LWN.net Weekly Edition for July 31, 2003

Not just IBM's problem

The Ottawa Kernel Summit managed to get through its agenda with almost no discussion of SCO, despite the fact that SCO had just told those developers that they need to purchase a binary licence in order to be able to run their own code. The IBM employees present were, without exception, entirely quiet on the whole situation - but they also radiated a sort of calm confidence that was impossible to miss. In general, at both the Summit and OLS, it was difficult to find anybody who was genuinely worried about SCO and its actions.

There are exceptions, of course, but it appears that much of the Linux community has come to the conclusion that IBM's lawyers will make the whole SCO problem go away. There are certainly reasons to feel that way. IBM's legal team inspires fear in many, especially when intellectual property issues are at stake. And IBM's interests align reasonably well with the wider community's interests in this case. IBM wants a commodity operating system platform which is free of external proprietary interests; with such a platform, IBM is well positioned to sell its hardware, services, and proprietary add-ons. So it would suit IBM to see SCO defeated in a manner that would strongly discourage any other enterprising bandits from attempting the same sort of heist.

Still, IBM is not the Linux community, and its interests are not exactly the same. It is conceivable (though unlikely) that IBM could eventually reach a settlement with SCO that ends the case, but leaves a number of users and developers in an uncertain legal position. And IBM has no particular incentive to defend Linux users against any future copyrights suits filed by SCO - especially if the victims are not IBM customers.

We all have high hopes for IBM's defense in this case. But the Linux community has a problem with SCO that is different from IBM's problem, and expecting IBM to fix it for us could prove to be a big mistake. We need to find ways of ending SCO's constant attacks on Linux developers and users. SCO's attempt to hijack and put a tax on Linux cannot be allowed to succeed.

The challenges which have quieted SCO in Germany (and, with luck, will have the same effect in Australia) show one way forward. SCO's attacks on Linux are slanderous, and its attacks on Linux developers head toward libel. The company needs to be made to put up its evidence or back down from its claims. This especially needs to happen in the U.S.

SCO also continues to distribute the 2.4 kernel - get your copy here. LWN downloaded a copy of this kernel on July 30, 2003; the date on SCO's server is May 9. This kernel lacks some of the disputed developments (e.g. RCU), but SCO has made it clear that it objects to code in all of the 2.4 kernels. So what we have here is SCO distributing code over which it claims proprietary rights as a derived product containing a great deal of uncontested, GPL-licensed code. That is, of course, a clear violation of the GPL. One can only hope that SCO's attitude toward copyright and licensing will come up at the IBM trial. But the situation would certainly be helped if one or more developers with copyrighted code in the kernel would bring an infringement case against SCO. That would be a counteroffensive which would attract some attention.

SCO is not just IBM's problem; the company has made it clear that it plans to cast its legal net far more widely than that. So it is important that IBM not be SCO's only problem. If we sit back and wait for IBM to clean up this mess, we may not get the thorough and complete job that we truly need.

Comments (10 posted)

Kroupware Kompleted

[This article was contributed by Joe 'Zonker' Brockmeier]

The Kroupware Project, announced last October, has been finished and released as Kolab. The project began last September when three companies, Erfrakon, Intevation GmbH and Klarälvdalens Datakonsult won a bid to create a free software groupware solution for Germany's federal agency for IT security, the Bundesamt für Sicherheit in der Informationstechnik (BSI). The goal was to create an end-to-end groupware solution, both client-side and server-side software, entirely from free software.

Instead of starting from scratch, which is where many free software projects fail, Kroupware was based on existing projects. The Kolab Server is made up of existing projects like Apache, Postfix, OpenLDAP and the Simple Authentication and Security Layer (SASL). The KDE Kolab client is made up of several existing programs for KDE, including KMail, Kontact and KDE PIM. Another project is underway to create an all-in-one groupware client for KDE called Kontact and work is being done on a webmail client as well.

The suite supports e-mail (POP3 and IMAP4), calendaring, global and private addressbooks, vacation notices, notes, synchronization with Palm OS devices, task lists and a number of other features that companies and organizations are looking for in a groupware suite. The server is managed using a Web-based interface. Almost all of the protocols used, with the notable exception of Palm's HotSync Protocol, are Internet Engineering Task Force (IETF) standards.

The project isn't aimed solely at any Linux distribution, or Linux alone for that matter. The Kolab server should run on just about any Unix-like system that runs Apache, Postfix, OpenLDAP and the other components that make up the server. On the client side, Windows users can fully access the Kolab Server groupware functions using Outlook and the Bynari Insight Connector Plugin. Note that the Bynari software is proprietary, but there is work being done by a third-party to create a free software connector. Other Windows groupware clients may work as well if an organization prefers to run Windows, or a mix of Windows and Linux, on the desktop.

It's good to see a fully open source, end-to-end, groupware solution being made available. Particularly one that allows Windows users and Linux users to share the same groupware server and allow companies to deploy Linux in some parts of their business without having to make an all-or-nothing commitment.

It will be interesting to see whether vendors are quick to embrace Kolab after developing their own groupware solutions. A single, standard, open source groupware solution could do a lot to boost Linux though it might hinder sales of products like Openexchange Server or Ximian Connector.

This is yet another piece of the puzzle that could allow Linux to gain significant share of the desktop market. At the moment, installation and configuration of the suite is still a bit rough for companies who are used to buying pre-packaged solutions. However, it should not be difficult for Linux distributors or other vendors to smooth over the installation process a bit and create a value-added product based on Kolab. And, of course, work continues on Kolab even though the Kroupware Project has been declared "complete." It seems as if legal challenges and perception are now the greatest obstacles to adoption of Linux on the desktop.

Comments (1 posted)

Trip report: the Ottawa Linux Symposium

The 2003 Ottawa Linux Symposium has run its course. Once again, OLS has established itself as the premier North American Linux developers' conference. A solid roster of speakers delivered four days' worth of intensely technical talks on where Linux development (and kernel development in particular) is headed. It is always nice to attend an event where the talk is technical and nobody is trying to sell you anything.

Your editor was not able to attend all of the presentations, of course, and did not write up every one he attended. Below, however, you'll find quick summaries of several of the more interesting talks given at OLS this year. Those looking for all the details can find them in the OLS 2003 Proceedings.

In response to popular demand (i.e. somebody actually asked), I have also put up the slides for my talk on porting drivers to the new kernel. Giving this sort of talk at OLS is a unique challenge, given that, for any topic, there's certain to be at least one person in the audience who knows way more than the speaker. Happily, the hecklers were kind...

Thanks are due to the OLS organizers for putting together another high-quality event, for the event's sponsors for helping making it possible, and to all the speakers for presenting their work.

Ugly ducklings - resurrecting unmaintained code

Dave Jone's talk covered the work he has done in 2.5 to fix up the MTRR and AGPGART drivers. Dave has observed a common sort of lifecycle for drivers. A driver is initially written for a specific vendor's widget. Over time, it is extended to support compatible widgets from other vendors, then slightly different widgets from yet other vendors. The number of special cases increases. Meanwhile, the maintainer gets bored and moves on. Eventually you end up with thousands of lines of spaghetti which is unmaintainable.

Dave's approach to such drivers includes splitting code into separate files by vendor (usually) and separating code which should never have been run together in the first place. "Useless abstractions" can be cleaned out. Eventually you end up with a code body which is sufficiently clean and understandable that it can be updated for modern hardware, new features, etc. But one should not underestimate the amount of work it can take to get there.

Large projects and bugzilla

Luis Villa discussed his experience working as GNOME's quality assurance person. He has, he estimates, read some 30,000 bug reports over the last few years. The experience appears to not have warped him too badly, though such things can take years to show.

He is, as one might expect, a strong proponent of organized bug tracking. A good QA system, he says, makes writing software easier (through reductions in mailing list traffic, among other things), eases the release process, makes the software better, and, important, makes writing software more fun.

The key point of the talk, perhaps, was that QA people have less power in free software projects than they do in the proprietary world. That makes it even more imperative that they not forget that they are providing a service to the developers, and that they have to understand what the developers need from them. Filtering ("triage") is especially important; developers should not have to deal directly with the full flow of bug reports. If the bug trackers are providing the sort of bug filtering and categorization that the hackers need, all will be well. Otherwise the bug tracking system will degenerate into an unused pile of old information.

Interactive kernel performance

Robert Love's talk covered work done in the 2.5 kernel to improve interactive performance. What's interactive? Robert takes a wide view; interactive applications are "everything except Oracle." The topics covered will be familiar to LWN Kernel Page readers; they include the anticipatory disk scheduler, the O(1) process scheduler, the preemptible kernel and other low-latency work, etc. In his opinion, the single most important bit of work to go in this time around (with regard to interactive performance) is the anticipatory scheduler.

udev - devfs done right

Greg Kroah-Hartman described udev, his user-space devfs replacement (covered here last April) in a standing room only session. Progress on udev has been slow since April (Greg has been busy with other stuff), but some things have happened. There is now a set of configuration files to allow the user to specify how device naming and permissions should be handled; it uses various attributes of a device (it's serial number, label, position in the bus topology, etc.) to figure out what the system administrator would like it to be called. Future versions will use the "tdb" database to track devices and handle persistent naming.

