. Topics include: Mozilla Thunderbird, ChatZilla 0.8.31, Documentation, Bookmarks, Junk Mail Controls, View Source, and Tree Status.

Comments (none posted)

Miscellaneous

Krusader Project Needs Developers

According to KDE.News, the Krusader project needs more developers. "Krusader is a twin-panel file manager for KDE, patterned after old-school managers like Midnight Commander and Norton Commander. It features basically all your file-management needs, plus extensive archive handling, mounted filesystems support, ftp and much much more. So far, the project has been developed by two developers, whose time is now not enough to continue the rapid pace of development. If you're a developer and you're interested in Krusader, we need your help!"

Comments (none posted)

Languages and Tools

C

Input Validation in C and C++ (O'ReillyNet)

O'Reilly has published an excerpt from the book Secure Programming Cookbook for C and C++. "Eavesdropping attacks are often easy to launch, but most people don't worry about them in their applications. Instead, they tend to worry about what malicious things can be done to the machine on which the application is running. Most people are far more worried about active attacks than they are about passive attacks."

Comments (none posted)

Caml

Caml Weekly News

The May 20-27, 2003 Caml Weekly News is out. Topics include: Theorem proving example code available, Data structures, and Generating a call-graph.

Full Story (comments: none)

Java

Java theory and practice: Hashing it out (IBM developerWorks)

Brian Goetz writes about Java hashing techniques on IBM's developerWorks. "Every Java object has a hashCode() and an equals() method. Many classes override the default implementations of these methods to provide a higher degree of semantic comparability between object instances. In this installment of Java theory and practice, Java developer Brian Goetz shows you the rules and guidelines you should follow when creating Java classes in order to define hashCode() and equals() effectively and appropriately."

Comments (none posted)

Lisp

SBCL 0.8.0 released

Version 0.8.0 of SBCL is available. "This is a major release with many changes, including support for native threads (on x86 Linux with kernel 2.4 or later), the ability of building SBCL using CLISP as a cross-compilation host, implementations of the MD5 algorithm and the simple-streams interface, and a merge of PCL classes with Common Lisp classes. This version also features better ANSI compliance, an interface to the CLOS MetaObject Protocol, improvements to debugging tools, and more."

Full Story (comments: none)

Perl

This Week on perl5-porters (use Perl)

The May 19-25, 2003 edition of This Week on perl5-porters is online. "Perhaps a bit late, but ready at least, here is your latest P5P summary, full of last week's selected threads. Read about I/O problems and other language issues."

Comments (none posted)

This week on Perl 6 (O'Reilly)

The May 18, 2003 edition of This week on Perl 6 is out with the latest Perl 6 news.

Comments (none posted)

PHP

PHP Weekly Summary

Topics on this week's PHP Weekly Summary include: 4.3.2 RC 4, fd/stdio patch, renaming stream functions, PHP 5 speedups, include_once, require_once, and Apache 2 PATH_TRANSLATED.

Comments (none posted)

PHP 4.3.2RC4 Released

Version 4.3.2RC4 of PHP has been released. "This is the fourth and final release candidate and should have no critical problems/bugs. Nevertheless, please download and test it as much as possible on real-life applications to uncover any remaining issues."

Comments (none posted)

Python

Python 2.2.3 rc 1 (SourceForge)

SourceForge mentions the availability of the first release candidate for Python 2.2.3. "We expect Python 2.2.3 final to be released within a week of this announcement."

Comments (none posted)

Dr. Dobb's Python-URL!

The May 26, 2003 Dr. Dobb's Python-URL! is out with the week's Python news.

Full Story (comments: none)

Python-dev Summary

The Python-dev Summary for the first half of May is now available. It looks at programmer control over dictionary sparseness, default values in classes using slots, a Timbot sighting, and more.

Full Story (comments: none)

Daily Python-URL

Take a look at the Daily Python-URL for a long list of Python-related articles.

Comments (none posted)

Writing good exceptions (IBM developerWorks)

Cameron Laird writes about Python exception handling code on IBM's developerWorks. "A refined exception system is one of the most distinctive advantages modern programming languages offer. Many experienced programmers still don't know, though, how to use exceptions well. Or, perhaps more precisely, they don't use them the way I think best. One consequence, among others, is to damage the security of their systems. So, let's see what we can improve."

