LWN.net Weekly Edition for June 5, 2003

The Eldred Act - toward a restoration of the public domain

Changes to copyright law over the years have (in the U.S. and, increasingly, elsewhere) brought the growth of the public domain to a complete halt. In the U.S., no works have entered the public domain since 1930, with the tiny exception of those put there explicitly by their creators. The extension of copyright terms, with the approval of the Supreme Court, means that the public domain will remain frozen indefinitely.

But the public domain is the ultimate source of almost everything found in new creative works. Whether the subject is fiction, film, or free software, our culture depends on a common pool of ideas. The starvation of the public domain can only serve to dry up that pool. But attempts to cut back on absolute copyright protection via the court system have not been successful. The word from the courts is that this is a matter which must be decided by Congress.

Enter the Eldred Act (or "Public Domain Enhancement Act"). This act would not reduce the period of copyright protection available to anyone. What it would do is require that, after 50 years, copyrights be renewed through the payment of a (very) small fee. Renewal would be required every five years thereafter. The renewal burden would be negligible for anybody who is making any sort of commercial use of copyrighted material. Mickey Mouse would be preserved for generations of Disney stockholders yet unborn.

But the fact is that very little copyrighted material is still being commercially exploited after 50 years. Under current law, all those works remain protected, and almost all of them simply vanish from sight. The Eldred Act would release it all into the public domain, where it can become a common resource.

The proposed law makes a great deal of sense; why maintain copyright protection on works that the copyright holder cannot be bothered to renew? Yet the bill is apparently already being opposed by lobbyist activity in Washington. As part of an effort to show that the lobbyists do not speak for a lot of people, the bill's promoters (including Lawrence Lessig) have set up an online petition where people can show their support. Signing it is a small act, but one which might help restore a more rational direction to copyright law.

Comments (6 posted)

A Look at Ximian Desktop 2

[This article was contributed by Joe 'Zonker' Brockmeier]

With the release of Ximian Desktop 2 right around the corner, I decided to ring up my contact with Ximian to see if I could get a test-drive. By the end of the day Monday I had XD2 installed on my Toshiba laptop running SuSE 8.2.

Before I start talking about the features and such that come with XD2, it's important to note Ximian's target audience. Ximian is not targeting the home user, nor are they targeting long-time Linux users. The Ximian desktop is primarily aimed at corporate desktops. There are a limited number of configuration options, and they're aimed at the needs of desktop workers migrating from Windows. That doesn't mean it's unsuitable for Linux gurus or for the average home user, but I'd say it's less suitable than some other desktop configurations for those users.

The Ximian folks gave me a Red Carpet Express account to test out XD2, so I used the Ximian Red Carpet download installer and went for the full install. The entire install, including the download time, took a little more than an hour over a broadband connection. The public servers might be a little slower, and I'm sure they'll be swamped next Monday for the official release. I wouldn't advise trying to do a download install over dial-up at any time unless you're a very patient person.

As usual, the Ximian Desktop looks fantastic. I realize this is a subjective thing, but I find XD2 to be one of the best-looking desktops on the market -- and that includes the Aqua desktop from Apple. It's not an overly-slick kind of look, that would probably turn off the corporate buyers that Ximian is trying to reach. It's just a nice, clean look that is pleasant to use without being distracting. If aesthetics alone were the deciding factor for corporate desktops, Microsoft would be in deep trouble. Then again, they'd never have gotten where they were in the first place if aesthetics were a big factor.

Speaking of Microsoft, Ximian takes a cue from the folks in Redmond with some desktop icons like "My Computer," "Trash" and a home folder that are all designed to be permanent fixtures. They can be removed, but it isn't as simple as right-clicking on the icon and hitting "Move to Trash." For the corporate desktop, this is a feature -- for the average Linux user, this is annoying. The "My Computer" folder contains the same kind of stuff you'd find on a Windows machine, a printer icon, settings icon, and so on. It's not an exact replica of the Windows setup, but it's probably close enough to be intuitive if you've been using Windows all your computing life.

I found that it's easy to browse to a Samba share using Nautilus, which is a good thing for companies who want to move some users from Windows to Linux. I'm guessing it would have been able to "see" a regular Windows box with file-sharing turned on as well.

XD2 also comes with a brand-new version of Evolution. Unfortunately, Evolution 1.4 is mostly a maintenance release -- there are no new features to speak of, just bug fixes, better integration with GNOME 2 and so on. While I don't want to minimize the importance of bug fixing and so forth, I was hoping for some new features for Evolution. Other than the splash screen, I didn't notice any difference between Evolution 1.4 and 1.2.

The folks at Ximian have done a nice job of sprucing up OpenOffice.org. They've added a whole new set of icons to the toolbars and so on, which isn't a big deal in terms of functionality, but it will probably do more to create a good first impression for former (or soon-to-be former) Microsoft Office users. They've also tweaked OOo to save files in Microsoft Office formats by default, rather than the standard OOo formats. This includes getting rid of the dialog box that warns that you might lose data by saving in other formats. Again, this is a feature that will be a big plus for users moving from Windows to Ximian, but possibly annoying for the average Linux user.

Ximian has also included "Windows metric compatible fonts" in XD2. Basically, this means that the fonts included are supposed to better mimic the default fonts you get with Windows -- making Web browsing and such more like the Windows experience. I don't really worry too much about Web pages looking different, but the XD2 fonts mean that MS Office documents look much more like they're supposed to when you open them in OpenOffice.org and that's a very good thing. Presumably, it will also mean that documents created in OpenOffice.org will look right when opened in Microsoft Office.

Speaking of Web pages. Ximian defaults to Galeon as its Web browser, rather than Mozilla. Since I usually use Mozilla, I wasn't sure I'd like the switch, but I really didn't notice much difference. One nice thing is that Ximian pre-installs the regular suspects when it comes to plugins, so you'd have Java, Flash and the rest from the beginning rather than having to download them separately. This is in the Professional edition of XD2 -- so if you're doing the free download, you're still going to have to go hunting for some of the plugins, Adobe Acrobat Reader, and you won't get the Agfa fonts.

Though I think XD2 is a great desktop, there are some areas for improvement. For example, one of the first things I do when I do a fresh install is to set the resident window manager or desktop environment to move windows transparently. I couldn't find a way to do this using any of the apps in XD2's Personal Settings panel. I'm also puzzled because Ximian installs a "Format a Floppy" icon by default under the "System Tools" menu -- despite the fact that the machine has no floppy drive.

Overall, though, I think that Ximian has delivered a great desktop for their target audience. Whether corporations take it up or not is another story, but here's hoping.

Comments (10 posted)

The end of the NIC

The "New Internet Computer" (NIC) was another one of Larry Ellison's Big Ideas: a low-price, hassle-free Linux-based computer which limited itself to Internet activity. It was essentially a browser with a bit of accompanying hardware. There was no hard disk; Linux would boot off a CDROM and what little data needed to be stored went into flash memory. At $200, it seemed like a cheap and easy way to get Linux onto desktops - and counter tops - where it had previously failed to go. LWN covered the NIC release back in July, 2000.

So much for that idea; three years later, as reported by ZDNet, the New Internet Computer Company is shutting down. Sales have been scarce, and the company was unable to come up with another round of financing. When you have a company that is not making money, there are really only a couple of choices: find an excuse to sue IBM, or shut down gracefully. NIC chose the latter path.

The Linux-based thin client (or "Internet appliance") product once looked like a good idea. Many people just want to play around on the net, and don't want to hassle with computers, software installations, drive failures, viruses, etc. Why not provide them with a simple box which handles this basic task and doesn't ask for any care and feeding?

The answer would seem to be that, when people want a computer, they want a real, general purpose computer. For the price of a NIC, it is possible to find real systems which can be customized, enhanced with additional software, and generally made more useful. People naturally shy away from a system which appears to offer reduced functionality or to be, in some way, crippled. This is, perhaps, especially true when people are looking at Linux systems, which ordinarily offer a greater degree of control than proprietary alternatives.

There may yet come a time when everything one might want is available as a web service, and users want little more than a display with a browser and a "buy" button. But, for now, it appears that the general purpose computer has not yet completed its run.

Comments (12 posted)

A few SCO notes

Things have been relatively quiet on the SCO front this week. The world is waiting for SCO to put up some evidence, and SCO management has not come up with any new ways to upset the Linux community. Still, a few things are worth mentioning.

SCO held a conference call on May 30 to explain its position. Executive summary: they claim to own the Unix copyrights, but it doesn't matter because the IBM suit is based on contracts. For more information see LWN's quick writeup or the complete transcript posted by Karsten Self.

LWN has decided not to request access to SCO's evidence under their non-disclosure agreement (which has been posted by the Linux Journal). Our ability to write about important topics, along with our continued ability to contribute to projects like the kernel, is more important than early access to SCO's exhibits. Besides, SCO's oft-repeated statements about the useful value of contracts as a vehicle for lawsuits suggests that they might be a good company to not sign contracts with.

LinuxTag's complaint against SCO in Germany, mentioned briefly here last week, has had some success: rather than put up its proof as demanded, SCO chose to shut down its German web site. The links to its "letter to Linux users" have also been removed from the SCOsource web page. It is a temporary situation, but, for now, SCO has chosen silence over backing up its claims.

News.com has tracked down a copy of the 1995 contract between SCO and Novell - the one which transferred (or didn't) Unix to SCO. Reading the contract seemingly does not make the situation any clearer; the contract looks like a muddy mess. Resolving who really owns the Unix copyrights looks like a job for the courts.

Finally, for some amusement, see Modern SCO Executive, an extreme exercise in fair use by Moen, Self, Gilbert, and Sullivan.

Comments (4 posted)

A quick LWN update

It's been a while since we've run one of these update articles, which is generally a good thing. We'd rather be talking about what is going on in the Linux community than ourselves. But every now and then somebody asks for an update, so here goes...

The subscription count remains, more or less, level. We went through the expiration of all the six-month subscriptions that people took out back at the beginning in reasonably good form, which is a good thing. But the rate of growth at this point is very low. We've begun to increase traffic with some careful, targetted advertising (mostly on Google for the moment) with some results. More needs to be done, however. The subscription level is still not at the level it needs to reach for LWN to be a long-term stable operation.

Advertising on the LWN site has been a little higher through the last few months. We would like to encourage everybody to remember the LWN text ad system, however. It is an effective and inexpensive way to get your message out to the Linux community and support LWN at the same time.

It is worth noting that it has now been one year since LWN switched over to the new site code and format. There were a lot of complaints at the time, but our readers appear to have gotten used to the new way of doing things. The new code has significantly reduced the effort it takes to put LWN together every week, has enabled the formation of a strong (and opinionated) community of commenters, and, of course, has let us set up the whole subscription system. We believe it was worth it, even if there are still a lot of rough edges in need of smoothing.

Thanks, as always, for supporting LWN.

Comments (19 posted)

Page editor: Jonathan Corbet

Security

Brief items

Algorithmic compexity attacks

Scott Crosby and Dan Wallach have announced a paper describing a new class of security problem that they call "algorithmic complexity attacks." The basic idea is simple: predictable behavior in certain application algorithms can be exploited by attackers to create denial of service problems; these attacks can be easy to mount and require very low amounts of bandwidth. The full paper describes this sort of attack in detail, with a strong emphasis on hash tables. The authors promote a particular class of hashing algorithm ("universal hash") as a way of fixing the problem.

The networking hash vulnerability described here two weeks ago clearly falls into this category of problem. (This vulnerability, incidentally, is still unfixed by any distributors beyond Red Hat and EnGarde). Mr. Crosby has also found a similar problem in the Linux kernel directory entry cache code; an attacker who has control over file names can force behavior which slows the system to a crawl.

The interesting thing is that, once one starts looking, this sort of vulnerability is widespread. For example:

• Languages like Perl and Python provide hashed data structures (associative arrays and dictionaries). If an application uses user input as a key for such a structure, that application can be vulnerable to attack. The paper demonstrates the degree to which Perl arrays can degrade with carefully chosen input.

• Regular expressions are widely used in applications. Anybody who has programmed with non-trivial regular expressions knows that they can be hard to get right in the first place. But writing regular expressions which do not bring the application down in flames when confronted with the wrong input is even harder.

Chances are many applications suffer from this sort of vulnerability. It may soon be that distributed denial of service attacks pass out of favor; if an algorithmic complexity attack is available, there is no real point in going to the effort of assembling the attack network.

Sadly, it may well turn out that free software applications are uniquely vulnerable to algorithmic complexity attacks - at least, in the short term. Mounting such an attack requires a reasonably well advanced understanding of which algorithms an application is using, and how it is using them. Closed-source applications will certainly have (at least) as many algorithmic complexity vulnerabilities as free applications, but the lack of source will make those vulnerabilities hard to exploit. In the longer term, of course, the situation may reverse itself; the vulnerabilities in free programs will have been found and fixed, while those in proprietary code lurk on, waiting for an exploit to be developed.