Future work includes changing udev to run as a daemon process; this change is required to properly handle out-of-order hotplug events. For those wanting to experiment with it, the udev code can be found on kernel.org in /pub/linux/utils/kernel/hotplug/.

Why doesn't my laptop suspend?

Pat Mochel's talk was on power management, or "why doesn't my laptop suspend?" He asked for a show of hands: how many in the audience have laptops? Well, this is OLS, so most of the attendees raised their hands. How many of those suspend correctly? Most hands went down.

Older, APM-based machines would handle suspend operations entirely in the firmware; it "just worked" for most people. Newer ACPI systems, however, push the suspend task into the software; this is evidently an improvement. And Linux software has not yet caught up with that. ACPI support is pretty much in place, but that is the easy part. The harder part is working power management support into all the drivers, coming up with a reliable way of suspending the system, and implementing a reasonable user-level interface to it all.

Much of this work has been done for 2.5; it still languishes in Pat's tree, however, and has not been merged into the mainline. The changes include a new set of driver power management methods; there is also a cleaned up software suspend subsystem with a safer snapshot mechanism and the ability to write the system image to any persistent media.

Pat has said that he will finish this work, though it was clear that he would appreciate some help from other developers as well. His hope is to get the work merged by August 20. Should he be successful, appreciative users should send him a birthday present ("small, unmarked bills") on that day.

Toward an O(1) VM

Rik van Riel discussed recent work with virtual memory management; the talk covered page replacement strategies, the reverse mapping VM, etc. The key point of his talk, however, was this: by many metrics relevent to VM, our newer, "faster" machines are actually slower. Over the years, the time required to perform tasks like reading an entire disk, or writing a system's entire RAM to disk, has gone up by a couple of orders of magnitude or more. Much of the previous century's research into VM is losing its relevance as memory and disk sizes increases faster then the transfer speeds between them. VM hackers increasingly find themselves having to make things up as they go.

Integrating DMA into the device model

James Bottomley discussed the new generic DMA layer; these functions have been documented in this article, which is part of the LWN driver porting series. What was new in this talk is James's discussion of where the DMA API needs to go in the future. The current version has no way of returning a failure code from the DMA mapping routines. But failure can happen: a system can run out of I/O memory management unit space, a problem which will be exacerbated in the future as GART hardware is used as a poor man's IOMMU. At some point, that sort of failure must be communicated back to the caller.

Device drivers can provide a DMA mask describing the range of addresses that their devices can handle. But there is no way for the system to pass back a mask saying which addresses the device needs to handle. Better performance can often be maintained when devices are operated in their smaller-memory modes; the system should provide the information that allows those modes to be used when they are applicable. Finally, the current approach to cache coherency needs some work; drivers should be able to find out just how coherency works on the host system. The means by which the CPU and peripherals share DMA buffers needs to be reorganized into a straightforward ownership model; in the current system, it is not always clear who has the right to change a buffer, and that can lead to data corruption.

The party

Your reporter was going to write up the legendary OLS closing party at the Black Thorn, but the whole event has become somewhat fuzzy and difficult to recall. Suffice to say that a lot of fun was had.

Comments (21 posted)

Page editor: Jonathan Corbet

Security

Brief items

On quietly fixing security holes

A recent Bugtraq posting came with the following statement:

This bug allows a remote attacker who can send packets to an NFSv3 server to overwrite memory and bring the system down. It would appear to be a hard vulnerability to exploit for anything beyond a denial of service, however.

The problem was not fixed entirely silently in 2.4.21; the relevant changelog entry reads "Avoid oops when NFSD decodes enourmous filehandle." Still, the fix has not been all that widely advertised either; there have been no alerts reading "systems running 2.4.20 and prior kernels may be subject to a denial of service vulnerability." In that sense, this was a classic "quiet fix."

There are advantages to quiet fixes when nobody is known to be exploiting the problem. With luck, the fix will be widely deployed before anybody notices the problem. If all goes well, many vulnerable installations can be protected before anybody begins to exploit the problem, and without the need for a panic update. These advantages need to be weighed against a couple of problems with quiet fixes, however. One is that crackers do watch changelogs and patch releases, hoping to find just this sort of fix. And the other is that many sites may continue to run vulnerable code because nobody has told them that there is a problem.

If you run any NFS servers with kernels older than 2.4.21, this is your notice that you may want to look into an upgrade. So far, nobody has been hurt by the quiet nature of this particular fix. Even so, it would have been better to treat it as the true security hole that it is.

Comments (3 posted)

New vulnerabilities

Apache: denial of service vulnerabilities

Package(s):	apache	CVE #(s):	CAN-2003-0460
Created:	July 24, 2003	Updated:	July 30, 2003
Description:	The Apache Software Foundation and The Apache Server Project released a new version of the Apache webserver which addresses the following security vulnerabilities: Denial of service (VU #379828) Ryan O'Neill reported that it is possible to make the httpd server enter infinite loops and crash under certain circumstances. A new configuration directive has been created (LimitInternalRecursion) to avoid these infinite loops and abort the request which caused them if the configured limit has been reached. File descriptor leak Leaks of several file descriptors to child processes, such as CGI scripts, were fixed.
Alerts:	Conectiva CLA-2003:704 2003-07-24

Comments (none posted)

konqueror: information disclosure vulnerability

Package(s):	kde konqueror	CVE #(s):	CAN-2003-0459
Created:	July 30, 2003	Updated:	August 11, 2003
Description:	All versions of Konqueror through KDE 3.1.2 contain a vulnerability wherein the browser could (in rare situations) send authentication information on an unrelated web site. See this advisory for details.
Alerts:	Red Hat RHSA-2003:235-01 2003-08-11 Debian DSA-361-2 2003-08-09 Slackware SSA:2003-213-01 2003-08-01 Debian DSA-361-1 2003-08-01 Mandrake MDKSA-2003:079 2003-07-31

Comments (none posted)

mnogosearch: Remote buffer overflow vulnerabilities

Package(s):	mnogosearch	CVE #(s):	CAN-2003-0436 CVE-2002-0789
Created:	July 28, 2003	Updated:	July 30, 2003
Description:	Buffer overflow in the "ul" variable (CAN-2003-0436) pokleyzz <pokleyzz -at- scan-associates.net> reported a buffer overflow vulnerability in mnoGoSearch which can be exploited remotely to execute arbitrary commands with the privileges of the webserver. Buffer overflow in the query variable ("q") (CVE-2002-0789) qitest1 <qitest1 -at- bespin.org> reported a buffer overflow vulnerability in the query variable ("q") which can be exploited remotely to execute arbitrary commands with the privileges of the webserver.
Alerts:	Conectiva CLA-2003:711 2003-07-28

Comments (none posted)

perl: cross site scripting vulnerability in CGI.pm module

Package(s):	perl	CVE #(s):	CAN-2003-0615
Created:	July 29, 2003	Updated:	October 1, 2003
Description:	obscure@eyeonsecurity.org reported a cross site scripting vulnerability in the CGI.pm perl module. This module is used to facilitate the creation of web forms and is part of the perl-modules RPM package. CAN-2003-0615
Alerts:	Red Hat RHSA-2003:256-02 2003-10-03 Red Hat RHSA-2003:256-01 2003-09-22 OpenPKG OpenPKG-SA-2003.039 2003-09-15 Mandrake MDKSA-2003:084 2003-08-20 Debian DSA-371-1 2003-08-11 OpenPKG OpenPKG-SA-2003.036 2003-08-06 Conectiva CLA-2003:713 2003-07-29

Comments (none posted)

stunnel: signal handler reentrancy DoS

Package(s):	stunnel	CVE #(s):	CAN-2002-1563
Created:	July 25, 2003	Updated:	November 25, 2003
Description:	Stunnel is a wrapper for network connections. It can be used to tunnel an unencrypted network connection over a secure connection (encrypted using SSL or TLS) or to provide a secure means of connecting to services that do not natively support encryption. When configured to listen for incoming connections (instead of being invoked by xinetd), stunnel can be configured to either start a thread or a child process to handle each new connection. If Stunnel is configured to start a new child process to handle each connection, it will receive a SIGCHLD signal when that child exits. Stunnel versions prior to 4.04 would perform tasks in the SIGCHLD signal handler which, if interrupted by another SIGCHLD signal, could be unsafe. This could lead to a denial of service.
Alerts:	Red Hat RHSA-2003:296-01 2003-11-24 SCO Group CSSA-2003-026.0 2003-10-03 Conectiva CLA-2003:736 2003-09-05 Trustix 2003-0030 2003-08-07 EnGarde ESA-20030806-020 2003-08-06 Red Hat RHSA-2003:221-01 2003-07-25

Comments (none posted)

sup: insecure temporary file

Package(s):	sup	CVE #(s):	CAN-2003-0606
Created:	July 29, 2003	Updated:	October 1, 2003
Description:	sup, a package used to maintain collections of files in identical versions across machines, fails to take appropriate security precautions when creating temporary files. A local attacker could exploit this vulnerability to overwrite arbitrary files with the privileges of the user running sup. CAN-2003-0606
Alerts:	Debian DSA-353-1 2003-07-29