Comments (none posted)

Ruby

Ruby-GNOME2 0.5.0 Released! (GnomeDesktop)

GnomeDesktop.org reports on a new release of Ruby-GNOME2, the Ruby language bindings to GNOME 2. "Not much has changed, mostly bugs being fixed and some new classes and methods have been added. The Ruby/GtkSourceView project has been started, allowing use of the GtkSourceView widget from your Ruby programs."

Comments (none posted)

Tcl/Tk

Tcl/Tk 8.4.3 release (SourceForge)

Version 8.4.3 of Tcl/Tk has been announced. A long list of bugs have been fixed, testers are needed.

Comments (none posted)

Dr. Dobb's Tcl-URL!

The May 26, 2003 Dr. Dobb's Tcl-URL! has been published. Take a look for the latest Tcl/Tk news.

Full Story (comments: none)

XML

DocBook XSL Stylesheets V1.61.2 released (SourceForge)

A new version of DocBook XSL Stylesheets is available with the following explanation: "Major bug fix for 1.61.1 and accumulated enhancements and fixes from previous releases."

Comments (none posted)

XML Data Management: Information modeling with XML (IBM developerWorks)

IBM's developerWorks has published an excerpt from the book XML Data Management. "As long as XML was used as a container for data managed by legacy systems, it was sufficient to consider only syntax when building documents. Now that XML is being used to do more than simply express data, it is important to consider grammar and style as well. Obviously, proper syntax is necessary for parsers to be able to accept XML documents at all. Good grammar insures that once XML information has been assimilated, it can be effectively interpreted without an inordinate need for specific (and redundant) domain knowledge on the part of application programs. Good style insures good application performance, especially when it comes to storing, retrieving, and managing information."

Comments (none posted)

XHTML is the Most Important XML Vocabulary (O'Reilly)

Kendall Grant Clark talks about the latest XHTML 2.0 draft. "Taking the long view of recent technology, XHTML may be the most important XML vocabulary ever created. What I mean is not that XHTML will be the most widely deployed XML vocabulary, though if we take the long view, it could be. What I mean is that XHTML puts XML's reputation -- and, by extension, the W3C's reputation -- on the line to a greater degree than any other XML vocabulary."

Comments (none posted)

Profilers

OProfile 0.5.3 has been released

Version 0.5.3 of the OProfile code profiler has been released. This version includes a number of bug fixes and some new features.

Full Story (comments: none)

Miscellaneous

SCons 0.14 released (SourceForge)

Version 0.14 alpha of SCons has been announced. "SCons is a software construction tool (build tool, or substitute for Make) implemented in Python, based on the winning design in the Software Carpentry build tool competition (in turn based on the Cons build tool). This release most notably adds support for Java builds (javac, javah, rmic and jar), and adds integrated Autoconf-like functionality for finding #include files and libraries. This release also contains significant performance improvements from previous releases."

Comments (none posted)

Page editor: Forrest Cook

Linux in the news

Recommended Reading

Meet Linux's New Public Enemy No. 1 (ZDNet)

ZDNet is carrying an interview with Darl McBride, CEO of SCO Group, in which McBride comments: "IBM took the same team that had been working on a Unix code project with us and moved them over to work on Linux code. If you look at the code we believe has been copied in, it's not just a line or two, it's an entire section -- and in some cases, an entire program."

Comments (10 posted)

Major Internet Standards Group Working On Fast Plan To Can Spam (TechWeb)

TechWeb covers the efforts of the Anti-Spam Research Group, an affiliate of the Internet Engineering Task Force. "The ASRG expects quick results, with initial technologies that will take a big bite out of spam being deployed within months, and other key technologies being deployed in one to two years."

Comments (3 posted)

Commentary: IBM will nullify SCO's Linux threat (News.com)

Forrester Research predicts that IBM will build a consortium to pay off SCO--or buy it outright, according to this News.com article. "Enterprises should not stop their Linux plans. Why not? Three reasons based on a risk/benefit analysis. First, the cost-benefit of migrating high-priced Unix on RISC servers to low-cost Linux on Intel servers is highly positive. Second, the risk that tiny SCO can muster the resources to effectively litigate against even one or two of the 1,500 companies it has threatened is low. And three, IBM will further dilute that risk by intervening to eliminate the threat of legal action."