Comments (5 posted)

New vulnerabilities

ghostscript: command execution vulnerability

Package(s):	ghostscript	CVE #(s):	CAN-2003-0354
Created:	June 2, 2003	Updated:	June 16, 2003
Description:	A flaw in unpatched versions of Ghostscript before 7.07 allows malicious postscript files to execute arbitrary commands even with -dSAFER enabled.
Alerts:	Gentoo 200306-08 2003-06-14 Yellow Dog YDU-20030607-1 2003-06-07 Mandrake MDKSA-2003:065 2003-06-10 OpenPKG OpenPKG-SA-2003.030 2003-06-03 Red Hat RHSA-2003:181-01 2003-05-30

Comments (none posted)

gPS: multiple vulnerabilities

Package(s):	gPS	CVE #(s):
Created:	May 29, 2003	Updated:	June 3, 2003
Description:	gPS is a graphical application to watch system processes. In release 1.1.0 of the gps package, several security vulnerabilities were fixed, including several buffer overflows and a problem where any host could connect to the server.
Alerts:	Debian DSA-307-1 2003-05-27

Comments (none posted)

kon2: buffer overflow allows local users to obtain root privileges

Package(s):	kon2	CVE #(s):	CAN-2002-1155
Created:	June 3, 2003	Updated:	June 16, 2003
Description:	KON is a Kanji emulator for the console. There is a buffer overflow vulnerability in the command line parsing code portion of the kon program up to and including version 0.3.9b. This vulnerability, if appropriately exploited, can lead to local users being able to gain elevated (root) privileges.
Alerts:	Gentoo 200306-07 2003-06-14 Mandrake MDKSA-2003:064 2003-06-05 Red Hat RHSA-2003:047-01 2003-06-03

Comments (none posted)

tomcat: insecure directory mode

Package(s):	tomcat	CVE #(s):
Created:	June 2, 2003	Updated:	June 3, 2003
Description:	Versions prior to tomcat-4.1.24 created /opt/tomcat with a directory mode which allowed users to access files containing passwords.
Alerts:	Gentoo 200306-01 2003-06-01

Comments (none posted)

uw-imapd: vulnerabilities in IMAP clients written with C and C++

Package(s):	uw-imapd	CVE #(s):
Created:	June 2, 2003	Updated:	June 3, 2003
Description:	There are two common vulnerabilities in IMAP clients written with C and C++: 1. Handling huge literal sizes. Many clients do malloc(literal_size+1) and then read the literal into it. Problem is that if literal_size is UINT_MAX-1, the +1 overflows it into malloc(0) but server is still allowed to write UINT_MAX-1 bytes of data there. There may also be similiar problems if literal size is read into signed integer which causes it to become negative. Some clients use atoi(), so giving -1 as literal size is equilevant to giving UINT_MAX-1. IMAP servers can also be vulnerable to this one if they're not careful. 2. Handling huge mailbox sizes (ie. huge value in EXISTS reply). Many clients do malloc(messages_count * sizeof(struct message)) and read data into it. Read the full advisory for more information.
Alerts:	Gentoo 200305-12 2003-06-01

Comments (none posted)

Updated vulnerabilities

Apache 2 - denial of service

Package(s):	apache	CVE #(s):	CAN-2003-0189 CAN-2003-0245
Created:	May 28, 2003	Updated:	June 16, 2003
Description:	A new set of denial of service vulnerabilities has been found in Apache versions 2.0 through 2.0.45. The potential for a remote code exploit apparently exists as well. See the Apache 2.0.46 announcement for more information.
Alerts:	Conectiva CLA-2003:661 2003-06-16 Yellow Dog YDU-20030603-1 2003-06-03 Mandrake MDKSA-2003:063-1 2003-06-02 Gentoo 200305-13 2003-06-01 Mandrake MDKSA-2003:063 2003-05-30 Red Hat RHSA-2003:186-01 2003-05-28

Comments (none posted)

bind buffer overflow vulnerability in DNS resolver libraries

Package(s):	bind glibc	CVE #(s):	CAN-2002-0651 CAN-2002-0684
Created:	July 8, 2002	Updated:	October 1, 2003
Description:	The BIND 4.9.8-OW2 patch and BIND 4.9.9 release (and thus 4.9.9-OW1) include fixes for a libc related vulnerability which does not affect Linux. Updates from the Internet Software Consortium (ISC) are available from here. No release or branch of Openwall GNU/*/Linux (Owl) is known to be affected, due to Olaf Kirch's fixes for this problem getting into the GNU C library more than two years ago. Unfortunatly that does not mean that Linux systems are not vulnerable. Similar code, without Olaf Firch's fixes, is in the glibc getnetbyXXX functions. These functions are described in the SuSE alert as " used by very few applications only, such as ifconfig and ifuser, which makes exploits less likely." CERT Advisory: CA-2002-19 Buffer Overflow in Multiple DNS Resolver Libraries CAN-2002-0651 CAN-2002-0684
Alerts:	Mandrake MDKSA-2002:050 2002-08-13 Yellow Dog YDU-20020810-3 2002-08-10 Eridani ERISA-2002:035 2002-08-09 Red Hat RHSA-2002:133-13 2002-08-08 SCO Group CSSA-2002-034.0 2002-08-05 Yellow Dog YDU-20020801-2 2002-08-01 Eridani ERISA-2002:028 2002-07-25 Red Hat RHSA-2002:139-10 2002-07-22 EnGarde ESA-20020724-018 2002-07-24 Mandrake MDKSA-2002:043 2002-07-16 Trustix 2002-0061 2002-07-15 Gentoo glibc-20020713 2002-07-13 Conectiva CLA-2002:507 2002-07-11 SuSE SuSE-SA:2002:026 2002-07-09 OpenPKG OpenPKG-SA-2002.006 2002-07-04

Comments (1 posted)

Canna server: exploitable buffer overrun

Package(s):	canna	CVE #(s):	CAN-2002-1158 CAN-2002-1159
Created:	December 10, 2002	Updated:	October 1, 2003
Description:	Canna is a kana-kanji conversion server which is necessary for Japanese language character input. A buffer overflow bug in the Canna server up to and including version 3.5b2 allows a local user to gain the privileges of the user 'bin' which could lead to further exploits. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-1158 to this issue. A lack of validation of requests has been found that affects Canna version 3.6 and earlier. A malicious remote user could exploit this vulnerability to leak information, or cause a denial of service attack. (CAN-2002-1159) See also http://canna.sourceforge.jp/sec/Canna-2002-01.txt CAN-2002-1158 CAN-2002-1159
Alerts:	SCO Group CSSA-2003-005.0 2003-01-21 Debian DSA-224-1 2002-01-08 Gentoo 200212-8 2002-12-20 Red Hat RHSA-2002:246-18 2002-12-04

Comments (none posted)

CUPS: vulnerability in the CUPS IPP implementation

Package(s):	cups	CVE #(s):	CAN-2003-0195
Created:	May 27, 2003	Updated:	July 22, 2003
Description:	Phil D'Amore of Red Hat discovered a vulnerability in the CUPS IPP (Internet Printing Protocol) implementation. The IPP implementation is single-threaded, which means only one request can be serviced at a time. An attacker could make a partial request that does not time out and therefore creates a denial of service. In order to exploit this bug, an attacker must have the ability to make a TCP connection to the IPP port (by default 631).
Alerts:	Conectiva CLA-2003:702 2003-07-22 Gentoo 200306-09 2003-06-14 Debian DSA-317-1 2003-06-11 SuSE SuSE-SA:2003:028 2003-06-06 Yellow Dog YDU-20030602-3 2003-06-02 Mandrake MDKSA-2003:062 2003-05-29 Slackware ssa:2003-149-01 2003-05-29 Red Hat RHSA-2003:171-01 2003-05-27

Comments (none posted)

dvips: command execution vulnerability

Package(s):	dvips	CVE #(s):	CAN-2002-0836
Created:	October 16, 2002	Updated:	June 10, 2003
Description:	The dvips utility uses the system() function improperly when managing fonts. An attacker who can craft the right sort of print job can use this vulnerability to execute commands under the UID used by the print system.
Alerts:	Immunix IMNX-2003-7+-016-01 2003-06-09 OpenPKG OpenPKG-SA-2002.015 2002-12-16 Debian DSA-207-1 2002-12-11 Conectiva CLA-2002:537 2002-10-29 Mandrake MDKSA-2002:071 2002-10-24 Mandrake MDKSA-2002:070 2002-10-23 Gentoo tetex-20021018 2002-10-18 Red Hat RHSA-2002:194-18 2002-10-08

Comments (none posted)

ethereal - format string vulnerability

Package(s):	ethereal	CVE #(s):	CAN-2003-0081
Created:	March 10, 2003	Updated:	June 12, 2003
Description:	The SOCKS dissector in Ethereal 0.9.9 is susceptible to a format string overflow. This vulnerability has been present in Ethereal since the SOCKS dissector was introduced in version 0.8.7. It was discovered by Georgi Guninski. Additionally, the NTLMSSP code is susceptible to a heap overflow. All users of Ethereal 0.9.9 and below are encouraged to upgrade. See the full advisory for additional information.
Alerts:	Mandrake MDKSA-2003:051 2003-03-24 Red Hat RHSA-2003:076-01 2003-04-23 Conectiva CLA-2003:627 2003-04-16 SuSE SuSE-SA:2003:019 2003-03-21 Debian DSA-258-1 2003-03-10 Gentoo 200303-10 2003-03-09

Comments (none posted)

Filename disclosure vulnerability in fam

Package(s):	fam	CVE #(s):	CAN-2002-0875
Created:	August 19, 2002	Updated:	January 5, 2005
Description:	"fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible.
Alerts:	Red Hat RHSA-2005:005-01 2005-01-05 Debian DSA-154-1 2002-08-15

Comments (none posted)

fetchmail: buffer overflow

Package(s):	fetchmail	CVE #(s):	CAN-2002-1365
Created:	December 17, 2002	Updated:	October 20, 2003
Description:	Versions of fetchmail prior to 6.2.0 have (yet another) buffer overflow vulnerability which can be exploited remotely via a suitably crafted message. See this advisory for details.
Alerts:	Immunix IMNX-2003-7+-023-01 2003-10-17 Mandrake MDKSA-2003:011 2003-01-27 EnGarde ESA-20030127-002 2003-01-27 SCO Group CSSA-2003-001.0 2003-01-09 SuSE SuSE-SA:2003:001 2003-01-02 Debian DSA-216-1 2002-12-24 Red Hat RHSA-2002:293-09 2002-12-17 Conectiva CLA-2002:554 2002-12-16

Comments (3 posted)

file - memory allocation problem, stack overflow

Package(s):	file	CVE #(s):	CAN-2003-0102
Created:	March 4, 2003	Updated:	June 4, 2003
Description:	Jeff Johnson found a memory allocation problem and David Endler found a stack overflow corruption problem in the file "Automatic File Content Type Recognition Tool" version 3.41. Nalin Dahyabhai improved ELF section and program header handling in file version 3.40. The folks at OpenPKG believe that file versions without those modifications are vulnerable to memory allocation and stack overflow problems which put security at risk.
Alerts:	Immunix IMNX-2003-7+-012-01 2003-06-03 SCO Group CSSA-2003-018.0 2003-04-28 Mandrake MDKSA-2003:030-1 2003-04-17 Conectiva CLA-2003:617 2003-04-04 SuSE SuSE-SA:2003:017 2003-03-21 Debian DSA-260-1 2003-03-13 Gentoo 200303-8 2003-03-08 EnGarde ESA-20030307-008 2003-03-07 Red Hat RHSA-2003:086-07 2003-03-07 Mandrake MDKSA-2003:030 2003-03-06 OpenPKG OpenPKG-SA-2003.017 2003-03-04

Comments (none posted)

Potential remote root exploit in glibc

Package(s):	glibc	CVE #(s):	CAN-2002-0391
Created:	August 14, 2002	Updated:	June 30, 2003
Description:	Felix von Leitner, discovered a potential division by zero bug in code derived from the SunRPC library which is used in glibc.This bug could be exploited to gain unauthorized root access to software linking to glibc. Updating as soon as practical is a good idea. Because SunRPC-derived XDR libraries are used by a variety of vendors in a variety of applications, this defect may lead to a number of differing security problems. Exploiting this vulnerability will lead to denial of service, execution of arbitrary code, or the disclosure of sensitive information. CERT/CC Vulnerability Note VU#192995 Integer overflow in xdr_array() function when deserializing the XDR stream
Alerts:	Debian DSA-333-1 2003-06-27 Conectiva CLA-2002:535 2002-10-29 Trustix 2002-0070 2002-10-17 EnGarde ESA-20021003-021 2002-10-03 Gentoo glibc-20020927 2002-09-27 Gentoo dietlibc-20020927 2002-09-27 Debian DSA-149-2 2002-09-26 Mandrake MDKSA-2002:061 2002-09-23 Gentoo glibc-20020905 2002-09-05 SuSE SuSE-SA:2002:031 2002-08-30 Trustix 2002-0067 2002-08-13 Eridani ERISA-2002:036 2002-08-13 Red Hat RHSA-2002:166-07 2002-08-12 Debian DSA-149-1 2002-08-13

Comments (none posted)

glibc: DNS stub resolvers contain buffer overflow vulnerability

Package(s):	glibc	CVE #(s):	CAN-2002-1146
Created:	November 7, 2002	Updated:	February 5, 2004
Description:	DNS stub resolvers from multiple vendors contain a buffer overflow vulnerability. The impact of this vulnerability appears to be limited to denial of service. (See CERT Vulnerability Note VU#738331) The BIND 4 and BIND 8.2.x stub resolver libraries, and other libraries such as glibc 2.2.5 and earlier, libc, and libresolv, uses the maximum buffer size instead of the actual size when processing a DNS response, which causes the stub resolvers to read past the actual boundary ("read buffer overflow"), allowing remote attackers to cause a denial of service (crash).
Alerts:	Mandrake MDKSA-2004:009 2004-02-04 Red Hat RHSA-2002:197-09 2002-11-06 Red Hat RHSA-2002:197-06 2002-10-03

Comments (none posted)

gnupg: key validation

Package(s):	gnupg	CVE #(s):	CAN-2003-0255
Created:	May 16, 2003	Updated:	November 18, 2003
Description:	A key validation bug was discovered in the GNU Privacy Guard (GPG) which would cause keys with more then one user ID to trust all user ID's with the amount of trust given to the most-valid user ID.
Alerts:	SCO Group CSSA-2003-034.0 2003-11-17 Conectiva CLA-2003:694 2003-07-11 Yellow Dog YDU-20030602-4 2003-06-02 Mandrake MDKSA-2003:061 2003-05-22 Slackware ssa:2003-141-04 2003-05-22 Red Hat RHSA-2003:175-01 2003-05-20 Gentoo 200305-04 2003-05-16 OpenPKG OpenPKG-SA-2003.029 2003-05-16 EnGarde ESA-20030515-016 2003-05-15

Comments (none posted)

gtkhtml: malformed messages cause crash

Package(s):	gtkhtml	CVE #(s):	CAN-2003-0133 CAN-2003-0541
Created:	April 14, 2003	Updated:	April 18, 2005
Description:	GtkHTML is the HTML rendering widget used by the Evolution mail reader. GtkHTML supplied with versions of Evolution prior to 1.2.4 contain a bug when handling HTML messages. Alan Cox discovered that certain malformed messages could cause the Evolution mail component to crash.
Alerts:	Debian DSA-710-1 2005-04-18 Mandrake MDKSA-2003:093 2003-09-18 Conectiva CLA-2003:737 2003-09-12 Red Hat RHSA-2003:264-01 2003-09-09 Mandrake MDKSA-2003:046 2003-04-15 Red Hat RHSA-2003:126-01 2003-04-14

Comments (none posted)

IMP - SQL injection vulnerability

Package(s):	imp	CVE #(s):	CAN-2003-0025
Created:	January 15, 2003	Updated:	July 8, 2003
Description:	The IMP IMAP server, versions 2.2.8 and prior, is vulnerable to SQL injection; see this advisory for details. Version 3.x is not vulnerable to this problem.
Alerts:	Conectiva CLA-2003:690 2003-07-08 SuSE SuSE-SA:2003:0008 2003-02-18 Debian DSA-229-2 2003-01-15