Comments (none posted)

Updated vulnerabilities

2.4 kernel - several vulnerabilities

Package(s):	2.4 kernel	CVE #(s):	CAN-2003-0461 CAN-2003-0462 CAN-2003-0464 CAN-2003-0476 CAN-2003-0501 CAN-2003-0550 CAN-2003-0551 CAN-2003-0552
Created:	July 21, 2003	Updated:	December 24, 2003
Description:	Several security issues have been discovered affecting the Linux kernel: CAN-2003-0461: /proc/tty/driver/serial reveals the exact character counts for serial links. This could be used by a local attacker to infer password lengths and inter-keystroke timings during password entry. CAN-2003-0462: Paul Starzetz discovered a file read race condition existing in the execve() system call, which could cause a local crash. CAN-2003-0464: A recent change in the RPC code set the reuse flag on newly-created sockets. Olaf Kirch noticed that his could allow normal users to bind to UDP ports used for services such as nfsd. CAN-2003-0476: The execve system call in Linux 2.4.x records the file descriptor of the executable process in the file table of the calling process, allowing local users to gain read access to restricted file descriptors. CAN-2003-0501: The /proc filesystem in Linux allows local users to obtain sensitive information by opening various entries in /proc/self before executing a setuid program. This causes the program to fail to change the ownership and permissions of already opened entries. CAN-2003-0550: The STP protocol is known to have no security, which could allow attackers to alter the bridge topology. STP is now turned off by default. CAN-2003-0551: STP input processing was lax in its length checking, which could lead to a denial of service. CAN-2003-0552: Jerry Kreuscher discovered that the Forwarding table could be spoofed by sending forged packets with bogus source addresses the same as the local host.
Alerts:	Red Hat RHSA-2003:408-00 2003-12-19 Gentoo 200308-01 2003-08-14 Debian DSA-358-4 2003-08-13 SuSE SuSE-SA:2003:034 2003-08-12 Debian DSA-358-2 2003-08-05 Debian DSA-358-3 2003-08-04 Debian DSA-358-1 2003-07-31 EnGarde ESA-20032407-018 2003-07-24 Red Hat RHSA-2003:238-01 2003-07-21

Comments (none posted)

apache: multiple vulnerabilities in Apache HTTP server

Package(s):	apache	CVE #(s):	CAN-2003-0192 CAN-2003-0253 CAN-2003-0254
Created:	July 11, 2003	Updated:	September 22, 2003
Description:	The Apache Software Foundation and the Apache HTTP Server Project have announced the release of the Apache HTTP Server 2.0.47. This release fixes four security vulnerabilities: Certain sequences of per-directory renegotiations and the SSLCipherSuite directive being used to upgrade from a weak ciphersuite to a strong one could result in the weak ciphersuite being used in place of the strong one. [CAN-2003-0192] Certain errors returned by accept() on rarely accessed ports could cause temporal denial of service, due to a bug in the prefork MPM. [CAN-2003-0253] Denial of service was caused when target host is IPv6 but ftp proxy server can't create IPv6 socket. [CAN-2003-0254] The server would crash when going into an infinite loop due to too many subsequent internal redirects and nested subrequests. [VU#379828]
Alerts:	Red Hat RHSA-2003:243-01 2003-09-22 Red Hat RHSA-2003:240-01 2003-09-04 Mandrake MDKSA-2003:075-1 2003-08-28 Mandrake MDKSA-2003:075 2003-07-21 Conectiva CLA-2003:698 2003-07-21 Trustix 2003-0025 2003-07-11

Comments (none posted)

bind buffer overflow vulnerability in DNS resolver libraries

Package(s):	bind glibc	CVE #(s):	CAN-2002-0651 CAN-2002-0684
Created:	July 8, 2002	Updated:	October 1, 2003
Description:	The BIND 4.9.8-OW2 patch and BIND 4.9.9 release (and thus 4.9.9-OW1) include fixes for a libc related vulnerability which does not affect Linux. Updates from the Internet Software Consortium (ISC) are available from here. No release or branch of Openwall GNU/*/Linux (Owl) is known to be affected, due to Olaf Kirch's fixes for this problem getting into the GNU C library more than two years ago. Unfortunatly that does not mean that Linux systems are not vulnerable. Similar code, without Olaf Firch's fixes, is in the glibc getnetbyXXX functions. These functions are described in the SuSE alert as " used by very few applications only, such as ifconfig and ifuser, which makes exploits less likely." CERT Advisory: CA-2002-19 Buffer Overflow in Multiple DNS Resolver Libraries CAN-2002-0651 CAN-2002-0684
Alerts:	Mandrake MDKSA-2002:050 2002-08-13 Yellow Dog YDU-20020810-3 2002-08-10 Eridani ERISA-2002:035 2002-08-09 Red Hat RHSA-2002:133-13 2002-08-08 SCO Group CSSA-2002-034.0 2002-08-05 Yellow Dog YDU-20020801-2 2002-08-01 Eridani ERISA-2002:028 2002-07-25 Red Hat RHSA-2002:139-10 2002-07-22 EnGarde ESA-20020724-018 2002-07-24 Mandrake MDKSA-2002:043 2002-07-16 Trustix 2002-0061 2002-07-15 Gentoo glibc-20020713 2002-07-13 Conectiva CLA-2002:507 2002-07-11 SuSE SuSE-SA:2002:026 2002-07-09 OpenPKG OpenPKG-SA-2002.006 2002-07-04

Comments (1 posted)

Canna server: exploitable buffer overrun

Package(s):	canna	CVE #(s):	CAN-2002-1158 CAN-2002-1159
Created:	December 10, 2002	Updated:	October 1, 2003
Description:	Canna is a kana-kanji conversion server which is necessary for Japanese language character input. A buffer overflow bug in the Canna server up to and including version 3.5b2 allows a local user to gain the privileges of the user 'bin' which could lead to further exploits. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-1158 to this issue. A lack of validation of requests has been found that affects Canna version 3.6 and earlier. A malicious remote user could exploit this vulnerability to leak information, or cause a denial of service attack. (CAN-2002-1159) See also http://canna.sourceforge.jp/sec/Canna-2002-01.txt CAN-2002-1158 CAN-2002-1159
Alerts:	SCO Group CSSA-2003-005.0 2003-01-21 Debian DSA-224-1 2002-01-08 Gentoo 200212-8 2002-12-20 Red Hat RHSA-2002:246-18 2002-12-04

Comments (none posted)

CUPS: vulnerability in the CUPS IPP implementation

Package(s):	cups	CVE #(s):	CAN-2003-0195
Created:	May 27, 2003	Updated:	July 22, 2003
Description:	Phil D'Amore of Red Hat discovered a vulnerability in the CUPS IPP (Internet Printing Protocol) implementation. The IPP implementation is single-threaded, which means only one request can be serviced at a time. An attacker could make a partial request that does not time out and therefore creates a denial of service. In order to exploit this bug, an attacker must have the ability to make a TCP connection to the IPP port (by default 631).
Alerts:	Conectiva CLA-2003:702 2003-07-22 Gentoo 200306-09 2003-06-14 Debian DSA-317-1 2003-06-11 SuSE SuSE-SA:2003:028 2003-06-06 Yellow Dog YDU-20030602-3 2003-06-02 Mandrake MDKSA-2003:062 2003-05-29 Slackware ssa:2003-149-01 2003-05-29 Red Hat RHSA-2003:171-01 2003-05-27

Comments (none posted)

ethereal: security problems in Ethereal 0.9.12

Package(s):	ethereal	CVE #(s):	CAN-2003-0428 CAN-2003-0429 CAN-2003-0431 CAN-2003-0432
Created:	June 23, 2003	Updated:	November 10, 2003
Description:	Several security problems have been found in Ethereal 0.9.12. "It may be possible to make Ethereal crash or run arbitrary code by injecting a purposefully malformed packet onto the wire, or by convincing someone to read a malformed packet trace file."
Alerts:	SCO Group CSSA-2003-030.0 2003-11-07 Yellow Dog YDU-20030718-2 2003-07-18 Red Hat RHSA-2003:203-01 2003-07-03 Gentoo 200306-13 2003-06-25 Conectiva CLA-2003:662 2003-06-25 Mandrake MDKSA-2003:070 2003-06-23

Comments (none posted)

Filename disclosure vulnerability in fam

Package(s):	fam	CVE #(s):	CAN-2002-0875
Created:	August 19, 2002	Updated:	January 5, 2005
Description:	"fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible.
Alerts:	Red Hat RHSA-2005:005-01 2005-01-05 Debian DSA-154-1 2002-08-15

Comments (none posted)

fdclone: insecure temporary directory

Package(s):	fdclone	CVE #(s):	CAN-2003-0596
Created:	July 23, 2003	Updated:	October 1, 2003
Description:	fdclone creates a temporary directory in /tmp as a workspace. However, if this directory already exists, the existing directory is used instead, regardless of its ownership or permissions. This would allow an attacker to gain access to fdclone's temporary files and their contents, or replace them with other files under the attacker's control. CAN-2003-0596
Alerts:	Debian DSA-352-1 2003-07-22