Comments (10 posted)

Novell challenges SCO's Unix claims (CBS MarketWatch)

CBS MarketWatch reports on Novell's challenge to SCO, and quotes SCO CEO Darl McBride as asserting that SCO owns the Unix copyrights. "McBride added that unless more companies start licensing SCO's property, he may also sue Linus Torvalds, who is credited with inventing the Linux operating system, for patent infringement."

Comments (18 posted)

Companies

Dell may join HP in Linux laptop drive (News.com)

CNet covers the overwhelming demand for Linux laptops in Thailand. "HP is producing the low-cost "people's notebook," which is loaded with Linux TLE, the Thai-language version of the Linux operating system, to support a Thai government drive to increase computer ownership, reported the Post earlier this month."

Comments (8 posted)

CIO Update: What You Should Know About IBM's Linux Strategy (ZDNet)

ZDNet has the latest Gartner Group pronouncement on IBM's Linux strategy, complete with lots of pretty diagrams and the "Midrange Server Magic Quadrant." "Gartner estimates that IBM can trace to Linux about $1.2 billion in revenue in 2002 (hardware, software and services), and we project strong overall revenue and profit for IBM from Linux during the next five years."

Comments (1 posted)

EU institutions test alternative to Microsoft (EUobserver)

The EUobserver reports that the EU signed a contract with Microsoft after testing Linux. "While IT-experts recommended the Linux system and said it was as good as Microsoft, the institutions decided to sign a new deal with Microsoft, sources inside the institutions told the EUobserver."

Comments (7 posted)

SCO quits German Linux group (ComputerWorld)

ComputerWorld reports that SCO Group resigned its membership in a German Linux association. "SCO today said it resigned from LIVE Linux-Verband eV, a Dusseldorf-based association that promotes the interests of Linux users and software developers in Germany, after the group notified the company in a recent letter that it might revoke the membership of SCO's German subsidiary, SCO Group GmbH." (Thanks to dododge)

Comments (1 posted)

More articles about SCO (Telepolis and TechWeb)

It seems about every online tech site is running multiple articles about SCO, even though there's really nothing new to report. Here are just a couple more:

TechWeb picks up a CRN interview with Linus Torvalds "In an e-mail response to CRN, Torvalds, widely considered the father of Linux, said he is awaiting judgment until SCO identifies the Unix code IBM allegedly misappropriated and handed over to the open-source community."

Telepolis has this article (in German). "The further development of Linux will most probably be rather untouched by this. Of course, some important developments of the last years have been founded by companies like IBM or SGI. But, if many companies go out of Linux business, this would just be the end of another hype, similiar to the dotcom bubble. Regardless of the law suit's results, it will in no way mean the end of Linux or even just a noteworthy obstacle." (Thanks to Dirk Hillbrecht for the link and the translation.)

Comments (none posted)

Legal

ESR: You can help stop the SCO-vs.-IBM lawsuit

Eric S. Raymond is looking for people who have had read access to proprietary Unix source code without a non-disclosure agreement as part of an effort to fight SCO's lawsuit against IBM.

Full Story (comments: none)

Bunner DVD case goes to the Supreme Court

The Electronic Frontier Foundation has sent out an update on the Bunner ("California") DVD case. The DVDCCA is appealing the previous Appellate Court decision that restricting Mr. Bunner from publishing the DeCSS source was a violation of his free speech rights; the hearing will happen on May 29. Lower court rulings on the publication of code as a free speech activity have been mixed, to say the least, so it will be interesting to see what the Supremes have to say.

Full Story (comments: 5)

Landmark DVD Piracy Case to Test Free Speech (San Jose Mercury News)

Here's a San Jose Mercury News article on the Bunner DVD case, which goes before the California Supreme Court on Thursday. "Four years later, DVD makers, while still fighting numerous legal battles to prevent copying, have been forced to concede their secrets are out the Internet's barn door. However, their case against Bunner lives on and has been transformed into a precedent-setting conflict between the First Amendment and California's tough trade-secret protections."

Comments (1 posted)

Interviews

The ponytail versus the penguin (Economist)

The Economist talks with Sun's Jonathan Schwartz about the company's approach to Linux. "Some software users have started to realise that even Linux is not as free as it appears: for instance, it has to be maintained and upgraded. 'Linux is like a puppy - in the beginning it's great, but you also have to take care of it,' says Mr Schwartz. He hopes that firms will opt for Solaris, because it requires less care."