Comments (1 posted)

kde: arbitrary code execution

Package(s):	kde	CVE #(s):	CAN-2003-0204
Created:	April 10, 2003	Updated:	June 30, 2003
Description:	The KDE Security team has issued an advisory on a vulnerability present in all versions of KDE that allow a remote attacker to execute arbitrary commands under your account. KDE 3.0.5b and KDE 3.1.1a have been released to address this problem. For KDE 2.2.2 patches to the KDE 2.2.2 sources have been made available. KDE uses Ghostscript software for processing of PostScript (PS) and PDF files in a way that allows for the execution of arbitrary commands that can be contained in such files. An attacker can prepare a malicious PostScript or PDF file which will provide the attacker with access to the victim's account and privileges when the victim opens this malicious file for viewing or when the victim browses a directory containing such malicious file and has file previews enabled. An attacker can provide malicious files remotely to a victim in an e-mail, as part of a webpage, via an ftp server and possible other means.
Alerts:	Conectiva CLA-2003:668 2003-06-30 Red Hat RHSA-2003:002-01 2003-05-12 Debian DSA-296-1 2003-04-30 Mandrake MDKSA-2003:049-1 2003-04-24 SuSE SuSE-SA:2003:0026 2003-04-24 Debian DSA-293-1 2003-04-23 Slackware sl-1050682024 2003-04-18 Mandrake MDKSA-2003:049 2003-04-17 Sorcerer SORCERER2003-04-12 2003-04-12 Debian DSA-284-1 2003-04-12 Gentoo 200304-05 2003-04-11 Gentoo 200304-04 2003-04-10

Comments (none posted)

kernel - ptrace-related vulnerability

Package(s):	kernel	CVE #(s):	CAN-2003-0127
Created:	March 17, 2003	Updated:	June 30, 2003
Description:	Versions 2.2.x and 2.4.x of the Linux kernel contain a vulnerability in ptrace() which may be exploited by a local user to obtain root access. This announcement contains the details and a patch for 2.4.20. For 2.2 users, 2.2.25 has been released which contains the fix.
Alerts:	Debian DSA-336-2 2003-06-29 Debian DSA-336-1 2003-06-29 Debian DSA-332-1 2003-06-27 Red Hat RHSA-2003:098-03 2003-06-02 SCO Group CSSA-2003-020.0 2003-05-09 Mandrake MDKSA-2003:038-1 2003-04-09 Red Hat RHSA-2003:135-00 2003-04-08 Conectiva CLA-2003:618 2003-04-07 Debian DSA-276-1 2003-04-03 Mandrake MDKSA-2003:039 2003-03-27 Mandrake MDKSA-2003:038 2003-03-27 Debian DSA-270-1 2003-03-27 SuSE SuSE-SA:2003:021 2003-03-25 Gentoo 200303-17 2003-03-21 Sorcerer SORCERER2003-03-19 2003-03-20 Red Hat RHSA-2003:088-01 2003-03-20 EnGarde ESA-20030318-009 2003-03-18 Trustix 2003-0007 2003-03-18 Red Hat RHSA-2003:098-00 2003-03-17

Comments (none posted)

kernel 2.4 - two new vulnerabilities

Package(s):	kernel	CVE #(s):	CAN-2003-0244 CAN-2003-0246
Created:	May 14, 2003	Updated:	July 25, 2003
Description:	The 2.4.20 (and prior) kernel contains a couple of vulnerabilities that are worth fixing. The ioperm() system call doesn't perform proper checking, allowing a local user to manipulate arbitrary I/O ports. The networking code contains a remotely exploitable denial of service condition; see the May 24 Security Page for details.
Alerts:	Mandrake MDKSA-2003:066-2 2003-07-25 Conectiva CLA-2003:701 2003-07-22 Mandrake MDKSA-2003:066-1 2003-07-21 Mandrake MDKSA-2003:074 2003-07-15 Slackware SSA:2003-168-01 2003-06-17 Mandrake MDKSA-2003:066 2003-06-11 Debian DSA-312-1 2003-06-09 Debian DSA-311-1 2003-06-08 Red Hat RHSA-2003:187-01 2003-06-03 Red Hat RHSA-2003:145-01 2003-05-27 EnGarde ESA-20030515-017 2003-05-15 Red Hat RHSA-2003:172-00 2003-05-14

Comments (2 posted)

kernel-utils: setuid vulnerability

Package(s):	kernel-utils	CVE #(s):	CAN-2003-0019
Created:	February 7, 2003	Updated:	January 21, 2005
Description:	The kernel-utils package contains several utilities that can be used to control the kernel or machine hardware. In Red Hat Linux 8.0 this package contains user mode linux (UML) utilities. The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was incorrectly shipped setuid root. This could allow local users to control certain network interfaces, add and remove arp entries and routes, and put interfaces in and out of promiscuous mode. All users of the kernel-utils package should update to these packages that contain a version of uml_net that is not setuid root. Alternatively, as a work-around to this vulnerability issue the following command as root: chmod -s /usr/bin/uml_net
Alerts:	Red Hat RHSA-2003:056-08 2003-02-07

Comments (none posted)

kopete: vulnerabiliy in GnuPG plugin

Package(s):	kopete	CVE #(s):	CAN-2003-0256
Created:	May 8, 2003	Updated:	June 27, 2003
Description:	A vulnerability was discovered in versions of kopete prior to 0.6.2. Kopete is a KDE instant messenger client. This vulnerabiliy is in the GnuPG plugin that allows for users to send each other GPG-encrypted instant messages. The plugin passes encrypted messages to gpg, but does no checking to sanitize the commandline passed to gpg. This can allow remote users to execute arbitrary code, with the permissions of the user running kopete, on the local system.
Alerts:	Conectiva CLA-2003:665 2003-06-27 Gentoo 200305-03 2003-05-14 Mandrake MDKSA-2003:055 2003-05-08

Comments (none posted)

libpng, libpng3: buffer overflow

Package(s):	libpng, libpng3	CVE #(s):	CAN-2002-1363
Created:	December 19, 2002	Updated:	July 14, 2004
Description:	Glenn Randers-Pehrson discovered a problem in connection with 16-bit samples from libpng, an interface for reading and writing PNG (Portable Network Graphics) format files. The starting offsets for the loops are calculated incorrectly which causes a buffer overrun beyond the beginning of the row buffer.
Alerts:	Gentoo 200407-06 2004-07-08 OpenPKG OpenPKG-SA-2004.030 2004-07-06 Mandrake MDKSA-2004:063 2004-06-29 Whitebox WBSA-2004:249-01 2004-06-21 Fedora FEDORA-2004-176 2004-06-18 Fedora FEDORA-2004-174 2004-06-18 Fedora FEDORA-2004-175 2004-06-18 Fedora FEDORA-2004-173 2004-06-18 Red Hat RHSA-2004:249-01 2004-06-18 Conectiva CLA-2003:564 2003-01-23 Mandrake MDKSA-2003:008 2003-01-20 OpenPKG OpenPKG-SA-2003.001 2003-01-15 Yellow Dog YDU-20030114-2 2002-01-14 SuSE SuSE-SA:2003:0004 2003-01-14 Red Hat RHSA-2003:006-06 2003-01-09 Debian DSA-213-1 2002-12-19

Comments (none posted)

LPRng: insecure temporary file

Package(s):	LPRng	CVE #(s):	CAN-2003-0136
Created:	April 14, 2003	Updated:	June 16, 2003
Description:	Karol Lewandowski discovered that psbanner, a printer filter that creates a PostScript format banner and is part of LPRng, insecurely creates a temporary file for debugging purpose when it is configured as filter. The program does not check whether this file already exists or is linked to another place writes its current environment and called arguments to the file unconditionally with the user id daemon.
Alerts:	Gentoo 200306-04 2003-06-14 Immunix IMNX-2003-7+-013-01 2003-06-04 Yellow Dog YDU-20030602-5 2003-06-02 Mandrake MDKSA-2003:060 2003-05-21 Red Hat RHSA-2003:142-01 2003-04-24 Debian DSA-285-1 2003-04-14

Comments (none posted)

lprold - buffer overflow in lprm

Package(s):	lprold lpd	CVE #(s):	CAN-2003-0144
Created:	March 13, 2003	Updated:	May 28, 2003
Description:	The lprm command of the printing package lprold contains a buffer overflow. This buffer overflow can be exploited by a local user, if the printer system is set up correctly, to gain root privileges.
Alerts:	Mandrake MDKSA-2003:059 2003-05-21 Debian DSA-267-2 2003-04-15 Debian DSA-275-1 2003-04-02 Debian DSA-267-1 2003-03-24 SuSE SuSE-SA:2003:0014 2003-03-13

Comments (none posted)

lv: privilege escalation

Package(s):	lv	CVE #(s):	CAN-2003-0188
Created:	May 16, 2003	Updated:	June 4, 2003
Description:	Leonard Stiles discovered that lv, a multilingual file viewer, would read options from a configuration file in the current directory. Because such a file could be placed there by a malicious user, and lv configuration options can be used to execute commands, this represented a security vulnerability. An attacker could gain the privileges of the user invoking lv, including root.
Alerts:	Yellow Dog YDU-20030602-6 2003-06-02 Gentoo 200305-07 2003-05-19 Red Hat RHSA-2003:169-01 2003-05-16 Debian DSA-304-1 2003-05-15

Comments (none posted)

lynx: CRLF injection vulnerability

Package(s):	lynx	CVE #(s):	CAN-2002-1405
Created:	November 19, 2002	Updated:	October 1, 2003
Description:	If lynx is given a url with some special characters on the command line, it will include faked headers in the HTTP query. This feature can be used to force scripts (that use Lynx for downloading files) to access the wrong site on a web server with multiple virtual hosts. CAN-2002-1405
Alerts:	Conectiva CLA-2003:720 2003-08-11 Mandrake MDKSA-2003:023 2003-02-24 OpenPKG OpenPKG-SA-2003.011 2003-02-18 Red Hat RHSA-2003:029-06 2003-02-12 Trustix 2002-0085 2002-12-19 Debian DSA-210-1 2002-12-13 SCO Group CSSA-2002-049.0 2002-11-18

Comments (none posted)

perl-MailTools: remote command execution

Package(s):	MailTools	CVE #(s):	CAN-2002-1271
Created:	November 5, 2002	Updated:	September 19, 2003
Description:	The SuSE Security Team reviewed critical Perl modules, including the Mail::Mailer package. This package contains a security hole which allows remote attackers to execute arbitrary commands in certain circumstances. This is due to the usage of mailx as default mailer which allows commands to be embedded in the mail body. Note that mail processing programs which use this package can be affected by this vulnerability; in particular, SpamAssassin is vulnerable if you use the -r or -w flags.
Alerts:	Debian DSA-386-1 2003-09-18 Gentoo 200302-01 2003-02-02 Mandrake MDKSA-2002:076 2002-11-07 Gentoo 200211-001 2002-11-06 SuSE SuSE-SA:2002:041 2002-11-05

Comments (none posted)

Nessus NASL scripting engine security issues

Package(s):	nessus	CVE #(s):
Created:	May 27, 2003	Updated:	August 12, 2004
Description:	Some some vulnerabilities exsist in the Nessus NASL scripting engine. To exploit these flaws, an attacker would need to have a valid Nessus account as well as the ability to upload arbitrary Nessus plugins in the Nessus server (this option is disabled by default) or he/she would need to trick a user somehow into running a specially crafted nasl script. Read the full advisory for additional information.
Alerts:	Gentoo 200305-10 2003-05-27

Comments (none posted)

nethack: buffer overflow

Package(s):	nethack, slashem, falconseye	CVE #(s):	CAN-2003-0358 CAN-2003-0359
Created:	February 18, 2003	Updated:	July 15, 2003
Description:	Overflowing a buffer in nethack may lead to privilege escalation to games uid. Read the the full advisory for the details. Note that falconseye does not contain the file permission error CAN-2003-0359 which affected some other nethack packages.
Alerts:	Debian DSA-350-1 2003-07-15 Debian DSA-316-3 2003-06-17 Debian DSA-316-2 2003-06-11 Debian DSA-316-1 2003-06-11 Gentoo 200302-08 2003-02-18

Comments (none posted)

netscape-flash: buffer overflow

Package(s):	netscape-flash	CVE #(s):
Created:	March 10, 2003	Updated:	June 20, 2003
Description:	Potentially exploitable buffer overflows exist in the Macromedia Flash Player. The full advisory is here. "The cumulative security patch is available today and addresses the potential for exploits surrounding buffer overflows (read/write) and sandbox integrity within the player, which might allow malicious users to gain access to a user's computer. The possibility of running native code on a users machine is a theoretical exploit, and extremely difficult to execute in practice. There are no known examples of running such native code from Macromedia Flash movies; however, even though this issue is difficult and theoretical in nature only, we are encouraging users to upgrade."
Alerts:	Red Hat RHSA-2003:026-01 2003-06-20 Gentoo 200303-9 2003-03-09

Comments (none posted)

net-snmp: denial of service vulnerability

Package(s):	net-snmp	CVE #(s):	CAN-2002-1170
Created:	December 17, 2002	Updated:	November 7, 2003
Description:	The SNMP daemon included in the Net-SNMP package versions 5.0.1 through 5.0.4 can be caused to crash if it is sent a specially crafted packet.
Alerts:	Conectiva CLA-2003:778 2003-11-07 Red Hat RHSA-2002:228-11 2002-12-17

Comments (none posted)

openssh: timing attack leads to information disclosure

Package(s):	openssh	CVE #(s):	CAN-2003-0190
Created:	May 2, 2003	Updated:	November 30, 2004
Description:	From the advisory: "During a pen-test we stumbled across a nasty bug in OpenSSH-portable with PAM support enabled (via the --with-pam configure script switch). This bug allows a remote attacker to identify valid users on vulnerable systems, through a simple timing attack. The vulnerability is easy to exploit and may have high severity, if combined with poor password policies and other security problems that allow local privilege escalation."
Alerts:	Ubuntu USN-34-1 2004-11-30 OpenPKG OpenPKG-SA-2003.035 2003-08-06 Red Hat RHSA-2003:222-01 2003-07-29 Gentoo 200305-02 2003-05-13 Gentoo 200305-01 2002-03-05

Comments (1 posted)

pam_xauth: root exploit

Package(s):	pam_xauth	CVE #(s):	CAN-2002-1160
Created:	February 13, 2003	Updated:	July 10, 2003
Description:	The pam_xauth module is used to forward xauth information from user to user in applications such as 'su'. Andreas Beck discovered that versions of pam_xauth supplied with Red Hat Linux since version 7.1 would forward authorization information from the root account to unprivileged users. This could be used by a local attacker to gain access to an administrator's X session. In order to exploit this vulnerability, the attacker would have to get the administrator, as root, to use su to the account belonging to the attacker.
Alerts:	Conectiva CLA-2003:693 2003-07-10 Mandrake MDKSA-2003:017-1 2003-04-28 Red Hat RHSA-2003:035-10 2003-02-12

Comments (none posted)