Comments (none posted)

fetchmail: buffer overflow

Package(s):	fetchmail	CVE #(s):	CAN-2002-1365
Created:	December 17, 2002	Updated:	October 20, 2003
Description:	Versions of fetchmail prior to 6.2.0 have (yet another) buffer overflow vulnerability which can be exploited remotely via a suitably crafted message. See this advisory for details.
Alerts:	Immunix IMNX-2003-7+-023-01 2003-10-17 Mandrake MDKSA-2003:011 2003-01-27 EnGarde ESA-20030127-002 2003-01-27 SCO Group CSSA-2003-001.0 2003-01-09 SuSE SuSE-SA:2003:001 2003-01-02 Debian DSA-216-1 2002-12-24 Red Hat RHSA-2002:293-09 2002-12-17 Conectiva CLA-2002:554 2002-12-16

Comments (3 posted)

glibc: DNS stub resolvers contain buffer overflow vulnerability

Package(s):	glibc	CVE #(s):	CAN-2002-1146
Created:	November 7, 2002	Updated:	February 5, 2004
Description:	DNS stub resolvers from multiple vendors contain a buffer overflow vulnerability. The impact of this vulnerability appears to be limited to denial of service. (See CERT Vulnerability Note VU#738331) The BIND 4 and BIND 8.2.x stub resolver libraries, and other libraries such as glibc 2.2.5 and earlier, libc, and libresolv, uses the maximum buffer size instead of the actual size when processing a DNS response, which causes the stub resolvers to read past the actual boundary ("read buffer overflow"), allowing remote attackers to cause a denial of service (crash).
Alerts:	Mandrake MDKSA-2004:009 2004-02-04 Red Hat RHSA-2002:197-09 2002-11-06 Red Hat RHSA-2002:197-06 2002-10-03

Comments (none posted)

gnupg: key validation

Package(s):	gnupg	CVE #(s):	CAN-2003-0255
Created:	May 16, 2003	Updated:	November 18, 2003
Description:	A key validation bug was discovered in the GNU Privacy Guard (GPG) which would cause keys with more then one user ID to trust all user ID's with the amount of trust given to the most-valid user ID.
Alerts:	SCO Group CSSA-2003-034.0 2003-11-17 Conectiva CLA-2003:694 2003-07-11 Yellow Dog YDU-20030602-4 2003-06-02 Mandrake MDKSA-2003:061 2003-05-22 Slackware ssa:2003-141-04 2003-05-22 Red Hat RHSA-2003:175-01 2003-05-20 Gentoo 200305-04 2003-05-16 OpenPKG OpenPKG-SA-2003.029 2003-05-16 EnGarde ESA-20030515-016 2003-05-15

Comments (none posted)

gnupg: gpg setgid

Package(s):	gnupg	CVE #(s):
Created:	July 21, 2003	Updated:	July 23, 2003
Description:	gpg needs to be setuid to make use of protected memory space, however the setgid bit allowed the gpg user to overwrite files owned by the group root.
Alerts:	Gentoo 200307-06 2003-07-19

Comments (none posted)

gtkhtml: malformed messages cause crash

Package(s):	gtkhtml	CVE #(s):	CAN-2003-0133 CAN-2003-0541
Created:	April 14, 2003	Updated:	April 18, 2005
Description:	GtkHTML is the HTML rendering widget used by the Evolution mail reader. GtkHTML supplied with versions of Evolution prior to 1.2.4 contain a bug when handling HTML messages. Alan Cox discovered that certain malformed messages could cause the Evolution mail component to crash.
Alerts:	Debian DSA-710-1 2005-04-18 Mandrake MDKSA-2003:093 2003-09-18 Conectiva CLA-2003:737 2003-09-12 Red Hat RHSA-2003:264-01 2003-09-09 Mandrake MDKSA-2003:046 2003-04-15 Red Hat RHSA-2003:126-01 2003-04-14

Comments (none posted)

kernel 2.4 - two new vulnerabilities

Package(s):	kernel	CVE #(s):	CAN-2003-0244 CAN-2003-0246
Created:	May 14, 2003	Updated:	July 25, 2003
Description:	The 2.4.20 (and prior) kernel contains a couple of vulnerabilities that are worth fixing. The ioperm() system call doesn't perform proper checking, allowing a local user to manipulate arbitrary I/O ports. The networking code contains a remotely exploitable denial of service condition; see the May 24 Security Page for details.
Alerts:	Mandrake MDKSA-2003:066-2 2003-07-25 Conectiva CLA-2003:701 2003-07-22 Mandrake MDKSA-2003:066-1 2003-07-21 Mandrake MDKSA-2003:074 2003-07-15 Slackware SSA:2003-168-01 2003-06-17 Mandrake MDKSA-2003:066 2003-06-11 Debian DSA-312-1 2003-06-09 Debian DSA-311-1 2003-06-08 Red Hat RHSA-2003:187-01 2003-06-03 Red Hat RHSA-2003:145-01 2003-05-27 EnGarde ESA-20030515-017 2003-05-15 Red Hat RHSA-2003:172-00 2003-05-14

Comments (2 posted)

kernel-utils: setuid vulnerability

Package(s):	kernel-utils	CVE #(s):	CAN-2003-0019
Created:	February 7, 2003	Updated:	January 21, 2005
Description:	The kernel-utils package contains several utilities that can be used to control the kernel or machine hardware. In Red Hat Linux 8.0 this package contains user mode linux (UML) utilities. The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was incorrectly shipped setuid root. This could allow local users to control certain network interfaces, add and remove arp entries and routes, and put interfaces in and out of promiscuous mode. All users of the kernel-utils package should update to these packages that contain a version of uml_net that is not setuid root. Alternatively, as a work-around to this vulnerability issue the following command as root: chmod -s /usr/bin/uml_net
Alerts:	Red Hat RHSA-2003:056-08 2003-02-07

Comments (none posted)

libpng, libpng3: buffer overflow

Package(s):	libpng, libpng3	CVE #(s):	CAN-2002-1363
Created:	December 19, 2002	Updated:	July 14, 2004
Description:	Glenn Randers-Pehrson discovered a problem in connection with 16-bit samples from libpng, an interface for reading and writing PNG (Portable Network Graphics) format files. The starting offsets for the loops are calculated incorrectly which causes a buffer overrun beyond the beginning of the row buffer.
Alerts:	Gentoo 200407-06 2004-07-08 OpenPKG OpenPKG-SA-2004.030 2004-07-06 Mandrake MDKSA-2004:063 2004-06-29 Whitebox WBSA-2004:249-01 2004-06-21 Fedora FEDORA-2004-176 2004-06-18 Fedora FEDORA-2004-174 2004-06-18 Fedora FEDORA-2004-175 2004-06-18 Fedora FEDORA-2004-173 2004-06-18 Red Hat RHSA-2004:249-01 2004-06-18 Conectiva CLA-2003:564 2003-01-23 Mandrake MDKSA-2003:008 2003-01-20 OpenPKG OpenPKG-SA-2003.001 2003-01-15 Yellow Dog YDU-20030114-2 2002-01-14 SuSE SuSE-SA:2003:0004 2003-01-14 Red Hat RHSA-2003:006-06 2003-01-09 Debian DSA-213-1 2002-12-19

Comments (none posted)

lynx: CRLF injection vulnerability

Package(s):	lynx	CVE #(s):	CAN-2002-1405
Created:	November 19, 2002	Updated:	October 1, 2003
Description:	If lynx is given a url with some special characters on the command line, it will include faked headers in the HTTP query. This feature can be used to force scripts (that use Lynx for downloading files) to access the wrong site on a web server with multiple virtual hosts. CAN-2002-1405
Alerts:	Conectiva CLA-2003:720 2003-08-11 Mandrake MDKSA-2003:023 2003-02-24 OpenPKG OpenPKG-SA-2003.011 2003-02-18 Red Hat RHSA-2003:029-06 2003-02-12 Trustix 2002-0085 2002-12-19 Debian DSA-210-1 2002-12-13 SCO Group CSSA-2002-049.0 2002-11-18

Comments (none posted)

perl-MailTools: remote command execution

Package(s):	MailTools	CVE #(s):	CAN-2002-1271
Created:	November 5, 2002	Updated:	September 19, 2003
Description:	The SuSE Security Team reviewed critical Perl modules, including the Mail::Mailer package. This package contains a security hole which allows remote attackers to execute arbitrary commands in certain circumstances. This is due to the usage of mailx as default mailer which allows commands to be embedded in the mail body. Note that mail processing programs which use this package can be affected by this vulnerability; in particular, SpamAssassin is vulnerable if you use the -r or -w flags.
Alerts:	Debian DSA-386-1 2003-09-18 Gentoo 200302-01 2003-02-02 Mandrake MDKSA-2002:076 2002-11-07 Gentoo 200211-001 2002-11-06 SuSE SuSE-SA:2002:041 2002-11-05

Comments (none posted)

mikmod: buffer overflow

Package(s):	mikmod	CVE #(s):	CAN-2003-0427
Created:	June 16, 2003	Updated:	June 16, 2005
Description:	Ingo Saitz discovered a bug in mikmod whereby a long filename inside an archive file can overflow a buffer when the archive is being read by mikmod.
Alerts:	Fedora FEDORA-2005-405 2005-06-16 Red Hat RHSA-2005:506-01 2005-06-13 Fedora FEDORA-2005-404 2005-06-09 Gentoo 200307-01 2003-07-02 Debian DSA-320-1 2003-06-13