Comments (13 posted)

The XML.com Interview: Steven Pemberton (O'Reilly)

O'Reilly has published an interview with Steven Pemberton. "At the top of the HTML hierarchy stands Steven Pemberton, chair of the HTML working group of the World Wide Web Consortium (W3C). A lover of language, a writer, and an editor, as well as an organizer and a leader in the web community, he has had both subtle and profound influences over the Web, not only in HTML standards, but in concepts that permeate the Web. He has been at the center of the forces that have been guiding the Web for over a decade."

Comments (none posted)

Resources

AirTraf security (IBM developerWorks)

L. Victor Marks writes about conducting a wireless site survey with the open-source AirTraf utility. "One of the things to pay attention to with wireless security is the usefulness of a site survey. Here, Victor Marks talks about conducting such a survey without having to buy a horrendously expensive software package, and getting immediate feedback and the most effectiveness."

Comments (none posted)

Open Source Content Management arrives (IT-Director)

IT-Director looks at a recent CIO survey on open source content management systems. "[A]s these software applications mature and lose their uniqueness, they become candidates for the open source movement. In the case of content management, a number of open source contenders are emerging but Bricolage, in particular, stands out in terms of capability."

Comments (3 posted)

Polishing Your Linux Laptop Setup (Linux Journal)

Linux Journal takes another look at Linux laptops. "In my past laptop oriented articles, I talked about procedures for installing a base Linux system and setting up GNOME 2.2. This time around, I discuss a few odds and ends that did not quite fit those other two articles but definitely deserve further attention."

Comments (1 posted)

Reviews

From PlayStation to supercomputer (News.com)

News.com looks at a new supercompter made from Sony PlayStation game consoles. "Perhaps the most striking aspect of the project, which uses the open-source Linux operating system, is that the only hardware engineering involved was placing 70 of the individual game machines in a rack and plugging them together with a high-speed Hewlett-Packard network switch. The center's scientists bought 100 machines but are holding 30 in reserve, possibly for high-resolution display application."

Comments (1 posted)

Linux Networx Cluster System Speeds Development of Disease Diagnostic Products (LinuxMedNews)

LinuxMedNews takes a look at a Linux NetworX Evolocity II cluster that speeds gene analysis. "Diagnostics help detect the presence of certain diseases so proper medical treatment can begin in the early stages of the disease. The Linux Networx system analyzes DNA and protein sequences to locate specific disease targets. The targets are then used to develop diagnostic products for diseases that are typically difficult to detect at an early stage, such as ovarian cancer."

Comments (1 posted)

Bits and pieces: Short Linux and computing notes (NewsForge)

Robin 'Roblimo' Miller goes shopping for a laptop in this NewForge article. At least, that's how it starts. Here are some comments about the command line. "Yes, it's nice to learn the inner workings of your software, just as it's good to know how your thyroid gland regulates many of your body's functions, and it's nice to understand the torque convertor in your car's automatic transmission. But most people get along without knowing much about their thyroids or torque convertors, and they can get along without knowing why this or that happens when they click a CD icon to use their CD drive under Linux."

Comments (1 posted)

MySQL (Database Journal)

Database Journal reviews MySQL, with a look at 4.0 (current), 4.1 (alpha) and what to expect in 5.0. "MySQL has come along by leaps and bounds, and the new version 4.0 is barely recognizable when compared with its earlier siblings. I first started using MySQL 3.22, when it was very much a toy, used version 3.23 extensively for websites, but version 4.0 and beyond promises much more. This article is a roadmap showing you the new features already implemented, and those still to come. If you have ever rejected MySQL as a product lacking in required features, maybe it's time to take another look."

Comments (4 posted)

Miscellaneous

Network security tailored to SMBs (IT-Director)

IT-Director is running a Bloor Research pronouncement which looks at secure Linux systems for small businesses. "An alternative to Trustix is Guardian Digital's Linux Lockbox, another Open Source network server appliance designed to serve as a complete secure Internet solution. Like Trustix Secure Linux, Lockbox offers secure Web management and is delivered in a way that requires little in-house Linux expertise, though it is light on the VPN and mail security side."

Comments (none posted)

Page editor: Forrest Cook

Announcements

Non-Commercial announcements

The Open Group on UNIX trademark

The Open Group wants to make sure that everyone knows that the UNIX trademark is theirs, not SCO's. "The Open Group is the owner of the UNIX trademark which it holds on behalf of the industry. This truth has not been entirely visible in the media, even though it is acknowledged on SCO Group products and on their web site."