PHP: vulnerability in mail function

Package(s):	php	CVE #(s):	CAN-2002-0985 CAN-2002-0986
Created:	November 13, 2002	Updated:	October 1, 2003
Description:	Two vulnerabilities exists in the mail() PHP function. The first one allows the execution of any program/script bypassing safe_mode restriction, the second one may give an open-relay script if the mail() function is not carefully used in PHP scripts. See this Bugtraq report for more details. Note that this is a different vulnerability than the previous PHP mail() problem, which affected versions through 4.1.0. CAN-2002-0985 CAN-2002-0986
Alerts:	SCO Group CSSA-2003-008.0 2003-03-04 Gentoo 200211-005 2002-11-20 EnGarde ESA-20021122-031 2002-11-22 Conectiva CLA-2002:545 2002-11-13 Red Hat RHSA-2002:213-06 2002-11-11

Comments (none posted)

PostgreSQL - more buffer overflows

Package(s):	postgresql	CVE #(s):
Created:	February 12, 2003	Updated:	November 7, 2003
Description:	A new set of buffer overflows has been discovered in PostgreSQL 7.2.2; they affect the circle_poly(), path_encode(), and path_addr() functions. Exploiting these overflows requires that the attacker first obtain a connection to the PostgreSQL server.
Alerts:	Debian DSA-397-1 2003-11-07 Immunix IMNX-2003-7+-005-01 2003-04-08 Trustix 2003-0004 2003-02-20 Mandrake MDKSA-2002:062-1 2003-02-11

Comments (1 posted)

PoPTop: remotely exploitable buffer overflow

Package(s):	pptpd	CVE #(s):	CAN-2003-0213
Created:	April 28, 2003	Updated:	June 6, 2003
Description:	The PoPToP PPTP server contains a remotely exploitable buffer overflow; read the full advisory for more information.
Alerts:	SuSE SuSE-SA:2003:029 2003-06-06 Debian DSA-295-1 2003-04-30 Gentoo 200304-08 2003-04-28

Comments (none posted)

Local arbitrary code execution vulnerability in Python

Package(s):	python	CVE #(s):	CAN-2002-1119
Created:	August 28, 2002	Updated:	October 1, 2003
Description:	Zack Weinberg discovered that os._execvpe from os.py uses a predictable name which could lead to execution of arbitrary code. According to the Debian advisory, the problem was present in Python versions 1.5, 2.1 and 2.2. CAN-2002-1119
Alerts:	Red Hat RHSA-2002:202-33 2003-02-12 OpenPKG OpenPKG-SA-2003.006 2003-01-23 Red Hat RHSA-2002:202-25 2003-01-21 Mandrake MDKSA-2002:082-1 2002-12-09 Mandrake MDKSA-2002:082 2002-11-25 SCO Group CSSA-2002-045.0 2002-11-14 Trustix 2002-0073 2002-10-17 Gentoo python-20021003 2002-10-03 Conectiva CLA-2002:527 2002-10-01 Debian DSA-159-2 2002-09-09 Debian DSA-159-1 2002-08-28

Comments (none posted)

Multiple-use vulnerability in Safe.pm

Package(s):	Safe.pm	CVE #(s):	CAN-2002-1323
Created:	October 9, 2002	Updated:	February 20, 2004
Description:	usePerl has a description of a vulnerability in the Safe.pm Perl module. It seems that if a Safe compartment is used more than once, it ceases to be safe. The problem is fixed in Safe 2.08.
Alerts:	SCO Group CSSA-2004-007.0 2004-02-20 Gentoo 200212-6 2002-12-20 Trustix 2002-0087 2002-12-19 OpenPKG OpenPKG-SA-2002.014 2002-12-16 Debian DSA-208-1 2002-12-12

Comments (none posted)

squirrelmail: more cross-site scripting vulnerabilities

Package(s):	squirrelmail	CVE #(s):	CAN-2003-0160
Created:	April 24, 2003	Updated:	June 4, 2003
Description:	SquirrelMail is a webmail package written in PHP. Multiple vulnerabilities have been found which affect versions of SquirrelMail shipped with Red Hat Linux 8.0 and Red Hat Linux 9. Cross-site scripting vulnerabilities in SquirrelMail version 1.2.10 and earlier allow remote attackers to execute script as other Web users via mailbox displays, message displays, or search results displays. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0160 to these issues. All users are advised to upgrade to these errata packages containing SquirrelMail version 1.2.11, which is not vulnerable to these issues.
Alerts:	Yellow Dog YDU-20030602-2 2003-06-02 Red Hat RHSA-2003:112-01 2003-04-24

Comments (none posted)

File overwrite vulnerability in tar and unzip

Package(s):	tar unzip	CVE #(s):	CAN-2001-1267 CAN-2001-1268 CAN-2001-1269 CAN-2002-0399
Created:	October 1, 2002	Updated:	April 10, 2006
Description:	The tar utility does not properly filter file names containing "../", meaning that a hostile archive can, if unpacked by an unsuspecting user, overwrite any file that is writable by that user. GNU tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42 has the same vulnerability.
Alerts:	Fedora-Legacy FLSA:183571-1 2006-04-04 Red Hat RHSA-2006:0195-01 2006-02-21 Conectiva CLA-2002:538 2002-10-29 Mandrake MDKSA-2002:066 2002-10-10 Mandrake MDKSA-2002:065 2002-10-10 EnGarde ESA-20021003-022 2002-10-03 Gentoo unzip-20021001 2002-10-01 Gentoo tar-20021001 2002-10-01 Red Hat RHSA-2002:096-24 2002-09-18

Comments (1 posted)

Multiple vendor telnetd vulnerability

Package(s):	telnet Telnet netkit-telnet-ssl kerberos telnetd netkit-telnet nkitb/nkitserv/telnetd krb5	CVE #(s):
Created:	May 21, 2002	Updated:	October 5, 2004
Description:	This vulnerability, originally thought to be confined to BSD-derived systems, was first covered in the July 26th Security Summary. It is now known that Linux telnet daemons are vulnerable as well.
Alerts:	Gentoo 200410-03 2004-10-05 Yellow Dog YDU-20010810-2 2001-08-10 Yellow Dog YDU-20010810-1 2001-08-10 SuSE SuSE-SA:2001:029 2001-09-03 Slackware sl-997726350 2001-08-09 Red Hat RHSA-2001:100-02 2001-08-09 Red Hat RHSA-2001:099-09 2002-02-07 Red Hat RHSA-2001:099-06 2001-08-09 Progeny PROGENY-SA-2001-27 2001-08-14 Mandrake MDKSA-2001:093 2001-12-17 Mandrake MDKSA-2001:068 2001-08-13 HP HPSBTL0202-023 2002-02-12 Debian DSA-075-2 2001-08-14 Debian DSA-075-1 2001-08-14 Conectiva CLA-2001:413 2001-08-24 SCO Group CSSA-2001-030.0 2001-08-10

Comments (none posted)

typespeed: buffer overflow

Package(s):	typespeed	CVE #(s):
Created:	January 1, 2003	Updated:	June 17, 2003
Description:	A problem has been discovered in the typespeed, a game that lets you measure your typematic speed. By overflowing a buffer a local attacker could execute arbitrary commands under the group id games.
Alerts:	Debian DSA-322-1 2003-06-16 Debian DSA-217-1 2002-12-27

Comments (none posted)

vim - modeline vulnerability

Package(s):	vim	CVE #(s):	CAN-2002-1377
Created:	January 16, 2003	Updated:	February 10, 2004
Description:	VIM allows a user to set the modeline differently for each edited text file by placing special comments in the files. Georgi Guninski found that these comments can be carefully crafted in order to call external programs. This could allow an attacker to create a text file such that when it is opened arbitrary commands are executed.
Alerts:	Conectiva CLA-2004:812 2004-02-10 Mandrake MDKSA-2003:012 2003-02-03 Yellow Dog YDU-20030127-3 2003-01-27 Gentoo 200301-13 2003-01-22 OpenPKG OpenPKG-SA-2003.003 2003-01-21 Red Hat RHSA-2002:297-17 2003-01-15

Comments (4 posted)

vixie-cron: Local vulnerability

Package(s):	vixie-cron	CVE #(s):	CVE-2001-0559
Created:	April 17, 2003	Updated:	October 3, 2003
Description:	From the ISS advisory: "Vixie Cron is a scheduling daemon that ships with several Linux distributions. Vixie Cron version 3.0pl1 could allow a local attacker to gain root privileges. Crontab fails to properly drop privileges in certain cases after a crontab modification operation. A local attacker could exploit this vulnerability to gain root privileges on the system since crontab is installed setuid root." Note: this vulnerability is dated May 07 2001, and was first mentioned in LWN on the May 10, 2001 security page.
Alerts:	Conectiva CLA-2003:758 2003-10-03 Conectiva CLA-2003:757 2003-10-03 Conectiva CLA-2003:628 2003-04-17

Comments (none posted)

wget:directory traversal bug

Package(s):	wget	CVE #(s):	CAN-2002-1344
Created:	December 10, 2002	Updated:	October 1, 2003
Description:	Versions of wget prior to 1.8.2-4 contain a bug that permits a malicious FTP server to create or overwrite files anywhere on the local file system. FTP clients must check to see if an FTP server's response to the NLST command includes any directory information along with the list of filenames required by the FTP protocol (RFC 959, section 4.1.3). If the FTP client fails to do so, a malicious FTP server can send filenames beginning with '/' or containing '/../' which can be used to direct a vulnerable FTP client to write files (such as .forward, .rhosts, .shosts, etc.) that can then be used for later attacks against the client machine. See also this Bugtraq article from 1997. CAN-2002-1344
Alerts:	Immunix IMNX-2003-7+-011-01 2003-06-03 OpenPKG OpenPKG-SA-2003.007 2003-01-23 SCO Group CSSA-2003-003.0 2003-01-16 Gentoo 200212-7 2002-12-20 Trustix 2002-0089 2002-12-19 Conectiva CLA-2002:552 2002-12-13 Debian DSA-209-1 2002-12-12 Mandrake MDKSA-2002:086 2002-12-11 Red Hat RHSA-2002:229-10 2002-12-04

Comments (none posted)

Wwwoffle remote privilege escalation vulnerability

Package(s):	wwwoffle	CVE #(s):	CAN-2002-0818
Created:	August 14, 2002	Updated:	October 1, 2003
Description:	The wwwoffle web proxy incorrectly processes HTTP PUT and POST requests with negative Content Length values. "It is believed that an attacker could exploit this bug to gain remote wwwrun access to the system wwwoffled is running on." CAN-2002-0818
Alerts:	SCO Group CSSA-2002-048.0 2002-11-18 Debian DSA-144-1 2002-08-06 SuSE SuSE-SA:2002:029 2002-08-01

Comments (none posted)

xinetd: Memory leak in xinetd 2.3.10

Package(s):	xinetd	CVE #(s):	CAN-2003-0211
Created:	May 13, 2003	Updated:	November 13, 2003
Description:	Xinetd is a 'master server' that is used to to accept service connection requests and start the appropriate servers. Because of a programming error, memory was allocated and never freed if a connection was refused for any reason. An attacker could exploit this flaw to crash the xinetd server, rendering all services it controls unavailable. In addition, other flaws in xinetd could cause incorrect operation in certain unusual server configurations. All users of xinetd are advised to update to xinetd-2.3.11 which is not vulnerable to these issues.
Alerts:	Conectiva CLA-2003:782 2003-11-12 Yellow Dog YDU-20030602-1 2003-06-02 Gentoo 200305-08 2003-05-19 Mandrake MDKSA-2003:056 2003-05-14 Red Hat RHSA-2003:160-01 2003-05-13

Comments (none posted)

Resources

June CERT Summary

The CERT Summary for June, 2003 is out; problems highlighted this time include the XDR integer overflow, the sendmail buffer overflow, and the snort vulnerabilities.

Full Story (comments: none)

Linux Advisory Watch

The May 30 Linux Advisory Watch newsletter from LinuxSecurity.com is available.

Full Story (comments: none)

A new vulnerability reporting process

A group called the Organization for Internet Safety has surfaced with a draft proposal describing a process for reporting (and responding to) vulnerabilities. It is a lengthy and detailed document which attempts to program what should happen at every stage of the vulnerability resolution process. Public comments are being accepted on the draft through July 7.

Full Story (comments: none)

Events

PHRACK MAGAZINE Call for Papers

The call for papers for PHRACK #61 has gone out; submissions are due by July 18. "Dont bother us with lame articles -- only the elite papers will make it."

Full Story (comments: none)

Page editor: Jonathan Corbet

Kernel development

Brief items

Kernel release status

The current development kernel is 2.5.70; Linus has not made a kernel release since May 26.

Linus's BitKeeper tree includes some device model work, a long-sought fix for hanging TCP sessions, an improved slab allocator which performs better in busy, multi-processor situations, some kbuild tweaks, an ALSA update, a set of hash function changes to deal with algorithmic complexity attacks, a FAT filesystem rework (if you have been waiting to be able to create FAT partitions greater than 128GB, this patch is for you), a v850 subarchitecture merge, a RAID update, the removal of the long-deprecated callout TTY device (/dev/cua) support, and several other fixes and updates.

The sixth version of the 2.6 kernel must-fix list is now available; it has been split into two separate lists: must-fix bugs and not-ready features and speedups. The list (pre-split) is also available in diff form.

The current stable kernel is 2.4.20. The current 2.4.21 prepatch is 2.4.21-rc7, released by Marcelo on June 3. "Now I really hope its the last one, all this rc's are making me mad."

Comments (none posted)

Kernel development news

Safely suspending an IDE system

The 2.6 kernel will feature much improved power management, thanks to the device model, improved ACPI support, and a fair amount of effort in general to get power management right. One nagging problem remains, however, in the IDE subsystem. An IDE suspend or resume operation must be carefully serialized with any other operations happening within the same "hwgroup," where a hwgroup is a set of IDE devices that can only be accessed one at a time. Simply shutting down a drive when the kernel asks runs the risk of corrupting in-progress operations and generally making a mess of things.

Benjamin Herrenschmidt has now worked up a patch which deals with this problem, and, incidentally, shows off one of the design features of the 2.5 block I/O subsystem. The key to the solution is to realize that the IDE subsystem already has a mechanism which carefully serializes accesses to hwgroups: the block I/O request queue. If suspend and resume requests are put onto the request queue, the IDE subsystem will find (and act on) them at just the right time.

When one thinks of the I/O request queue, what usually comes to mind is commands to move data blocks to and from a drive. But, as covered in the LWN Driver Porting series, the newly redesigned block subsystem includes the ability to put other kinds of commands into request queues. This mechanism is used, for example, to queue packet-mode commands or explicit taskfile operations. But it can also be exploited to serialize power management commands.

So, all that was required is a new REQ_POWER_MANAGEMENT request type. The desired power management state is stored in the special field of the request structure, which is added to the target drive's request queue. When the hwgroup has finished up any other outstanding operations it may have going, it will see the power management request and deal with it at the right time. Problem solved.

Comments (none posted)

Where did that code come from?