Comments (none posted)

mpg123 - buffer overflow

Package(s):	mpg123	CVE #(s):	CAN-2003-0577
Created:	July 16, 2003	Updated:	September 30, 2003
Description:	The mpg123 utility contains a buffer overflow vulnerability which can allow an attacker to execute arbitrary code by way of a malicious MP3 file.
Alerts:	Gentoo 200309-17 2003-09-30 Mandrake MDKSA-2003:078 2003-07-23 Conectiva CLA-2003:695 2003-07-15

Comments (none posted)

Nessus NASL scripting engine security issues

Package(s):	nessus	CVE #(s):
Created:	May 27, 2003	Updated:	August 12, 2004
Description:	Some some vulnerabilities exsist in the Nessus NASL scripting engine. To exploit these flaws, an attacker would need to have a valid Nessus account as well as the ability to upload arbitrary Nessus plugins in the Nessus server (this option is disabled by default) or he/she would need to trick a user somehow into running a specially crafted nasl script. Read the full advisory for additional information.
Alerts:	Gentoo 200305-10 2003-05-27

Comments (none posted)

net-snmp: denial of service vulnerability

Package(s):	net-snmp	CVE #(s):	CAN-2002-1170
Created:	December 17, 2002	Updated:	November 7, 2003
Description:	The SNMP daemon included in the Net-SNMP package versions 5.0.1 through 5.0.4 can be caused to crash if it is sent a specially crafted packet.
Alerts:	Conectiva CLA-2003:778 2003-11-07 Red Hat RHSA-2002:228-11 2002-12-17

Comments (none posted)

nfs-utils xlog() off-by-one bug

Package(s):	nfs-utils	CVE #(s):	CAN-2003-0252
Created:	July 14, 2003	Updated:	March 8, 2004
Description:	Linux NFS utils package contains remotely exploitable off-by-one bug. A local or remote attacker could exploit this vulnerability by sending specially crafted request to rpc.mountd daemon. See this BugTraq post for more details.
Alerts:	Trustix TSLSA-2004-0009 2004-03-05 SCO Group CSSA-2003-037.0 2003-11-17 Conectiva CLA-2003:700 2003-07-22 Mandrake MDKSA-2003:076 2003-07-21 Gentoo 200307-07 2003-07-19 Yellow Dog YDU-20030718-1 2003-07-18 Slackware SSA:2003-195-01b 2003-07-15 Immunix IMNX-2003-7+-018-01 2003-07-14 SuSE SuSE-SA:2003:031 2003-07-15 Slackware SSA:2003-195-01 2003-07-14 Debian DSA-349-1 2003-07-14 Red Hat RHSA-2003:206-01 2003-07-14

Comments (none posted)

openssh: timing attack leads to information disclosure

Package(s):	openssh	CVE #(s):	CAN-2003-0190
Created:	May 2, 2003	Updated:	November 30, 2004
Description:	From the advisory: "During a pen-test we stumbled across a nasty bug in OpenSSH-portable with PAM support enabled (via the --with-pam configure script switch). This bug allows a remote attacker to identify valid users on vulnerable systems, through a simple timing attack. The vulnerability is easy to exploit and may have high severity, if combined with poor password policies and other security problems that allow local privilege escalation."
Alerts:	Ubuntu USN-34-1 2004-11-30 OpenPKG OpenPKG-SA-2003.035 2003-08-06 Red Hat RHSA-2003:222-01 2003-07-29 Gentoo 200305-02 2003-05-13 Gentoo 200305-01 2002-03-05

Comments (1 posted)

PHP: vulnerability in mail function

Package(s):	php	CVE #(s):	CAN-2002-0985 CAN-2002-0986
Created:	November 13, 2002	Updated:	October 1, 2003
Description:	Two vulnerabilities exists in the mail() PHP function. The first one allows the execution of any program/script bypassing safe_mode restriction, the second one may give an open-relay script if the mail() function is not carefully used in PHP scripts. See this Bugtraq report for more details. Note that this is a different vulnerability than the previous PHP mail() problem, which affected versions through 4.1.0. CAN-2002-0985 CAN-2002-0986
Alerts:	SCO Group CSSA-2003-008.0 2003-03-04 Gentoo 200211-005 2002-11-20 EnGarde ESA-20021122-031 2002-11-22 Conectiva CLA-2002:545 2002-11-13 Red Hat RHSA-2002:213-06 2002-11-11

Comments (none posted)

PHP: Cross site scripting vulnerability

Package(s):	PHP	CVE #(s):	CAN-2003-0442
Created:	July 2, 2003	Updated:	August 13, 2003
Description:	In PHP version 4.3.1 and earlier, when transparent session ID support is enabled using the "session.use_trans_sid" option, the session ID is not escaped before use. This allows a Cross Site Scripting attack.
Alerts:	Mandrake MDKSA-2003:082-1 2003-08-12 Mandrake MDKSA-2003:082 2003-08-04 Yellow Dog YDU-20030710-2 2003-07-10 Debian DSA-351-1 2003-07-16 Conectiva CLA-2003:691 2003-07-08 OpenPKG OpenPKG-SA-2003.032 2003-07-07 Red Hat RHSA-2003:204-01 2003-07-02

Comments (none posted)

phpgroupware - cross-site scripting and other exploits

Package(s):	phpgroupware	CVE #(s):	CAN-2003-0504 CAN-2003-0582
Created:	July 16, 2003	Updated:	October 1, 2003
Description:	Several vulnerabilities were discovered in all versions of phpgroupware prior to 0.9.14.006. This latest version fixes an exploitable condition in all versions that can be exploited remotely without authentication and can lead to arbitrary code execution on the web server. This vulnerability is being actively exploited. Version 0.9.14.005 fixed several other vulnerabilities including cross-site scripting issues that can be exploited to obtain sensitive information such as authentication cookies. See this Security Corportation report for more information. CAN-2003-0504 CAN-2003-0582
Alerts:	Debian DSA-365-1 2003-08-05 Conectiva CLA-2003:703 2003-07-23 Mandrake MDKSA-2003:077 2003-07-23 Conectiva CLA-2003:697 2003-07-16

Comments (none posted)

PostgreSQL - more buffer overflows

Package(s):	postgresql	CVE #(s):
Created:	February 12, 2003	Updated:	November 7, 2003
Description:	A new set of buffer overflows has been discovered in PostgreSQL 7.2.2; they affect the circle_poly(), path_encode(), and path_addr() functions. Exploiting these overflows requires that the attacker first obtain a connection to the PostgreSQL server.
Alerts:	Debian DSA-397-1 2003-11-07 Immunix IMNX-2003-7+-005-01 2003-04-08 Trustix 2003-0004 2003-02-20 Mandrake MDKSA-2002:062-1 2003-02-11

Comments (1 posted)

Local arbitrary code execution vulnerability in Python

Package(s):	python	CVE #(s):	CAN-2002-1119
Created:	August 28, 2002	Updated:	October 1, 2003
Description:	Zack Weinberg discovered that os._execvpe from os.py uses a predictable name which could lead to execution of arbitrary code. According to the Debian advisory, the problem was present in Python versions 1.5, 2.1 and 2.2. CAN-2002-1119
Alerts:	Red Hat RHSA-2002:202-33 2003-02-12 OpenPKG OpenPKG-SA-2003.006 2003-01-23 Red Hat RHSA-2002:202-25 2003-01-21 Mandrake MDKSA-2002:082-1 2002-12-09 Mandrake MDKSA-2002:082 2002-11-25 SCO Group CSSA-2002-045.0 2002-11-14 Trustix 2002-0073 2002-10-17 Gentoo python-20021003 2002-10-03 Conectiva CLA-2002:527 2002-10-01 Debian DSA-159-2 2002-09-09 Debian DSA-159-1 2002-08-28

Comments (none posted)

Multiple-use vulnerability in Safe.pm

Package(s):	Safe.pm	CVE #(s):	CAN-2002-1323
Created:	October 9, 2002	Updated:	February 20, 2004
Description:	usePerl has a description of a vulnerability in the Safe.pm Perl module. It seems that if a Safe compartment is used more than once, it ceases to be safe. The problem is fixed in Safe 2.08.
Alerts:	SCO Group CSSA-2004-007.0 2004-02-20 Gentoo 200212-6 2002-12-20 Trustix 2002-0087 2002-12-19 OpenPKG OpenPKG-SA-2002.014 2002-12-16 Debian DSA-208-1 2002-12-12

Comments (none posted)

semi: insecure temporary file

Package(s):	semi, wemi	CVE #(s):	CAN-2003-0440
Created:	July 7, 2003	Updated:	October 1, 2003
Description:	semi, a MIME library for GNU Emacs, does not take appropriate security precautions when creating temporary files. This bug could potentially be exploited to overwrite arbitrary files with the privileges of the user running Emacs and semi, potentially with contents supplied by the attacker. wemi is a fork of semi, and contains the same bug. CAN-2003-0440
Alerts:	Gentoo 200308-02 2003-08-14 Yellow Dog YDU-20030723-2 2003-07-23 Red Hat RHSA-2003:234-01 2003-07-23 Debian DSA-339-1 2003-07-06