Full Story (comments: 22)

AUUG calls for SCO to Cease Destructive Actions

The Australian Unix User's Group (AUUG) has sent out this press release concerning SCO. "The Australian UNIX and Open Systems User Group (AUUG, Inc.) today called on SCO (formerly Caldera) to cease its destructive actions and work toward the constructive resolution of any intellectual property (IP) issues SCO has with the Linux and Open Source communities. AUUG further called on SCO to publicly identify any IP violations in Linux so the issues can be resolved as soon as possible." Thanks to Gordon Hubbard.

Comments (none posted)

Open Source Software Institute becomes LPI affiliate

The Linux Professional Institute (LPI) has affiliated with Open Source Software Institute (OSSI) to increase exposure and participation of Linux by corporate, government and academic environments across the United States.

Full Story (comments: none)

GOK awarded first place in Accessibility category Trophées du Libre (GnomeDesktop)

GOK, the gnome onscreen keyboard has received first place in the Accessibility category at the first Trophées du Libre International Free Software Competition.

Comments (none posted)

KDE Accessibility Project Receives Trophy

KDE.News reports that the KDE Accessibility Project has received a trophy for their efforts. "The KDE Accessibility Project is proud to have accepted a trophy at the international Free Software competition Trophées Du Libre in France. The KDEAP received this trophy for a number of accessibility aids, including KMouth, KMag, KMouseTool and the upcoming KDE Text-To-Speech Service. Many thanks and congratulations to everyone who has contributed to these applications!"

Comments (none posted)

Object Application Awards

The finalists of the OMG Object Application Awards 2003 have been announced.

Full Story (comments: none)

Commercial announcements

HP Achieves Linux Clustered Oracle Applications Standard Benchmark

HP has announced that industry-standard HP ProLiant servers running SuSE Linux Enterprise Server 8 have achieved the industry's first clustered Oracle(R) Applications Standard Benchmark (OASB)(1) on Linux.

Comments (none posted)

Just what the doctor ordered

The Royal College of General Practitioners (RCGP) has chosen Trustix and IBM to supply a Linux based e-mail server solution to support the delivery of bulk e-mail to over 6000 GP’s across the United Kingdom.

Full Story (comments: none)

MySQL AB and SAP AG Partner to Build New Open Source Databases

MySQL AB has announced a technology and cross-licensing partnership with SAP AG to give large and medium-sized companies new enterprise-ready open source databases.

Comments (11 posted)

City of Munich goes to Linux

SuSE has issued a press release stating that the city of Munich has decided to move to Linux. "This initiative will see Germany's third largest city migrate 14,000 desktop and notebook computers to Linux." The city has not yet chosen a vendor.

Comments (3 posted)

Pogo Linux CEO Leads Storage Panel at ELF

Pogo Linux, Inc has sent out a press release announcing their presence at the Enterprise Linux Forum Conference & Expo on June 4-6 in Santa Clara, CA.

Full Story (comments: none)

Cross Platform: new versions of Win4Lin and CrossOver Office

NeTraverse announced immediate availability of the next version of the award winning Win4Lin Workstation product. Version 5.0 extends the ability of Win4Lin to help users painlessly bridge from legacy Windows environments to Linux and Open Source infrastructure models.

CodeWeavers has announced CrossOver Office version 2.0.1. This is primarily a bug fix release.

Comments (3 posted)

Resources

GNOME Talks! Part 3 (GnomeDesktop)

The third part of a four part accessibility series on Gnopernicus is available. "In the third (MP3 Audio) of a four-part series about Gnopernicus from the American Council of the Blind, Sun accessibility engineer Marc Mulcachy demonstrates Nautlius and gedit. He also makes a note about the complaints of doing these demostrations using a speech synthesizer that is no longer available, so for this demonstration and the next he will be using of the DecTalk speech synthesizer. He also demonstrates the FreeTTS speech synthesizer."

Comments (none posted)

LDP Weekly News

The May 28, 2003 Linux Documentation Project Weekly News is out with news of the latest documentation updates.

Full Story (comments: none)

Upcoming Events

Infosec 2003

Infosec 2003, the 2nd Congress of Information Security on the Internet, is an online conference that will be held from June 16-20, 2003.