SCO's lawsuit claims that code has been copied from its (or somebody's) proprietary code base into the Linux kernel. Beyond that, SCO claims that IBM, in particular, is responsible for that copying. These claims remain hypothetical as long as SCO refuses to provide any proof. As an intellectual exercise, let us imagine for a moment that SCO is actually able to produce examples of code that appear to have been copied from one system to the other. How then do they go about proving where it came from?

The kernel development process is nearly unique in a couple of ways. In one sense, it is one of the mostly tightly controlled projects out there; one - and exactly one - person can commit code to the mainline kernel tree. If Linus does not merge a patch, it simply does not go in. On the other hand, Linus did not use any sort of source code management system until early 2002. He also did not maintain any sort of records of what he merged, as far as anybody can tell; changelogs for kernel releases had to be created by digging through the large release-to-release patches and seeing what changed. So, while Linus is the "choke point" through which all patches pass, the record of what happened at that point is limited to his official kernel releases. One can look at Linus's output to determine, with great precision, when a particular patch went in, and, importantly, the evolutionary steps it took to get to its present state. Figuring out where it came from will be another story.

Since there is little information to be had from Linus on the provenance of patches before the BitKeeper era (which is the time period SCO is interested in), it will be necessary to try to trace any offending patches backward. And that means looking at how code reaches Linus. The basic nature of the submission process has not changed in a long time.

Some code is written by Linus himself. Linus's contributions have become a very small part of the whole, but he does still have something to add at times. It is probably safe to assume that Linus is not copying his work from proprietary Unix.

Some patches get to him by way of the linux-kernel mailing list. It is rare for Linus to pick up patches directly from linux-kernel, but it does happen. If a particular piece of allegedly infringing code was posted publicly, it should be possible to determine who sent it out. Chances are that the SCO investigators, if they really have infringing code to show, have been digging through the linux-kernel archives in the hopes of finding this sort of "smoking gun." The thought of SCO lawyers wading through old devfs flamewars is good for a smile or two.

Many patches go directly to Linus, often with no public posting at all. For example, much of Alexander Viro's work - big changes to core parts of the kernel - are first seen when they show up in a kernel release. There will be no record of these contributions other than Linus's memory and, perhaps, any existing backups of his mail spool. Unless this code comes with a comment like:

    /*
     * Copyright © Caldera International
     * 
     * Ripped off in 2000 by plagiarist@ibm.com; I'm too lazy to 
     * do this myself and they'll never notice.
     */

it will be very hard for SCO (or anybody else) to prove where the code came from.

The rest of the patches arrive by way of one of the "lieutenants" - developers like Alan Cox, David Miller, Greg Kroah-Hartman, Andrew Morton, and others. Some of these developers have used source management systems at times, others have not. Again, much of this code goes into the kernel without ever being posted on a public list. It can have two layers of private communication obscuring its true origin.

The end result of all the above is that the kernel development process is not quite as open as many people believe. A lot of code is posted publicly and its authors duly flamed for anything that does not look quite right. But a lot of code takes a quieter path and only sees the light of day when it shows up mixed into a development kernel. Much of the code that went into the 2.3 development series could be nearly impossible to trace back to its contributor.

It is also worth bearing in mind that no sort of paperwork is required to contribute code to the kernel. No copyright assignments, no warranties of originality, no indemnification. So there is no paper trail behind contributions to the Linux kernel - at least, not on the Linus side of things. One can only assume that companies like IBM have rather more rigorous procedures internally. But before that matters, a particular chunk of code will have to be traced back to IBM, and that could prove difficult.

The "low-ceremony" nature of kernel development is one of its attractions; the only thing you need in order to to play the game is some worthwhile code. It would be a shame if legal pressures eventually forced Linus to erect a wall of paperwork between himself and aspiring contributors.

For SCO's purposes, however, it is too late. Unless an IBM employee went out of his or her way to attach their name to a code contribution via a public posting or internal comments, it may never be possible to prove the origin of that contribution. And that could be bad news for SCO, which has gone out of its way to state that IBM, in particular, is responsible for the copying that SCO claims has occurred.

Comments (12 posted)

Patches and updates

Kernel trees

• Andrew Morton: 2.5.70-mm2. (May 29, 2003)

• Andrew Morton: 2.5.70-mm3. (May 31, 2003)

• Andrew Morton: 2.5.70-mm4. (June 4, 2003)

• Marcelo Tosatti: Linux 2.4.21-rc7. (June 3, 2003)

• Alan Cox: Linux 2.4.21-rc7-ac1. (June 4, 2003)

• Marcelo Tosatti: Linux 2.4.21-rc6. (May 29, 2003)

• Alan Cox: Linux 2.4.21rc6-ac1. (May 31, 2003)

• Alan Cox: Linux 2.4.21-rc6-ac2. (June 3, 2003)

• Disconnect: prerelease of 2.4.21-rc6-dis3. (June 3, 2003)

• Alan Cox: Linux 2.4.21-rc5-ac2. (May 29, 2003)

Core kernel code

• Ingo Molnar: new sys_tkill2() system call, 2.5.70. (June 3, 2003)

• Andy Pfiffer: kexec for 2.5.70 available. (June 4, 2003)

Development tools

• Hiro Yoshioka: hardmeter 2003-0603 is released. (June 4, 2003)

Device drivers

• Mark Haverkamp: pci bridge class code. (May 29, 2003)

• Jeff Garzik: net driver merges. (May 30, 2003)

• Andrew Vasquez: QLogic qla2xxx driver update available (v8.00.00b3).. (May 30, 2003)

• Greg KH: USB changes for 2.5.70. (May 30, 2003)

• Greg KH: More USB changes for 2.5.70. (June 3, 2003)

• Jaroslav Kysela: ALSA update 0.9.4. (June 2, 2003)

• Justin T. Gibbs: Aic7x_x_x 6.2.36 && Aic79xx 1.3.10 Updates. (June 4, 2003)

• Benjamin Herrenschmidt: IDE Power Management (Was: software suspend in 2.5.70-mm3). (June 4, 2003)

Documentation

• Denis Vlasenko: lk maintainers. (May 29, 2003)

• Douglas Gilbert: UML class diagram overview of scsi subsystem. (June 3, 2003)

Filesystems and block I/O

• Neil Schemenauer: new IO scheduler for 2.4.20. (May 31, 2003)

• Andrey Borzenkov: supermount for 2.5 test version available. (June 3, 2003)

Memory management

• Rik van Riel: rmap 15j. (May 30, 2003)

• William Lee Irwin III: pgcl-2.5.70-bk4-1. (May 31, 2003)

• William Lee Irwin III: pgcl-2.5.70-bk7-1. (June 2, 2003)

Networking

• Krishna Kumar: Prefix List patch against 2.5.70. (June 3, 2003)

Architecture-specific

• Zwane Mwaikambo: 32way/8quad NUMAQ booting with NR_IRQS = 640. (May 30, 2003)

• Zwane Mwaikambo: 32way/8quad NUMAQ booting with NR_IRQS = 640. (May 30, 2003)

• Anders Gustafsson: Support for mach-xbox (updated AGAIN). (June 3, 2003)

Security-related

• David S. Miller: DCACHE hash using Jenkins. (May 30, 2003)

• Chris Wright: 2.5.70-lsm1. (June 3, 2003)

Benchmarks and bugs

• rwhron@earthlink.net: 2.5.70 for 4 filesystems. (June 2, 2003)

• Con Kolivas: 2.5.70 with contest. (June 3, 2003)

• Con Kolivas: 2.5.70-mm2 with contest. (June 3, 2003)

• Con Kolivas: 2.5.70-mm3 with contest. (June 3, 2003)

• Con Kolivas: 100Hz v 1000Hz with contest. (June 3, 2003)

• Con Kolivas: 100Hz preempt v nopreempt contest results. (June 3, 2003)

Miscellaneous

• Gary_Lerhaupt@Dell.com: DKMS - added SuSE/UnitedLinux kernel support. (May 30, 2003)

• Albert Cahalan: procps 3.1.9. (June 2, 2003)

Page editor: Jonathan Corbet

Distributions

News and Editorials

Roundup of Educational Linux Distributions

[This article was contributed by Ladislav Bodnar]

A noteworthy trend that seems to have emerged in recent months are increasing Linux-related activities in educational and government institutions around the world. Many schools, colleges, universities and government departments are now building their own custom Linux distributions. While few of them can be classified as original projects, it is still interesting to see how Linux is slowly infiltrating all levels of our societies. Let's take a brief tour of these projects, listed here in alphabetical order.

The ADIOS project has been created by the Queensland University of Technology in Brisbane, Australia. Perhaps not the most inspiring name for a Linux distribution, ADIOS is an acronym for "Automated Download and Installation of Operating Systems". While the project's main goal is to provide students with an operating system where they have administrative privileges in a laboratory environment, it has also released a Red Hat-based bootable live CD for general home use.

CollegeLinux is a product of Robert Kennedy College in Delémont, Switzerland. The idea was to create an easy-to-use desktop Linux distribution for use by students. The college has identified Linux as a phenomenon playing an increasingly important role in IT, so what better way to teach it than to involve students in building their own Linux distribution? Based on Slackware, CollegeLinux has produced several releases and it has succeeded in creating a substantial user community. Interesting information about the distribution's philosophy can be read in this Interview with Professor David Costa of CollegeLinux by OSNews.

EduLinux (web site in French) is a project of Sherbrooke University in Quebec, Canada. It is a Mandrake-based distribution designed for use in French-speaking educational and governmental organizations. The developers have focused on providing a system which would allow painless migration of tasks from Microsoft-based systems to Linux.

Edunix (web site in Czech) is a Czech Linux-for-schools project. It is unclear from the web site who is behind the initiative, but the idea has been evolving for several months and a first beta edition, based on K12LTSP, has recently been released.

The Freeduc CD is a live Linux CD built by the Organization for Free Software in Education and Teaching (Ofset). Ofset is a legal entity based in Paris, France, with the goal to promote the development of free software in education. Freeduc is a modified Knoppix, excluding some of the memory intensive applications and including useful educational software. The removed applications have been replaced by less resource-hungry alternatives as the CD is designed to power low-end computers, often found in schools. The CD boots straight into a graphical environment, which is managed by intuitive and light-weight XFce windowing system. Besides French and English, Freeduc also supports a number of European languages.

LinEx is one of the most successful efforts in converting government offices and educational establishments to free software. Developed by the regional government of Extremadura in Spain, this Debian-based distribution is frequently given away with newspapers, magazines and in government offices around the region. Governments in other areas of Spain have started catching up and both Andalucía and Aragón have recently announced Linux initiatives (both links in Spanish).

Lorma Linux is another new project initiated by a small group of Linux enthusiasts at Lorma Colleges in San Fernando City, La Union, Philippines. This distribution is a modified Red Hat Linux - it has been scaled down to fit on one CD, KDE has been set as the default desktop environment and all applications have been recompiled for the i686 architecture.

K12LTSP (K12 Linux Terminal Server Project) is possibly the best-known and most successful Linux implementation for use in schools. The Red Hat-based distribution is designed to be installed as a web, file and application server and accessed by low-cost diskless workstations or terminals, also known as thin clients. These thin clients have no software or hard drives - perfect for schools as they are easy to install and require little maintenance. They are reliable and immune to malicious tampering and viruses. The project has excellent community resources and highly active mailing lists. LinuxPlanet has published a K12LTSP tutorial and report.

kmLinux (web site in German) is a distribution sponsored by the Government of Schleswig-Holstein in Germany. It is a single CD, SuSE-based distribution supplying the usual range of educational software for use in schools.

Quantian is a new project, a Knoppix-based variant tailored to numerical and quantitative analysis. Some applications from the original Knoppix were removed to make space for several quantitative, numerical and scientific programs, including R, Octave, Maxima, GSL, QuantLib, OpenDX, Mayavi, TeXmacs and many others.

Skolelinux (web site mostly in Norwegian, parts in English) is a Norwegian project to replace Windows with Linux in schools around Norway. "Our school saves at least 128,000 Norwegian kroner a year, and we are able to use new software on old computers", says Bjarne Hugo Hansen, principal of Hole primary and secondary school. Thanks to the Debian-based Skolelinux, all local languages of Bokmål, Nynorsk and Sami are receiving full attention, something that wasn't always the case with proprietary systems. This project is in active development and changes are frequently implemented based on feedback from schools.

SULIX (web site in Hungarian) is a distribution, developed by a small group of teachers at the University of Szeged, Hungary. Based on the Knoppix live CD, its main features are usability, Hungarian language support and inclusion of educational software packages. It is routinely handed out to students for individual practicing at home. While the distribution's main language is Hungarian, other languages are also supported.

We probably missed a few projects, so if you happen to know about some that belong in this category, please tell us by posting a comment below.

[Ed. note: see also the Education section of the LWN Distribution List, recently link-checked and edited (although some are looking a bit historical), where you'll find some of the distributions mentioned above, and a few that are not.]

Comments (6 posted)

Distribution News

Debian GNU/Linux

The Debian Weekly News for June 3, 2003 is out. This week Petter Reinholdtsen announced a new Skolelinux CD image a while ago that fixes many bugs and uses the debian-installer already. Mario Lang urgently needs help fixing bugs in the speakup kernel packages, otherwise the package will be abandoned. All that and more in this week's edition.

Look for the Debian Project at conferences in Austria and Brazil. June 5th to 7th - 2nd LinuxWochen - Vienna, Austria and June 5th to 7th - International Free Software Convention - Porto Alegre, Brazil.

The DDTP team and the Debian-BR project have announced the second public release of APT featuring support for translated package descriptions.

Branden Robinson reports that Debian's XFree86 packages are becoming team-maintained. "In practice they have always been to some extent, thanks to contributions large and small from many people (grep the xfree86 package changelog for "thanks" sometime)."

Jason Boxman has written a detailed HOWTO for configuring Exim and Courier IMAP under Debian GNU/Linux. Found on DebianPlanet.

Also from DebianPlanet, we found orth's kde cvs debian packages. "If you think you noticed a difference between KDE 3.0 and 3.1, you'll find the same exponential improvement in these packages."

Comments (1 posted)

Gentoo Weekly Newsletter -- Volume 2, Issue 22

The Gentoo Weekly Newsletter for the week of June 2, 2003 is available. This week's issue covers new mirror sites in North America, the CFLAGS/cpuinfo collection project, and an upcoming infrastructure change.

Full Story (comments: none)

Slackware Linux

Slackware Linux has updates to slackware-current including a new version of procps. See the slackware-current changelog for details.

Comments (none posted)

Yellow Dog Linux

Yellow Dog has an enhancement announcement for a new compat-gcc package. "The compat-gcc package provides a compatibility compiler that is compatible with Yellow Dog Linux 2.3. The version of compat-gcc that comes with Yellow Dog Linux 3.0 is missing a compatibility version of the g77 fortran compiler."

Full Story (comments: none)

LSB Certifications

SuSE Linux AG has registered SuSE Linux Desktop 1.0 as conforming to the LSB Runtime Environment for IA32 version 1.3 product standard.