Comments (none posted)

File overwrite vulnerability in tar and unzip

Package(s):	tar unzip	CVE #(s):	CAN-2001-1267 CAN-2001-1268 CAN-2001-1269 CAN-2002-0399
Created:	October 1, 2002	Updated:	April 10, 2006
Description:	The tar utility does not properly filter file names containing "../", meaning that a hostile archive can, if unpacked by an unsuspecting user, overwrite any file that is writable by that user. GNU tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42 has the same vulnerability.
Alerts:	Fedora-Legacy FLSA:183571-1 2006-04-04 Red Hat RHSA-2006:0195-01 2006-02-21 Conectiva CLA-2002:538 2002-10-29 Mandrake MDKSA-2002:066 2002-10-10 Mandrake MDKSA-2002:065 2002-10-10 EnGarde ESA-20021003-022 2002-10-03 Gentoo unzip-20021001 2002-10-01 Gentoo tar-20021001 2002-10-01 Red Hat RHSA-2002:096-24 2002-09-18

Comments (1 posted)

teapop: SQL injection

Package(s):	teapop	CVE #(s):	CAN-2003-0515
Created:	July 9, 2003	Updated:	October 1, 2003
Description:	teapop, a POP-3 server, includes modules for authenticating users against a PostgreSQL or MySQL database. These modules do not properly escape user-supplied strings before using them in SQL queries. This vulnerability could be exploited to execute arbitrary SQL under the privileges of the database user as which teapop has authenticated. CAN-2003-0515
Alerts:	Gentoo 200309-18 2003-09-30 Debian DSA-347-1 2003-07-08

Comments (none posted)

Multiple vendor telnetd vulnerability

Package(s):	telnet Telnet netkit-telnet-ssl kerberos telnetd netkit-telnet nkitb/nkitserv/telnetd krb5	CVE #(s):
Created:	May 21, 2002	Updated:	October 5, 2004
Description:	This vulnerability, originally thought to be confined to BSD-derived systems, was first covered in the July 26th Security Summary. It is now known that Linux telnet daemons are vulnerable as well.
Alerts:	Gentoo 200410-03 2004-10-05 Yellow Dog YDU-20010810-2 2001-08-10 Yellow Dog YDU-20010810-1 2001-08-10 SuSE SuSE-SA:2001:029 2001-09-03 Slackware sl-997726350 2001-08-09 Red Hat RHSA-2001:100-02 2001-08-09 Red Hat RHSA-2001:099-09 2002-02-07 Red Hat RHSA-2001:099-06 2001-08-09 Progeny PROGENY-SA-2001-27 2001-08-14 Mandrake MDKSA-2001:093 2001-12-17 Mandrake MDKSA-2001:068 2001-08-13 HP HPSBTL0202-023 2002-02-12 Debian DSA-075-2 2001-08-14 Debian DSA-075-1 2001-08-14 Conectiva CLA-2001:413 2001-08-24 SCO Group CSSA-2001-030.0 2001-08-10

Comments (none posted)

unzip: directory traversal vulnerability

Package(s):	unzip	CVE #(s):	CAN-2003-0282
Created:	July 1, 2003	Updated:	November 13, 2003
Description:	A vulnerabilitiy in unzip version 5.50 and earlier allows attackers to overwrite arbitrary files during archive extraction by placing invalid (non-printable) characters between two "." characters. These non-printable characters are filtered, resulting in a ".." sequence. See the full advisory for further information.
Alerts:	SCO Group CSSA-2003-031.0 2003-11-07 Debian DSA-344-2 2003-08-26 Slackware SSA:2003-237-01 2003-08-25 Mandrake MDKSA-2003:073-1 2003-08-19 Conectiva CLA-2003:724 2003-08-18 Red Hat RHSA-2003:199-02 2003-08-15 Yellow Dog YDU-20030710-1 2003-07-10 Gentoo 200307-02 2003-07-11 OpenPKG OpenPKG-SA-2003.033 2003-07-10 Debian DSA-344-1 2003-07-08 Mandrake MDKSA-2003:073 2003-07-07 Conectiva CLA-2003:672 2003-07-02 Immunix IMNX-2003-7+-017-01 2003-07-02 Red Hat RHSA-2003:199-01 2003-07-01

Comments (none posted)

vim - modeline vulnerability

Package(s):	vim	CVE #(s):	CAN-2002-1377
Created:	January 16, 2003	Updated:	February 10, 2004
Description:	VIM allows a user to set the modeline differently for each edited text file by placing special comments in the files. Georgi Guninski found that these comments can be carefully crafted in order to call external programs. This could allow an attacker to create a text file such that when it is opened arbitrary commands are executed.
Alerts:	Conectiva CLA-2004:812 2004-02-10 Mandrake MDKSA-2003:012 2003-02-03 Yellow Dog YDU-20030127-3 2003-01-27 Gentoo 200301-13 2003-01-22 OpenPKG OpenPKG-SA-2003.003 2003-01-21 Red Hat RHSA-2002:297-17 2003-01-15

Comments (4 posted)

vixie-cron: Local vulnerability

Package(s):	vixie-cron	CVE #(s):	CVE-2001-0559
Created:	April 17, 2003	Updated:	October 3, 2003
Description:	From the ISS advisory: "Vixie Cron is a scheduling daemon that ships with several Linux distributions. Vixie Cron version 3.0pl1 could allow a local attacker to gain root privileges. Crontab fails to properly drop privileges in certain cases after a crontab modification operation. A local attacker could exploit this vulnerability to gain root privileges on the system since crontab is installed setuid root." Note: this vulnerability is dated May 07 2001, and was first mentioned in LWN on the May 10, 2001 security page.
Alerts:	Conectiva CLA-2003:758 2003-10-03 Conectiva CLA-2003:757 2003-10-03 Conectiva CLA-2003:628 2003-04-17

Comments (none posted)

webmin: session ID spoofing

Package(s):	webmin	CVE #(s):	CAN-2003-0101
Created:	June 13, 2003	Updated:	November 18, 2003
Description:	miniserv.pl in the webmin package does not properly handle metacharacters, such as line feeds and carriage returns, in Base64-encoded strings used in Basic authentication. This vulnerability allows remote attackers to spoof a session ID, and thereby gain root privileges.
Alerts:	SCO Group CSSA-2003-035.0 2003-11-17 Debian DSA-319-1 2003-06-12

Comments (none posted)

wget:directory traversal bug

Package(s):	wget	CVE #(s):	CAN-2002-1344
Created:	December 10, 2002	Updated:	October 1, 2003
Description:	Versions of wget prior to 1.8.2-4 contain a bug that permits a malicious FTP server to create or overwrite files anywhere on the local file system. FTP clients must check to see if an FTP server's response to the NLST command includes any directory information along with the list of filenames required by the FTP protocol (RFC 959, section 4.1.3). If the FTP client fails to do so, a malicious FTP server can send filenames beginning with '/' or containing '/../' which can be used to direct a vulnerable FTP client to write files (such as .forward, .rhosts, .shosts, etc.) that can then be used for later attacks against the client machine. See also this Bugtraq article from 1997. CAN-2002-1344
Alerts:	Immunix IMNX-2003-7+-011-01 2003-06-03 OpenPKG OpenPKG-SA-2003.007 2003-01-23 SCO Group CSSA-2003-003.0 2003-01-16 Gentoo 200212-7 2002-12-20 Trustix 2002-0089 2002-12-19 Conectiva CLA-2002:552 2002-12-13 Debian DSA-209-1 2002-12-12 Mandrake MDKSA-2002:086 2002-12-11 Red Hat RHSA-2002:229-10 2002-12-04

Comments (none posted)

Wwwoffle remote privilege escalation vulnerability

Package(s):	wwwoffle	CVE #(s):	CAN-2002-0818
Created:	August 14, 2002	Updated:	October 1, 2003
Description:	The wwwoffle web proxy incorrectly processes HTTP PUT and POST requests with negative Content Length values. "It is believed that an attacker could exploit this bug to gain remote wwwrun access to the system wwwoffled is running on." CAN-2002-0818
Alerts:	SCO Group CSSA-2002-048.0 2002-11-18 Debian DSA-144-1 2002-08-06 SuSE SuSE-SA:2002:029 2002-08-01

Comments (none posted)

xinetd: Memory leak in xinetd 2.3.10

Package(s):	xinetd	CVE #(s):	CAN-2003-0211
Created:	May 13, 2003	Updated:	November 13, 2003
Description:	Xinetd is a 'master server' that is used to to accept service connection requests and start the appropriate servers. Because of a programming error, memory was allocated and never freed if a connection was refused for any reason. An attacker could exploit this flaw to crash the xinetd server, rendering all services it controls unavailable. In addition, other flaws in xinetd could cause incorrect operation in certain unusual server configurations. All users of xinetd are advised to update to xinetd-2.3.11 which is not vulnerable to these issues.
Alerts:	Conectiva CLA-2003:782 2003-11-12 Yellow Dog YDU-20030602-1 2003-06-02 Gentoo 200305-08 2003-05-19 Mandrake MDKSA-2003:056 2003-05-14 Red Hat RHSA-2003:160-01 2003-05-13

Comments (none posted)

Xpdf - command execution vulnerability

Package(s):	Xpdf	CVE #(s):	CAN-2003-0434
Created:	June 18, 2003	Updated:	July 24, 2003
Description:	Xpdf suffers from the same sort of "execute arbitrary code embedded in a malicious document" vulnerability that is so widespread in other PostScript and PDF interpreters.
Alerts:	Mandrake MDKSA-2003:071-1 2003-07-23 Yellow Dog YDU-20030723-1 2003-07-23 Red Hat RHSA-2003:196-02 2003-07-17 Conectiva CLA-2003:674 2003-07-04 Mandrake MDKSA-2003:071 2003-06-27 Gentoo 200306-11 2003-06-25 Yellow Dog YDU-20030620-1 2003-06-20 Red Hat RHSA-2003:196-01 2003-06-18

Comments (none posted)

Resources

Security newsletters

The July 28 O'Reilly Security Alerts column is available; it looks at the latest apache and kernel problems, along with several others.