Full Story (comments: none)

KDE Developers' Conference: Call for Papers

A call for papers has gone out for the The KDE Developers' Conference, to be held in Zamek, Nove Hrady, Czech Republic on August 23-25, 2003. "The KDE Developers' Conference is a meeting of KDE contributors from all over the world. It will feature three days of technical talks and tutorials. Do you have a particular expertise related to KDE programming that could be useful for your fellow developers? Do you want to present a particular programming pattern, a tool, a development strategy, or anything else that helps KDE developers become more productive? Then consider talking about it or giving a tutorial at the KDE Developers' Conference."

Comments (none posted)

Linux Fest in Luxembourg

The LiLux Linux User Group will be holding a Linux Fest in Luxembourg on June 21 and 22, 2003.

Full Story (comments: none)

Reports from XML Europe 2003 (O'Reilly)

Uche Ogbuji and Simon St. Laurent report on the activities at the XML Europe Conference. "XML Europe 2003 put the ongoing energy and innovation of the XML community on display, including actual products on the exhibit floor. There was the usual variety of companies displaying editors, scripting tools, XML databases, training and consulting. One important theme was GUI tools for the unsophisticated user. Companies were showing tools which offered a variety of mainstream idioms for processing SVG, XSL FO, Topic Maps, e-business XML formats, and more. There have always been such offerings on display at conferences, but the increasing proportion and sophistication at XML Europe 2003 was notable."

Comments (none posted)

Events: May 29 - July 24, 2003

Date	Event	Location
May 29 - 30, 2003	Open Source Content Management, 2003(OSCOM)	(Harvard Law School)Cambridge, Mass
May 30 - 31, 2003	4th European Tcl/Tk Users Meeting(Tcl'Europe 2003)	Nürnberg, Germany
June 4 - 6, 2003	Enterprise Linux Forum Conference & Expo	(Santa Clara Convention Center)Santa Clara, California
June 9 - 14, 2003	USENIX 2003	(Marriott Hotel)San Antonio, TX
June 10, 2003	Linux For Business	(The Commonwealth Institute)London, England
June 16 - 18, 2003	Yet Another Perl Conference::North America(YAPC::2003)	(Florida Atlantic University)Boca Raton, FL
June 16 - 18, 2003	GNOME User and Developer European Conference(GUADEC)	(Trinity College)Dublin, Ireland
June 16 - 20, 2003	Infosec 2003	(UniNet)Online
June 18 - 23, 2003	Open Source Clinical Application Resource Workshop(OSCAR)	(McMaster University)Ontario, Canada
June 21 - 22, 2003	EuropeanRubyConference	(University of Karlsruhe)Karlsruhe, Germany
June 23 - 26, 2003	ClusterWorld Conference & Expo	(San Jose Convention Center)San Jose, California
June 23 - 26, 2003	Fourth Workshop On UML for Enterprise Applications	(Hyatt Regency San Francisco Airport Hotel)Burlingame, CA
June 24 - 26, 2003	LinuxUser & Developer Expo	(Birmingham National Exhibition Centre)Birmingham, UK
June 25 - 27, 2003	European Python and Zope Conference 2003	(CEME)Charleroi, Belgium
July 7 - 11, 2003	O'Reilly Open Source Convention 2003(OSCON)	(Portland Marriot)Portland, Oregon
July 9 - 12, 2003	Libre Software Meeting	Metz, France
July 10 - 13, 2003	LinuxTag	Karlsruhe, Germany
July 12 - 17, 2003	Debcamp	Oslo, Norway
July 18 - 20, 2003	Debconf 3	(The University of Oslo)Oslo, Norway
July 23 - 26, 2003	Ottawa Linux Symposium	Ottawa Canada
July 23 - 25, 2003	YAPC::Europe 2003	(CNAM Conservatory)Paris, France

Comments (none posted)

Web sites

Open XUL Alliance Site Goes Live (MozillaZine)

According to MozillaZine, the Open XUL Alliance has launched their new site. "The site aims promote XUL and encourage interoperability with a collection of XUL news articles, mailing lists and links."

Comments (none posted)

Software announcements

This week's software announcements

Here are the software announcements, courtesy of Freshmeat.net. They are available in two formats:

• Sorted alphabetically,
• Sorted by license.

Comments (none posted)

Page editor: Forrest Cook