ThizLinux Laboratory has registered ThizLinux Desktop 7.0 as conforming to the LSB Runtime Environment for IA32 version 1.3 product standard.

Comments (none posted)

"Absolute OpenBSD" from No Starch Press

For OpenBSD users and security conscious people everywhere, No Starch Press has announced the publication of "Absolute OpenBSD", by Michael W. Lucas.

Full Story (comments: none)

New Distributions

ClusterKnoppix

DebianPlanet reports on ClusterKnoppix, a modified version of Knoppix with the openMosix kernel extensions. Bittorrent: clusterKNOPPIX_V3.2-2003-05-20-EN-cl1.iso was released May 28, 2003.

Comments (none posted)

Quantian: A Knoppix remastering for Scientific Computing

A new distribution called "Quantian" has been launched. This one is a rework of Knoppix (and is thus Debian-based) which turns a PC into a scientific workstation. To that end, a long list of numeric and scientific packages have been added to the mix. All the nice features of Knoppix have been retained, of course.

Full Story (comments: none)

Minor distribution updates

2-Disk Xwindow embedded Linux

2-Disk Xwindow embedded Linux has released v1.0.8 (Source code) with major feature enhancements. "Changes: linux-lite kernel source was added, enabling a kernel image of ~47kb. Boot loader methods have been changed to reduce size. The build script has been cleaned up. Issues with ibiblio searches have been fixed (it may take some time for downloads to propagate out from incoming). There are changes to the info regs system."

Comments (none posted)

Astaro Security Linux

Astaro Security Linux has released v4.007 with minor bugfixes. "Changes: This Up2Date fixes a small bug in the VPN IPSec section of the WebAdmin."

Comments (none posted)

Slackware Live CD

Slackware Live CD has released v2.9.0.15 with major feature enhancements. "Changes: The ISO image fits the 190MB CD-RW medium now. There are new mouse cursors for Xwindows. KDE 3.1.2 , Kopete 0.6.2 (a lot of bugs fixed), a flag for international keyboard support under KDE, the ability to run something automatically after booting (autoexec), and the Quanta HTML and PHP WYSIWYG editor have been added. The ramdisk takes 22 MB now to raise free ramdisk space. Mplayer has been recompiled for CPU autodetection. Some 75dpi international fonts have been removed, as has emacs."

Comments (none posted)

Distribution reviews

Tux goes to college (NewsForge)

NewsForge reviews College Linux 2.3, a Slackware-based distribution from Robert Kennedy College in Delémont, Switzerland. "CollegeLinux comes with some software you might expect, like a 2.4.20 kernel, OpenOffice.org software suite, KOffice, nfs, Samba, and openssh. It also comes with a few things you might not expect. For example, while Wine is considered an option on many other Linux distributions, it is included here. I guess many students have a Windows partition on their machines. Having Wine installed means that many Windows programs (the ones that don't choke under Wine, that is) will be available under CollegeLinux. Good idea."

Comments (1 posted)

A Beginner's Guide to Choosing a Linux Distribution (DistroWatch)

DistroWatch has updated the "Beginner's Guide to Choosing a Linux Distribution". Those new to Linux are often overwhelmed by the choices available to them. This handy resource helps reduce some of the confusion by looking at several distributions that could be good for beginners. "The bewildering choice and ever increasing number of Linux distributions can be confusing for those of you who are new to Linux. This is why this page was created. It lists 10 distributions, which are generally considered as most widely used by Linux users around the world. There are no figures to back it up and there are many other distributions that might suit your particular purpose better, but as a general rule, all of these are popular and have very active forums or mailing lists where you can ask questions if you get stuck."

Comments (none posted)

Page editor: Rebecca Sobol

Development

Haystack: the universal information client

The Haystack project has come to our attention: "Haystack is a tool designed to let every individual manage all of their information in the way that makes the most sense to them. By removing the arbitrary barriers created by applications only handling certain information "types", and recording only a fixed set of relationships defined by the developer, we aim to let users define whichever arrangements of, connections between, and views of information they find most effective. Such personalization of information management will dramatically improve each individual's ability to find what they need when they need it."

Haystack is a cross-platform project, it is designed to run on Linux and several versions of Windows. The system is dependent on the Java 2 Development Kit (JDK) version 1.4 or later. It is recommended that users have a 2 Ghz Pentium 4 processor, at least 512 MB of RAM, and 1GB of disk space.

A summary of Haystack's characteristics include:

• Haystack aims to put all information in one place.
• All types of information can be accessed by right-clicking on them.
• The system has an information centered view instead of the traditional application centered view.
• All information can be dragged and dropped into other information.
• Haystack integrates email and instant messaging (IM).
• A personal digital library is included for organizing information.

The project overview has detailed documentation with examples of how someone would use all of these capabilities.

A preliminary release of Haystack is available for download, it is still in development, so expect bugs. The download page says that Haystack runs slowly under Linux and the embedded web browser is not yet functional. The system has been released as open-source under a Copyright from the Massachusetts Institute of Technology.

Comments (none posted)

System Applications

Audio Projects

Alsa 0.9.4 Released

Version 0.9.4 of the Alsa Sound Driver has been released. Change information is in the source code.

Comments (none posted)

Ogg Traffic

The June 3, 2003 edition of Ogg Traffic is out with the latest Ogg Vorbis audio compression software news. "This Ogg Traffic should really have appeared last week, but I was too busy with various real life issues. A lot has happened in the meantime, and consequently, today's Ogg Traffic features status updates from a whopping 14 Xiph.org team members."

Comments (1 posted)

Planet CCRMA changes

A number of new audio applications have been added to the Planet CCRMA audio package site. See the change log for details.

Comments (none posted)

CORBA

MICO 2.3.10 released

Version 2.3.10 of MICO (MICO Is CORBA) has been released. Change information is in the source code.

Comments (none posted)

Database Software

Firebird 1.5 Release Candidate 3

Version 1.5 Release Candidate 3 of the Firebird database is available "The development of Firebird 1.5 release is in final development stage ! The Release Candidate means that we're "almost there", and we turned our focus to remaining known issues and rough edges, final testing and bug squashing. We made a lot of progress with it thanks to your feedback."

Comments (1 posted)

PostgreSQL Weekly News - May 28th 2003

Here's the PostgreSQL Weekly News, with a look at the 7.3.3 release, and what to expect in 7.4. Also, PostgreSQL In the News and Upcoming Events.

Full Story (comments: none)

libgda, libgnomedb, Mergeant 0.12 released (GnomeDesktop)

GnomeDesktop reports that there are new versions of libgda/libgnomedb and Mergeant, all are part of a database framework for GNOME. "This release is the next in a series that will result in 1.0, which is what GNOME-DB developers are working hard at. For this reason, we need users and developers to use it and report any problems/suggestions."

Comments (none posted)

phpMyAdmin 2.5.1 released (SourceForge)

SourceForge has the announcement for phpMyAdmin version 2.5.1. "The development team is pleased to present you version 2.5.1, which aims to stabilize the 2.5.x series. phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the http://www."

Comments (none posted)

Electronics

flP5 - the fast light Parallel Port Production PIC Programmer 1.0.0

For those of you who are working with PIC microcontrollers, flp5, the fast light Parallel Port Production PIC Programmer version 1.0.0 has been released. Flp5 is based on FLTK, the Fast, Light ToolKit. For more information, see the flp5 home page.

Comments (none posted)

Networking Tools

Sussen GUI for Nessus security scanner

Sussen is a GUI client for the Nessus security scanner. Version 0.1 has been released, the code is available under the GPL.

Full Story (comments: none)

Printing

HP Inkjet Linux Driver 1.4.1 release (SourceForge)

SourceForge has an announcement for a new version of the HP inkjet printer driver. "The Hewlett-Packard Co. Linux Inkjet Driver Project is a add-on to the GNU Ghostscript application. This driver is based on the Hewlett Packard Appliance APDK for deskjet printers. This release includes bug fixes."

Comments (none posted)

AFPL Ghostscript 8.10 release

Version 8.10 of AFPL Ghostscript has been released. "It contains some fairly substantial reworking of important modules, most notably in the font rendering. Because of the extent of the changes, we're labelling this as a beta release. It should be quite usable, but it hasn't been as thoroughly wrung out as our production releases. The major new feature is improved font rendering by Igor Melichev."

Comments (none posted)

Web Site Development

Moodle 1.0.9 released (SourceForge)

Version 1.0.9 of Moodle is available. "Moodle 1.0.9 was released recently, and contains a very long list of new features, performance improvements and fixes. Moodle is PHP software that aims to make quality online courses (eg distance education) easy to develop and conduct. Learning and development are guided using a social constructionist philosophy. Implemented on thousands of sites and in 30 languages."

Comments (none posted)

phpWebSite 0.9.2 Stable released (SourceForge)

Version 0.92 of phpWebSite has been released. "Includes many bug fixes, new control panel, categorized pages, and more. Developed by the Web Technology Group at Appalachian State University, phpWebSite provides a complete web site content management system. All client output is XHTML 1.0 and meets the W3C's Web Accessibility Initiative requirements."

Comments (none posted)

Plone 1.0.2 released! (ZopeMembers)

Plone version 1.0.2 has been released. "The Plone Team today released Plone 1.0.2, a maintenance release for Plone 1.0. Plone is an open source information management system available in 25 languages, and has a large and active community supporting it."

Comments (none posted)

Zope 2.6.2 Beta 2 Released (ZopeMembers)

ZOPE 2.6.2 Beta 2 has been announced. "Users of the Zope source release should note that Python 2.1.3 is now the required platform. Python 2.1.3 includes a fix to an issue that could cause crashes in Zope." Numerous bugs have been fixed in this release.

Comments (none posted)

Zope Group Calendar 0.2 released (ZopeMembers)

Version 0.2 of Zope Group Calendar has been released. "Recent changes include the views week and year, as well as some bugfixes and refactored code."

Comments (none posted)

ZWiki 0.19.0 released (ZopeMembers)

ZopeMembersNews mentions the release of Zwiki version 0.19.0, a wiki package for Zope. "Summary: Preliminary reStructured Text support, page types cleanup, skin bugfixes, customizable issue colours."

Comments (none posted)

Web Services

Web services globalization model

Xiao Hui Zhu writes about globalization issues for web services on IBM's developerWorks. "This article starts from the base elements of a globalization architecture and then applies them to the Web services architecture. To strengthen the ideas, some examples are raised in the paper, together with some references for further information."

Comments (none posted)

Desktop Applications

Audio Applications

Ecamegapedal 0.4.2 released

Version 0.4.2 of Ecamegapedal, a realtime audio processor that works with Ecasound, has been released. Change information is in the source code.

Comments (none posted)

Horgand v0.90 available

The first release of Horgund, a real-time organ synthesizer, is available.

Full Story (comments: none)

Marlin 0.1 Released (GnomeDesktop)

GnomeDesktop reports on the release of Marlin 0.1, an audio sample editor. "Its only 0.1 so it doesn't have a whole host of features, but its usable I think for small editing jobs, and really, after a year I think its time for people to see it."

Comments (none posted)

swh-plugins 0.4.2 available

Version 0.4.2 of swh-plugins, a real-time audio effect utility, has been released. This version adds new filter plugins, bug fixes, and more.

Full Story (comments: none)

Tkeca 1.8.0 Released

Version 1.8.0 of Tkeca, a GUI interface to the Ecasound audio utility, is available with a number of new features.

Full Story (comments: none)

tuneroid 0.9.3 released

Version 0.9.3 of tuneroid, a musical instrument tuning application, has been released.

Full Story (comments: none)

Desktop Environments

Release Team's Almost-Final New Modules List for GNOME 2.4 (GnomeDesktop)

The GNOME team has compiled a list of new modules for GNOME 2.4. "This list will become the official new modules list for GNOME 2.3.x on June 2, enshrined forever in GEP 11, unless we hear loud wailing and gnashing of teeth at any of our judgements before then. That means you have just under a week to bring up any doubts or queries you have about this list." If you can't get to GnomeDesktop try the mailing list archives instead.

Comments (12 posted)

KDE Traffic #53

Issue #53 of KDE Traffic has been published. The KDE 3.2 release cycle is looked at.

Comments (none posted)

Games

Gnome Games 2.3.3 = New Games ! (GnomeDesktop)

GnomeDesktop.org mentions the 2.3.3 release of Gnome Games. "Gnome 2.0 Anonymous George writes "When gnome-games was last heard of there were horrible rumours of death and dismemberment. Not all of them were true. XBill is still gone, but Gnibbles and Gnobots are back. There have even been some new additions." Perhaps someone should write a game called X-SCO to replace XBill.

Comments (none posted)

Graphics

Gimp-Print 4.3.15 (development) (SourceForge)

Version 4.3.15 of Gimp-Print has been released. Many changes have been included.

Comments (none posted)

GUI Packages

New wxWindows Releases

New software for the wxWindows GUI framework includes wxOTL 0.3, a wxWindows database programming library, and wxCRP 1.2, a template wizard.

Comments (none posted)

Interoperability

Wine Traffic #172

Issue #172 of Wine Traffic is available. Topics include: Frank's Corner Milestone, Updated To-do List, Building a CHM Viewer, Update CVS Utilities for Compression, and Using Ventrilo.

Comments (none posted)

Office Applications

AbiWord Weekly News

Issue #146 of the AbiWord Weekly News is out. "I hope you like screenshots....I hope you like a *LOT* of screenshots. I hope your religion requires screenshots, because there's a lot of them, especially thanks to Christian Neumair, a.k.a. Manny. Additionally, a new Win32 binary sneaks its way in; you can get caught up on the development of MacOS X's port, and 1.0.6 is no longer a running gag. That's right...its out there...somewhere! Lucky Mac OS X users...."

Comments (none posted)

GNUe Traffic #83

Issue #83 of GNUe Traffic is out with the latest Gnu Enterprise news. Topics include: Native Microsoft Windows UI driver for Forms, Default RPC type for Application Server, Updates and inserts on multiple lists in AppServer, XSLT and GNUe Reports, and GNUe Schema Defintion files and W3 Standards.

Comments (none posted)

Graphing in Gnumeric (GnomeDesktop)

GnomeDesktop.org reports on graphing with Gnumeric. "Its been a grind to get charting back in Gnumeric but at long last there is a framework in place. Its still a touch rough around the edges, with some tuning necessary in the libart backend, and lots of unfinished bells and whistles. However, it is quite modular, easy to understand, and has a decent interface to Gnumeric."

Comments (none posted)

Web Browsers

Mozilla 1.4 Release Candidate 1 Now Available (MozillaZine)

Mozilla 1.4 RC 1 has been released. "Mozilla 1.4 Release Candidate 1 began shipping today. mozilla.org is making release candidates of 1.4 available to ensure a high quality product that can replace the Mozilla 1.0 branch as the stable development path."