The latest Linux Advisory Watch and Linux Security Week newletters from LinuxSecurity.com are also available.

Comments (none posted)

Events

Financial Cryptography '04

The 2004 Financial Cryptography conference will be held February 9 to 12 in Key West, Florida. The call for papers has gone out, with submissions due by September 1.

Full Story (comments: none)

Page editor: Jonathan Corbet

Kernel development

Brief items

Kernel release status

The current development kernel is 2.6.0-test2, which was released by Linus on July 27. It contains a lot of fixes, of course, including a bunch of forward-ported 2.4 patches, numerous architecture updates, some IDE fixes, an option to remove I/O schedulers from the kernel entirely, and a new local_t type for CPU-local data. See the long-format changelog for the details.

As of this writing, there are no patches beyond -test2 in Linus's BitKeeper repository.

The current stable kernel is 2.4.21. Marcelo has been busy with the prepatches, however; 2.4.22-pre8 was released on July 24, and 2.4.22-pre9 on July 29. Both patches limit themselves to fixes.

Comments (none posted)

Kernel development news

Fixing interactive response in 2.6

While the performance improvements in the 2.6 kernel have impressed and pleased many users, there has been a constant level of complaining about the scheduler. In particular, many users are unhappy with the interactive feel of the 2.6 kernel; reports of jerky response and skipping audio are common. Some have gone as far as to compare the 2.6-test scheduler with the 2.4 virtual memory subsystem at the same point in the development cycle. There is some concern that scheduling could be one of the (few) embarrassments in the upcoming 2.6.0 release. Those worries are probably overdone, but the point is that 2.6.0-test scheduling still needs some work.

The good news is that said work is being done. Con Kolivas has been posting a set of interactivity patches for about a month now. Those wanting to try them out can find them in a recent -mm kernel; patches against the Linus kernels can be found on Con's web site. His most recent patch is 011int.

Con's work follows a familiar theme: improve interactive performance by giving a priority boost to interactive processes. All you have to do is figure out which processes are the interactive ones. Of course, that is rather easier said than done. Con's interactivity patches have been through several iterations in an attempt to find the best way to identify interactive processes and the proper amount of bonus to give them. This patch series may be converging on a result; several testers have reported good results.

The core idea (already part of the 2.6.0-test scheduler) is that an interactive process is one which sleeps much of the time. With Con's patches, any process which sleeps for at least one clock tick gets a priority bonus when it wakes up; processes which have done enough sleeping recently to be explicitly marked as "interactive" get a bigger bonus than others. Processes which run without sleeping for their entire time slice lose a point. In this way, CPU-hog processes sink to the lowest priorities, while a process reading from a terminal (or an audio stream) will get quick access to the processor. Additionally, processes which have maxed out their sleep bonus and are seen as truly interactive can hang out in the run queue for a while even after their time slice expires.

Life is not always so simple, however. Early versions of this patch tended to make life hard for newborn processes; it took them quite a while to build up enough of an interactivity bonus to be able to respond quickly on a loaded system. So things had to be tweaked to let new processes find their natural level quickly. There is also the issue of processes that sleep for a long time, then wake up to do some serious cranking. So processes that sleep for longer than one second lose their interactivity bonus, and end up at an "idle" level just below the interactive level. Work has also been required to balance priorities properly when an interactive process forks.

More recently, Ingo Molnar has also started looking at the interactivity problem; his sched-2.6.0-test1-G6 patch takes a different approach. Ingo starts by changing the scheduler to use nanosecond resolution in its timekeeping; his claim is that, by working with high-resolution time, audio skipping problems can be fixed. Then, the patch splits up time slices so that processes running at the same priority switch off with each other much more often, ensuring that none of them have to wait too long before getting some processor time. Finally, Ingo's patch extends the sleep bonus to include time that the process sits in the run queue, but does not actually get into the processor.

The two sets of patches are mostly orthogonal to each other; while it remains hard to apply both Con's and Ingo's patches to a single system, the two really are addressing different issues. Recent versions of Con's patches, however, also include some of Ingo's work (almost everything except the nanosecond resolution). In the end, code from both patches is likely to find its way into the kernel.

As a postscript, it's worth taking a look at this post from Daniel Phillips, where he states that the wrong approach is being taken for the audio skipping problem. Audio playback, says Daniel, is not an interactive task - it is a realtime task. What is really needed for the audio case is a bounded-latency soft realtime scheduler, not an endless series of interactive scheduler tweaks.

Comments (8 posted)

A different approach to module races

The topic of module unload races - where the kernel can end up calling into a module which has been removed - comes back occasionally. Much work has been done in 2.5 to reduce and eliminate these races. Part of that effort was moving module reference counting outside of the modules themselves. The result was a safer scheme, but one which imposes new requirements on kernel code which calls into modules. In some kernel subsystems (networking), the maintainers have decided that there is no need to worry about reference counting for modules; they simply ignore it.

Enter Rusty Russell. Since the reference counts are seen to be a pain, and some code isn't using them at all, why not simply get rid of them? He has submitted a patch which does exactly that.

Of course, the issue of how to safely remove modules remains. Without reference counts, how does the kernel know when it can actually get rid of a particular module? With Rusty's patch, a different approach is taken: modules are never actually removed. If an administrator invokes rmmod, the module's cleanup function will be called and all kernel knowledge of the module will go away - but the module code itself will remain in the kernel. The patch thus sacrifices some system memory on every unload as a way of avoiding unload races.

Some developers liked this patch, others didn't. For a kernel hacker who is debugging a module, a little lost memory for each load/unload cycle is probably not a big problem; the system will likely be rebooted soon anyway. The patch does present a bigger problem for Linux installers, however; many of these do hardware detection by loading almost every module available and seeing which ones actually find something. On a "small" system (that is, say, 64MB), it is possible that some distribution installers would simply run out of memory and die.

Rusty proposed adding a special rmmod option which would clean up memory left behind by deleted modules (while also marking the kernel tainted). For now, however, all of this has been made irrelevant by Linus, who decreed: "First off - we're not changing fundamental module stuff any more." This statement drew an amused response from Rusty ("OK. Who are you and what have you done with the real Linus?"), but the general sigh of relief from most kernel hackers could be heard worldwide. It seems that Linus is truly holding the line and keeping out potentially disruptive changes this time around.

Comments (4 posted)

Reiser4 is coming

The final part of the 2.3 development series featured a strong campaign to get the ReiserFS filesystem merged. That campaign was successful; ReiserFS was added in 2.4.1. Now it appears that history may repeat itself with the 2.6 kernel. Hans Reiser has posted a note asking that the soon-to-be-posted Reiser4 patch be merged into 2.6.0-test.

Reiser4 is not an updated version of ReiserFS; it is an entirely new filesystem. According to the posted benchmarks, Reiser4 outperforms ReiserFS and ext3 on several fronts. According to Hans, the performance of Reiser4 is now good enough to justify including it in 2.6-test.

The truly interesting part of Reiser4 is not limited to performance, however. Reiser4 is presented as a fully atomic filesystem - every operation either executes fully or not at all. It thus offers the same sort of crash resistence found in journaling filesystems, but with a couple of differences. One is that, it is claimed, the "wandering log" technique used in Reiser4 offers greater speed, since, unlike with other journaling schemes, it is not necessary to write data twice. And the other is that the "fully atomic" nature of the filesystem can extend beyond individual operations. Reiser4, in other words, can provide actual transactions.

A typical journaling filesystem works by writing all of the blocks to be changed in a given operation to a special journal file, followed by a "commit record." Once the operation is committed, the blocks can be copied from the journal to their real destination on the disk. If the system dies before the commit record is written, the operation is simply discarded and the filesystem is unchanged. If, instead, a fully committed operation is found in the journal, it can be replayed. With a scheme like this, an operation may be lost in a crash, but the filesystem itself will not be corrupted.