Comments (none posted)

Independent Status Reports (MozillaZine)

The latest Mozilla Independent Status Reports are available. "The latest set of status reports includes updates from LinkVisitor, Jazilla, Negotiateauth, Uzilla, ForceContentType, IEStreamConv, Documoz and SmoothWheel."

Comments (none posted)

Minutes of the mozilla.org Staff Meeting (MozillaZine)

The minutes from the May 19, 2003 Mozilla.org staff meeting are online. See the pointer on MozillaZine for feedback. "Issue[s] discussed include 1.4, Mozilla Firebird 0.6 feedback, cooperation with ports maintainers, security fixes for the 1.0 branch and disabling dead CVS accounts."

Comments (none posted)

Lynx 2.8.5 dev 16 available

Version 2.8.5 dev 16 of the Lynx text-mode web browser is available for download. Change information is in the source code.

Comments (none posted)

Miscellaneous

Gaim 0.64 released

Version 0.64 of Gaim, an internet messaging client, has been released. "As you can tell from the ChangeLog, Gaim 0.64 has bugfixes, buddy list sorting, and a bunch of internal changes only nerds like us care about."

Comments (none posted)

Vim 6.2 Released

Version 6.2 of the Vim editor has been released. "Since Vim 6.1 hundreds of reported problems have been fixed. Also included are new and updated syntax files, translated menus and messages."

Full Story (comments: none)

Languages and Tools

Caml

Caml Weekly News

The June 2, 2003 Caml Weekly News is out with the latest Caml language news.

Full Story (comments: none)

A Concise Introduction to Objective Caml

David Matuszek has put together a document entitled A Concise Introduction to Objective Caml. " Caml is a dialect of ML, developed primarily in France. This paper describes Objective Caml version 3.01, or OCaml (pronounced "oh-camel") for short; it does not go into the object-oriented features of OCaml, however. Another dialect, Caml Lite 0.74, has almost identical syntax, but the modules and many of the functions in the modules differ to a greater or lesser extent."

Comments (none posted)

Erlang

The First Erlang Newsletter

A new publication known as the Erlang Newsletter has hit the virtual street. Take a look for the latest developent news from the Open Source Erlang project.

Comments (none posted)

FORTRAN

G95 developments

Development continues on the G95 project, an open-source FORTRAN compiler. "G95 is in a pupal state. It can compile simple programs, though all language features are not yet available."

Comments (none posted)

Haskell

Glasgow Haskell Compiler version 6.0

A major new release of the Glasgow Haskell Compiler is available. This version adds Template Haskell, a metaprogramming extension. Thanks to Jens Petersen.

Full Story (comments: none)

Java

Aspect-Oriented Programming and JBoss (O'Reilly)

Bill Burke and Adrian Brock take a look at JBoss and aspect-oriented programming on O'Reilly. "Aspect-oriented programming (AOP) is an exciting new paradigm that should have the same effect on software development that object-oriented programming (OOP) had 15-20 years ago. AOP and OOP are not competing technologies, but actually complement each other quite nicely."

Comments (none posted)

Parsing, indexing, and searching XML with Digester and Lucene (IBM developerWorks)

Otis Gospodnetic writes about XML parsing under Java with Digester and Lucene. "Java developers can use the SAX interface to parse XML documents, but this process is rather complex. Digester and Lucene, two open source projects from the Apache Foundation, cut down your development time for projects in which you manipulate XML. Lucene developer Otis Gospodnetic shows you how it's done, with example code that you can compile and run."

Comments (none posted)

Perl

This Week on perl5-porters (use Perl)

The May 26 - June 1, 2003 edition of This Week on perl5-porters is out. "As usual, the weekly summary will try to present a useful or entertaining cross-section of the perl 5 porters' activity. The various topics include C-level I/O, scoping, installation layouts, and some amount of bugs and patches."

Comments (none posted)

This week on Perl 6 (O'Reilly)

The May 25, 2003 edition of This week on Perl 6 is online with the latest Perl 6 language news.

Comments (none posted)

Hidden Treasures of the Perl Core (O'Reilly)

Casey West examines some Perl Core modules on O'Reilly. "The Perl Core comes with a lot of little modules to help you get thejob done. Many of these modules are not well-known. Even some of the well-known modules have some nice features that are often overlooked. In this article, we'll dive into many of these hidden treasures of the Perl Core."

Comments (none posted)

PHP

PHP 4.3.2 released with security fixes

PHP 4.3.2 is out; it includes fixes for "several potentially hazardous integer and buffer overflows." The PHP team is strongly recommending that users upgrade; that might be a hint that is worth taking.

Full Story (comments: none)

PHP Weekly Summary

The June 2, 2003 PHP Weekly Summary is online. Contents include: "PHP 4.3.2 now officially shipping, DOMXML for 64 bit, fd patch, exec in cli and mod_php, property access in PHP 5, PHP, Netware, phpMyAdmin."

Comments (none posted)

Python

Python 2.2.3 (final) Released

Version 2.2.3 (final) of Python is now available. "This is a bug fix release for the stable Python 2.2 code line. It contains more than 40 bug fixes and memory leak patches since Python 2.2.2, and all Python 2.2 users are encouraged to upgrade."

Full Story (comments: none)

Dr. Dobb's Python-URL!

The Dr. Dobb's Python-URL for June 2, 2003 is out. This week's discussions include how to make a switch-case work-alike by abusing exceptions and an introspective technique for "declaring" local variables. Also there's the Python 2.2.3 announcment and a reminder that voting for the 2003 Active Awards for open-source programmers starts June 3.

Full Story (comments: none)

The Daily Python-URL

The Daily Python-URL has dozens of new links to Python language articles and projects.

Comments (none posted)

Ruby

The Ruby Garden

The Ruby Garden has a number of new articles on Ruby this week. For more Ruby news, see the June 3, 2003 edition of the Ruby Weekly News.

Comments (none posted)

Scheme

Scheme Weekly News

The June 2, 2003 Scheme Weekly News is out. Take a look for the latest on Scheme language development news.

Full Story (comments: none)

Tcl/Tk

Dr. Dobb's Tcl-URL!

The June 3, 2003 edition of Dr. Dobb's Tcl-URL! is out with the week's roundup of Tcl/Tk development news.

Full Story (comments: none)

XML

XML Power Job Hunting (O'Reilly)

John E. Simpson explores the XML Résumé Library on O'Reilly. "If you've spent much time job-hunting, you know one of the basic frustrations: how to avoid handcrafting a different résumé for each different job you're considering. Wouldn't it be better, or at least easier, if you could create a single résumé but instruct your résumé-generating tool to include this skill and exclude that one or to name this referee but not the other?"

Comments (none posted)

Miscellaneous

Advanced OOP: Multimethods (O'ReillyNet)

David Mertz covers multimethods on O'Reilly. "Most popular object oriented languages take their method dispatch styles from Smalltalk's message passing style, dispatching based on the invocant. Another approach is multiple dispatch or multimethods, which considers multiple invocants for dispatch. Why is this important? David Mertz explains how multimethods improve polymorphism and often provide a better alternative to inheritance."

Comments (none posted)

Page editor: Forrest Cook

Linux in the news

Recommended Reading

Senator wants limits on copy protection (News.com)

News.com looks at a new legislative proposal in the U.S. "The bill, authored by Sen. Sam Brownback, would regulate digital rights management systems, granting consumers the right to resell copy-protected products and requiring manufacturers to prominently disclose when anti-copying technology is being used." The law would also make it harder for copyright holders to obtain the names of peer-to-peer users and forbid regulatory agencies from requiring hardware manufacturers to include copy protection technology in their products.

Comments (3 posted)

Brass tacks: SCO and your business (NewsForge)

NewsForge advises businesses on how to respond to the SCO suit. For the most part, that advice is "don't worry." One statement of interest, though, is: "Thus even if there has been direct copying, which remains without a shred of publicly available evidence, trying to prove that IBM put the 'illegal' code in is impossible. It's like trying to decide the fate of a single strawberry after dozens have been thrown into the blender and you've turned it on puree." Determining the source of any infringing code is an interesting subject requiring further thought.

Comments (11 posted)

Killing Linux (PC Magazine)

Here's a Dvorak column on the SCO suit. "The Linux community seems to have put its collective head in the sand. Nobody seems to realize that Linux and the entire open-source movement are at grave risk. Apparently the open-source idealists don't understand the quirks of the legal system."

Comments (28 posted)

Companies

IBM unveils Linux desktop in India (ZDNet)

ZDNet covers the IBM Linux PC in India, an offering aimed at small to medium-sized businesses and home offices in India's secondary cities. "Despite the use of the open-source Linux operating system, which is cheaper to buy than a Microsoft Windows license, the IBM Linux PC will still be priced on the high side, at about 39,000 rupees ($850) including taxes, said a report in the news daily The Times of India. IBM was unable to furnish more details about what sort of technical support would be given, the Linux distribution used or why the price was so high."

Comments (none posted)

Lindows.com claims SCO immunity via Caldera deal (Register)

In a never-ending quest for more press coverage, Lindows.com announced their immunity from SCO prosecution, covered in this Register article. "Applying some educated guesswork to this study in imprecision we can postulate that the agreements Lindows.com claims it has with SCO stem from discussions it engaged in with Caldera during its construction phase. These may or may not have resulted in some form of deal which covers Lindows against being busted by SCO for claimed infringements in the Linux kernel. But unless SCO now says, 'By George, Mr Robertson, you're right, you're entirely clean,' the matter can't be settled without lawyers at dawn."

Comments (1 posted)

SCO Rings Up First Quarterly Profit (TechWeb)

TechWeb takes a look at SCO's latest financial results. Apparently lawsuits can be good for business. "For its second fiscal quarter, ended April 30, the company earned a profit of $4.5 million, or 33 cents a diluted share, on revenue of $21.4 million. That's a big turnaround from a year ago, when the company lost $6.6 million, or 47 cents per share, on revenue of $15.5 million."

Comments (9 posted)

Analysts to SCO: No thanks to code review offer (ComputerWorld)

Here's a ComputerWorld article (from a few days ago) on the lack of enthusiasm for SCO's "sign an NDA to see the code" plan. "But Giga Information Group Inc. analyst Stacey Quandt said she has discussed SCO's offer with her legal counsel, and if she signs an NDA, it may hinder her ability to write about it. She could get subpoenaed as well. Quandt called the offer a PR stunt." Scroll down for a good Linus quote on the whole thing.

Comments (6 posted)

SCO actions prompt Linux warning (News.com)

Here's some FUD (Fear, Uncertainty, Doubt) from Gartner, on News.com. ""Although Gartner has reservations on the merits of (SCO's claims), don't take them lightly," Gartner analyst George Weiss advised in a May note. "Minimize Linux in complex, mission-critical systems until the merits of SCO's claims or any resulting judgments become clear.""

Comments (18 posted)

Business

Linux Server Sales Soar As Overall Market Drops (TechWeb)

TechWeb reports that Linux server sales are up, even though server sales in general are down. "Hewlett-Packard led in both Linux server volume and revenue, with 50,500 units sold and revenue of $185 million in the first quarter. Dell came in second, selling 38,000 servers worth $124 million. They were followed by IBM, which shipped 23,700 Linux servers worth $91 million."

Comments (1 posted)

Linux Adoption

India leader advocates open source (News.com)

News.com reports that the President of India is an open source advocate. "[President] Kalam said open-source software offers developing nations such as India the best opportunity to modernize."

Comments (6 posted)

Legal

Court confirms DMCA 'good faith' web site shut down rights (Register)

The Register reports on the latest DMCA fun in U.S. District Court. "InternetMovies.com had asked the District Court for the District of Hawaii to require that copyright holders investigate infringing Web sites before shutting them down. This rational request was rejected by the court, as its granted the MPAA (Motion Picture Association of America) and any other DMCA zealot the right to put the clamp on Web sites at will."

Comments (1 posted)

MobiliX v. Asterix in plea to top German court (Register)

The Register follows the continuing legal battles of MobiliX. "The mobile open source project formerly known as MobiliX has stepped up its fight to have its long-running trademark dispute with the firm behind Asterix and Obelix heard by Germany's highest civil court."

Comments (none posted)

Court Puts Muzzle on SCO (eWeek)

A German court granted a preliminary injunction against SCO, according to this eWeek article. "Ryan Tibbitts, SCO's in-house general counsel, on Friday said that the German court had just issued a temporary restraining order against the company. The legal action was brought against SCO by a number of Linux associations, including LinuxTag. This was also an ex parte proceeding, which meant the court has not heard any arguments from SCO's side, he said."

Comments (1 posted)

Interviews

Boies' Take (Forbes)

Forbes talks with David Boies - SCO's lawyer. "Somehow, everyone thinks SCO is in it for the money and out to thwart Linux. In Boies' eyes, it's hard to see how anyone could jump to that conclusion. The $1 billion in damages and future royalties SCO is seeking won't put a mere dent in the Linux movement: 'That's a cost that gets lost in the rounding,' says Boies, adding, 'The cost efficiency of Linux won't rise or fall.'"

Comments (9 posted)

Python and the Programmer (artima.com)

artima.com interviews Bruce Eckel, the author of Thinking in Java, about Python. "I feel Python was designed for the person who is actually doing the programming, to maximize their productivity. And that just makes me feel warm and fuzzy all over. I feel nobody is going to be telling me, 'Oh yeah, you have to jump through all these hoops for one reason or another.' When you have the experience of really being able to be as productive as possible, then you start to get pissed off at other languages."

Comments (2 posted)

Interview with Ximian's Nat Friedman (OSNews)

OSNews interviews Nat Friedman, co-founder and vice-president of product development at Ximian. "Which version of GNOME is Ximian Desktop 2.0 based on exactly, and what changes have you applied when compared to the vanilla Gnome? Nat Friedman: XD2, as we like to call it, is based on GNOME 2.2, Mozilla 1.3 and OpenOffice.org 1.0.3."

Comments (none posted)

Free Software Carnival: Latin America Takes to FLOSS in a Big Way (Linux Journal)

Linux Journal talks with Cesar Brod about the spread of free software in Latin America. "Latin America, specifically Peru, also has challenged the role of proprietary software and Microsoft. In addition, Brazil has come up with interesting university-based software solutions. For instance, the Brazilian UNIVATES says it has saved about $130,000 USD by not acquiring copies of proprietary software for servers and desktops. It saves $70,000 USD each year on software upgrades and maintenance--enough to pay the salaries of the development group. Therefore, UNIVATES can produce effective technology for its own use, which others also can make use of, at virtually no cost."

Comments (none posted)

Q&A: SCO's Chris Sontag on Linux, Unix and brewing legal fights (ComputerWorld)

ComputerWorld's Patrick Thibodeau interviews Chris Sontag, a senior vice president and general manager of SCOsource Division. "How many lines of code in the Linux kernel are a direct copyright violation? It's very extensive. It is many different sections of code ranging from five to 10 to 15 lines of code in multiple places that are of issue, up to large blocks of code that have been inappropriately copied into Linux in violation of our source-code licensing contract. That's in the kernel itself, so it is significant. It is not a line or two here or there. It was quite a surprise for us." (Thanks to Sharon Machlis)

Comments (11 posted)

EuroPython interview with Moshe Zadka

The EuroPython and Zope Conference is coming up later this month and to help people get ready, there will be a series of interviews with some of the speakers. First up is this interview with Moshe Zadka. "EuroPython: On which Python projects are you working at the moment? I'm most active on "Twisted", the asynchronous networking framework. I'm involved in design and documentation, but what interests me most from a research point of view is how to deploy Twisted-based applications in a flexible manner. That ties in with my biggest role in the Twisted project as the Debian maintainer. I make sure Twisted integrates with the Debian tools, so that I can give users of the Debian operating system a system which is powerful, easy and flexible."

Comments (none posted)

Resources

Top Five Open Source Packages for System Administrators (O'ReillyNet)

O'ReillyNet picks the top five most useful and widely applicable open source administrative tools. "The top honor in my top five tools list goes to Cfengine, written by Mark Burgess. Cfengine is a wonderful tool for configuring and maintaining Unix computer systems. Cfengine is a stand-alone tool (set of tools), which administers and configures computers according to the instructions in its configuration files."

Comments (7 posted)

Saving Our Bacon: Snort Security Holes and Strategies for Safe Network Monitoring (O'ReillyNet)

O'ReillyNet covers recent vulnerabilities in Snort along with strategies to minimize risks. "Since the main purpose of Snort is detection, a primary goal of attackers is evasion. If attacks can be structured so that they are overlooked by Snort, then system administrators will be left with a false sense of security -- arguably a worse situation than if Snort had not been used at all."

Comments (none posted)

Netcat and Reverse Telnet (O'Reilly)

Kivilcim Hindistan examines Netcat on O'Reilly. "As a basic point of view, Netcat is a telnet program. But that's like calling the Swiss Army Knife just a knife. Netcat was written in 1996 by a hacker called Hobbit to meet all kinds of telnet needs. Today you can easily find a version of Netcat for your flavor of Unix or even Windows. There are also some variants, such as cryptcat which adds vital encryption features, which we will also use later in this article."

Comments (none posted)

Reviews

Open source moves to deskless email market (vnunet)

Vnunet looks at 2 new 'deskless' email products. "Hewlett Packard (HP) and Intel recently partnered with open source provider Sendmail to launch Workforce Mail running on Linux, while IBM Lotus has brought out Lotus Workplace Messaging."

Comments (none posted)

A First Look at Ximian Desktop 2 (LinuxWorld)

Joe Barr reviews Ximian Desktop 2 in this LinuxWorld article. "A month or two ago Ximian asked if I would like to participate in a beta for its new desktop offering. I said yes, but only if it supported Red Hat 9. Ximian marketing folk said it would and swore me to secrecy. The following is what I found in the last two weeks: Ximian 2 is drop-dead gorgeous. It is much more powerful than it was before, and many tweaks are now in the interface. A couple of the tweaks I didn't like, but most I did. I'll get into those specifics a little later in the story. Let's start at the beginning."

Comments (5 posted)

Building a TiVo, a Step at a Time (Wired)

Wired looks at free digital video recording software. "The MythTV software offers all the basic DVR features -- it can pause and rewind live TV, and fast-forward through shows and ads. It supports multiple tuner cards (and multiple simultaneous recordings) and boasts picture-in-picture capability if there's more than one tuner card installed. It also offers basic video-editing capabilities and allows shows to be archived to video CD."

Comments (none posted)

Page editor: Forrest Cook

Announcements

Non-Commercial announcements

DoD Open Source Policy Statement Released

The Center of Open Source & Government tells us that the DoD made its first official statement about Open Source and put it on a level playing field with proprietary software.

Full Story (comments: 1)

Commercial announcements

ActiveState's Komodo IDE honored in SD Times 100

ActiveState has announced that its Komodo IDE has earned a place in the SD Times 100 list. In the "Tools and Environments" category, Komodo is "the first professional-quality IDE for scripting language developers".

Comments (none posted)

Open Source Software Faces Uphill Battle in Larger Companies in Europe, Middle East and Africa

Evans Data Corporation has completed the third survey in its regionally based series. Europe, Middle East and Africa Development Survey Vol. 1 2003 (EMEA) found that 58% of developers use open source software (OSS) but, in companies with more than 500 employees, 25% of developers indicated that company policies were the primary reason for not using OSS.

Comments (none posted)

MySQL AB Named to First Annual SD TIMES 100 List

MySQL AB has put out a press release concerning the inclusion of MySQL in the SD TTMES 100 list. "MySQL AB, developer of the world's most popular open source database, today announced it has been selected for inclusion in the first annual SD TIMES 100, a list of companies and organizations that demonstrated the greatest innovation and leadership in the software development industry in 2002."

Comments (none posted)

MySQL AB Secures $19.5 Million Investment Round

MySQL AB has announced the completion of a $19.5 million Series B round of financing led by Benchmark Capital, and that Kevin Harvey, general partner of Benchmark Capital, will join MySQL AB's board of directors.

Comments (2 posted)

OSCI Delivers First Language Reference Manual to Public

The Open SystemC Initiative (OSCI) has announced the initial delivery of the SystemC v2.0.1 Language Reference Manual (LRM), a more than 400-page definitive on SystemC semantics that provides an unambiguous definition of the SystemC language.

Comments (none posted)

French CEA using Nuxeo Web Application

Nuxeo has sent out a press release announcing that the French Atomic Energy Commission (CEA) is now using Nuxeo's CPS and the Zope platform.

Full Story (comments: none)

Ximian Announces Ximian Desktop 2 and Ximian Evolution 1.4

Ximian, Inc. has announced Ximian Desktop 2, a new version of its Linux desktop software.

Ximian has also announced new versions of both Ximian Evolution and Ximian Connector for Microsoft Exchange.

Comments (none posted)

Resources

LDP Weekly News

The June 3, 2003 edition of the Linux Documentation Project Weekly News is out. Take a look for a listing of the latest new and updated documentation.

Full Story (comments: none)

Linux Gazette - June 2003

The Linux Gazette issue #91, June 2003, is out. This month read a book review of Web Hacking: Attacks and Defense, by John B Cole; Installing Slackware and Making It Secure, by Cezary M Kruk; Silicon Valley Humor, Baby Boomer Style, by Janine M Lodato; Creating/Manipulating images with gd, by Shuveb Hussain; Exploring The sendfile System Call, by Jeff Tranter; and much more.

Comments (none posted)

LPI-News May 2003

The Linux Professional Institute's monthly newsletter is out for the month of May. Topics include the retake policy for LPI exams; the volunteer of the month - Jason Record of Novell; and much more.

Full Story (comments: none)

Upcoming Events

SCO/Linux debate at USENIX San Antonio conference

The USENIX Technical Conference, which runs from June 9-14 in San Antonio, Texas will hold the First Public SCO/Linux Debate on June 12.

Full Story (comments: none)

Linuxwochen 2003

An ongoing series of Linux events, known as Linuxwochen 2003 (in German), will be held in various European cities up to June 21, 2003. Thanks to Maximilian Attems.

Comments (none posted)

First Annual GCC Developers' Summit

The proceedings and photos from the First Annual GCC Developers' Summit are now available.

Comments (3 posted)

JBoss Group's Second Annual Conference

JBoss Group has announced JBossTwo, the company's second annual free conference for Java developers. JBossTwo will take place from 9:30 a.m. to 5:00 p.m., June 11, 2003, at the Sony Metreon in San Francisco.

Comments (none posted)

Third DZUG-Conference in Paderborn (ZopeMembers)

The German Zope User Group (DZUG) will hold a Zope conference in Paderborn, Germany on September 26 and 27, 2003.

Comments (none posted)

Events: June 5 - July 31, 2003

Date	Event	Location
June 5 - 6, 2003	Enterprise Linux Forum Conference & Expo	(Santa Clara Convention Center)Santa Clara, California
June 9 - 14, 2003	USENIX 2003	(Marriott Hotel)San Antonio, TX
June 10, 2003	Linux For Business	(The Commonwealth Institute)London, England
June 11, 2003	JBoss Group's Second Annual Java Conference(JBossTwo)	(Sony Metreon)San Francisco, CA
June 16 - 18, 2003	Yet Another Perl Conference::North America(YAPC::2003)	(Florida Atlantic University)Boca Raton, FL
June 16 - 18, 2003	GNOME User and Developer European Conference(GUADEC)	(Trinity College)Dublin, Ireland
June 16 - 20, 2003	Infosec 2003	(UniNet)Online
June 18 - 23, 2003	Open Source Clinical Application Resource Workshop(OSCAR)	(McMaster University)Ontario, Canada
June 21 - 22, 2003	EuropeanRubyConference	(University of Karlsruhe)Karlsruhe, Germany
June 23 - 26, 2003	ClusterWorld Conference & Expo	(San Jose Convention Center)San Jose, California
June 23 - 26, 2003	Fourth Workshop On UML for Enterprise Applications	(Hyatt Regency San Francisco Airport Hotel)Burlingame, CA
June 24 - 26, 2003	LinuxUser & Developer Expo	(Birmingham National Exhibition Centre)Birmingham, UK
June 25 - 27, 2003	European Python and Zope Conference 2003	(CEME)Charleroi, Belgium
July 7 - 11, 2003	O'Reilly Open Source Convention 2003(OSCON)	(Portland Marriot)Portland, Oregon
July 9 - 12, 2003	Libre Software Meeting	Metz, France
July 10 - 13, 2003	LinuxTag	Karlsruhe, Germany
July 12 - 17, 2003	Debcamp	Oslo, Norway
July 18 - 20, 2003	Debconf 3	(The University of Oslo)Oslo, Norway
July 23 - 26, 2003	Ottawa Linux Symposium	Ottawa Canada
July 23 - 25, 2003	YAPC::Europe 2003	(CNAM Conservatory)Paris, France
July 29 - August 2, 2003	The 10th Annual Tcl/Tk Conference	Ann Arbor, Michigan
July 31 - August 3, 2003	UKUUG Linux Developers' Conference(LINUX 2003)	(George Watson's College)Edinburgh Scotland

Comments (none posted)

Web sites

Lisp NYC web site

Lisp NYC has put up a new web site. The group is described as: "a group devoted to the advocacy and advancement of professional software developers in their adoption of Common Lisp and associated languages".

Full Story (comments: none)

Sound & MIDI Software For Linux updated

Dave Philips has updated his Sound & MIDI Software For Linux site. The musings column summarizes recent developments in a number of Linux audio projects.

Comments (none posted)

Software announcements

This week's software announcements

Here are the software announcements, courtesy of Freshmeat.net. They are available in two formats:

• Sorted alphabetically,
• Sorted by license.

Comments (none posted)

Miscellaneous

SCO v. IBM resource site

Karsten Self has put together a wiki-based page on the SCO/IBM mess. Therein you'll find lots of useful information, including teleconference transcripts, lots of links, and a timeline for the whole affair.

Comments (3 posted)

International Eiffel Programming Contest

An Eiffel programming contest is being held, the submissions deadline is October 31, 2003. Prizes include cash and commercial software.

Full Story (comments: none)

Page editor: Forrest Cook

Letters to the editor

Pleasant Supreme Court decision

From:		Max.Hyre@cardiopulmonarycorp.com
To:		lwn@lwn.net
Subject:		Pleasant Supreme Court decision
Date:		Mon, 2 Jun 2003 17:09:04 -0400

In a pleasant indication that the U.S. Supreme Court has not
completely lost its collective mind, it decided 8--0 that the Lanham
Act (part of trademark law) does not lessen the public's right to
public-domain works. (Decision at
http://www.supremecourtus.gov/opinions/02pdf/02-428.pdf.)
 
The case is a bit tortuous, but briefly, a book was published, and
a TV program was made from it, the publisher having sold the TV
rights. Years later, the publisher renewed the book's copyright, but
the video was allowed to pass into the public domain. A decade after
that, the publisher re-sold the book's TV rights to a video
distributor. When another company repackaged and sold the original
(public-domain) video the distributor sued under the Lanham Act,
claiming that the repackager was ``reverse passing off'' (selling
someone else's goods under your own label).
 
The court observed that since the repackager had taken a PD work
and resold it, the distributor was SOL. The distributor has rights in
its own, newly-slapped-together, version, but cannot use the Lanham
Act to reach back and gain rights in the public domain, which ``would
cause it to conflict with copyright law, which is precisely directed
to that subject[...].''
 
We've gotta take our victories where we can.
--
 
                         Best wishes,
 
                                  Max Hyre
  

Comments (none posted)

CNET succumbs to FUD or were allways part of it

From:		"David Hartley" <penguin@linuxweb.org>
To:		<letters@lwn.net>
Subject:		CNET succumbs to FUD or were allways part of it
Date:		Mon, 2 Jun 2003 13:59:21 -0400 (EDT)

 
As reported here: http://www.sys-con.com/linux/articlenews.cfm?id=779
CNET is quietly getting out of the linux download business.
(I first discovered this link at the Netraverse web site)
I am wondering if this is simply more fallout from the Source Challenged
Obfuscators or part of a bigger assault on Linux. At any rate CNET was
never a big player in the linux download business in my opinion so they
are safe to continue to be irrelevant.
 
--
David Hartley
penguin@linuxweb.org
Peace, Love, and Penguins
 
 

Comments (4 posted)

Security site

From:		"Jay R. Ashworth" <jra@baylink.com>
To:		lwn@lwn.net
Subject:		Security site
Date:		Mon, 2 Jun 2003 20:33:34 -0400
Cc:		risks@csl.sri.com

I'm fixin' (damn, but it's nice to live in the South :-) to flang up a
bunch of websites for friends and clients using WebGUI, and it occured
to me that if there was an automated tester for website security,
that'd be a good thing to play with.

In my search therefore, I came across a pretty spiffy site that
apparently *used* to be called Ideahamster (and indeed, that's the
domain name still) which includes the "Open Source Security Testing
Methodology" manual.

http://www.ideahamster.org/

Hain't read it yet, but it's got a groovy name, no?

If anyone has pointers to any *other* frameworks for this sort of
thing; I'd appreciate hearing about them.

Cheers,
-- jra
-- 
Jay R. Ashworth                                                jra@baylink.com
Member of the Technical Staff     Baylink                             RFC 2100
The Suncoast Freenet         The Things I Think
Tampa Bay, Florida        http://baylink.pitas.com             +1 727 647 1274

   "If you don't have a dream; how're you gonna have a dream come true?"
     -- Captain Sensible, The Damned (from South Pacific's "Happy Talk")

Comments (1 posted)

Page editor: Jonathan Corbet