The Reiser4 wandering log technique works a little differently. It does not overwrite blocks in the filesystem; instead, blocks to be changed are relocated and the data is written in the new spot. The block pointers in the filesystem are changed in an (also relocated) directory block. This process continues up the filesystem tree until, with a single write pointing to the new root block, the whole operation is committed. The elimination of the need to write data separately to a journal file can increase performance, but this technique also has the potential to fragment files across the disk, hurting read performance. For that reason, Reiser4 allows for plugin modules which can look at operations and opt for a more normal journaling scheme when it makes sense. There will also be a "repacker" program which will go through occasionally and rearrange disks for better read performance.

The ability to perform multi-operation, multi-file transactions is what will make Reiser4 truly unique, however. A transactional capability will allow applications to perform complicated operations without the need to resort to tricks with fsync() and file renaming, and without the need to use a separate database manager. Of course, there are a few residual issues, like the fact that the standard Unix system calls make no provision for starting, committing, and rolling back transactions. So a new system call interface will be required. The Reiser4 developers are working on this interface, but have not yet posted it for wide review.

Linus has not committed himself with regard to merging Reiser4 into 2.6. It's worth noting that, when ReiserFS was merged, it had been stable and widely used for some time. That is not the case for Reiser4, which is still in an early stage. Chances are that Reiser4 will have a harder time getting into the kernel than ReiserFS did. (For more information on Reiser4, see this document on transactions, and this one on wandering logs, dancing trees, and other journaling topics).

Comments (12 posted)

Patches and updates

Kernel trees

• Linus Torvalds: Linux v2.6.0-test2. (July 28, 2003)

• Andrew Morton: 2.6.0-test2-mm1. (July 29, 2003)

• Stephen Hemminger: 2.6.0-test2-osdl1. (July 29, 2003)

• Martin J. Bligh: 2.6.0-test2-mjb1. (July 30, 2003)

• Marcelo Tosatti: Linux 2.4.22-pre9. (July 29, 2003)

• Marcelo Tosatti: Linux 2.4.22-pre8. (July 25, 2003)

• J.A. Magallon: Linux 2.4.22-pre8-jam1m. (July 26, 2003)

Core kernel code

• Rusty Russell: Remove module reference counting.. (July 26, 2003)

• Con Kolivas: O9int for interactivity. (July 26, 2003)

• Con Kolivas: O10int for interactivity. (July 28, 2003)

• Con Kolivas: O11int for interactivity. (July 30, 2003)

• Ingo Molnar: sched-2.6.0-test1-G6, interactivity changes. (July 28, 2003)

• Erich Focht: [patch 2.6.0-test1] node affine NUMA scheduler extension. (July 29, 2003)

• Erich Focht: [patch] scheduler fix for 1cpu/node case. (July 29, 2003)

• Fabian Frederick: shm kobject model against 2.6t1. (July 26, 2003)

• Pavel Machek: swsusp updates. (July 28, 2003)

• Nigel Cunningham: Annouce: swsusp 1.1-pre1. (July 30, 2003)

Device drivers

• Jaroslav Kysela: ALSA update 0.9.6. (July 28, 2003)

• Benjamin Herrenschmidt: Framebuffer: client notification mecanism & PM. (July 29, 2003)

• Philip Graham Willoughby: PATCH : LEDs - possibly the most pointless kernel subsystem ever. (July 29, 2003)

• Krzysztof Halasa: 2.6.0-test2 wanXL driver. (July 29, 2003)

• Bagalkote, Sreenivas: megaraid 2.00.6 driver. (July 30, 2003)

Documentation

• Denis Vlasenko: lk maintainers. (July 28, 2003)

Filesystems and block I/O

• Bernardo Innocenti: Make I/O schedulers optional (Was: Re: Kernel 2.6 size increase). (July 26, 2003)

• Lever, Charles: Announcing Release Two of NFSv4 on Linux 2.4. (July 29, 2003)

Janitorial

• Christoph Hellwig: remove the release timer from all pcmcia net drivers. (July 25, 2003)

Networking

• Thomas Graf: Extended Generic Packet Classifier. (July 29, 2003)

Security-related

• Olaf Dietsche: 2.6.0-test2: access permission filesystem 0.16. (July 28, 2003)

Benchmarks and bugs

• Martin J. Bligh: 2.6.0-test2-mm1 results. (July 30, 2003)

Miscellaneous

• Greg KH: udev 0.2 release. (July 29, 2003)

Page editor: Jonathan Corbet

Distributions

News and Editorials

Linux in Spain

[This article was contributed by Ladislav Bodnar]

While Germany's Munich has been stealing the headlines with its effort to convert the city's public administration infrastructure from Windows to Linux, another European country has been even bolder and more successful in adopting open source software for similar tasks. This country is Spain. Based on its many success stories and the determined approach of several regional governments, it won't be an exaggeration to claim that Spain -- of all European countries -- is furthest along the road to Linux adoption and is setting a notable precedent for other countries to follow.

Although Linux had always been popular with the geek segment of Spain's computer users, its wide-spread adoption really got off the ground with the announcement in April 2002 of the LinEx project. The LinEx distribution, based on Debian GNU/Linux and with GNOME as its default desktop environment, was created by the regional government of Extremadura in Western Spain. Extremadura had set itself some clear goals: create conditions for wide-spread adoption of information technology and increase computer literacy among the citizens. Various ideas for achieving those goals were followed by clear plans -- until the realization that the cost of providing the hardware in combination with inevitable software licenses would be unbearable.

Refusing to give up at the first hurdle, the Extremadura government turned to open source software. It did not hesitate to employ engineers to create a customized Linux distribution which would meet its exact needs. Although the first releases of LinEx were not without problems, the subsequent ones have seen dramatic improvements, especially in the area of hardware support. There was no shortage of testers, as the government gave away the product CDs at every opportunity - in government offices, magazines and even daily newspapers. There was a determined campaign to get LinEx out to everybody. Finally, the effort bore fruit and the Extremadura government announced last month that it had successfully deployed 80,000 LinEx computers in schools, or one system per two students, and it had also created 33 computer centers for use by the general population.

Enthusiam for free software tends to be contagious, so few people were taken by surprise when the neighboring province of Andalusia, the largest in Spain and roughly the size of Minnesota or Austria, also began flirting with Linux. It wasn't long before a firm policy was declared in March of this year. It demanded, among other things, that all software development carried out by "La Junta de Andalusia" or any official educational entity be developed with free software. Additionally, all hardware acquired by official educational centers was to be fully compatible with Free Software operating systems, which was to come pre-installed on all newly purchased computers. All official Internet access points were required to be equipped with Free Software.

Next in the line of "infected" regions was Aragon, another large province in the North East of the country. Earlier this month, its government introduced intensive 40-hour Linux courses in Zaragoza, the region's capital, while the local Linux enthusiasts have launched the Zaralinux portal and even their own distribution called Augustux. Augustux is a Knoppix-based live CD with full support for the local language and its latest version is freely available for download. It is worth noting that Richard Stallman visited Zaragoza earlier this month to take part in a conference on Free Software movement and GNU/Linux.

Even if the remaining regional governments of Spain have yet to declare any open source software initiatives, they are undoubtedly watching the progress made by the pioneers in Extremadura and Andalusia with keen eyes. After all, politics and finance play important roles in every society. If other regions can save substantial amounts of money and provide their citizens with access to technology at the same time, then opposition parties and taxpayers in other provinces will have every reason to demand the same. This in turn will create further opportunities for commercial companies in software development, education and technical support.

And indications are that this is already happening. Spain has always had a fair share of Linux distributions and while some of them are no longer around, new ones are being established regularly. The oldest ones are HispaFuentes and ESware. Although HispaFuentes seems to have withdrawn from developing their Red Hat-based distribution and is concentrating instead on custom solutions, support and security, ESware continues with active development of its Debian-based desktop and server products called ESware365. The company also provides consultation and support services as well as educational and certification programs. Several new Linux companies have sprouted recently. Among them is BlueSock Linux Solutions, a company creating a Debian-based distribution called BlueSock Linux (a first beta release is now available for download) and Lambdaux (λux), a commercial company producing yet another Debian and LinEx-based distribution. Both of them also offer a range of Linux training and certification services.

Spain is a country which has embraced Linux and free software with open arms for the benefit of both its population and its economy. Between the government initiatives, volunteer efforts, commercial companies and non-profit communities, the country has pioneered Linux adoption like no other on this planet. Determination in overcoming difficulties, resistance and FUD of those whose livelihood depends on the current status quo, together with a clear plan of action has made Extremadura and LinEx an example to follow. Many countries are a lot poorer than Spain, yet they still run their public administration on expensive proprietary software and channel their taxpayers' money out of the country. As Extremadura has shown us, it doesn't need to be that way.

Comments (7 posted)

Distribution News

Mandrake Linux 9.2 Beta 1 Officially Released

Mandrake Linux 9.2 Beta 1 has arrived to offer you the opportunity of an entertaining summer of bug squashing. It's got lots of updated packages and it's waiting to be downloaded now. Just be sure not to use it in production environments, and report those bugs.

Full Story (comments: none)

Red Hat Enterprise Linux 3 Beta 1

Red Hat has announced a public beta release of Red Hat Enterprise Linux 3. This release is available for several architectures, and includes a heavily patched 2.4.21 kernel (Native Posix Threading, FUTEXes, per-device block I/O locking, reverse-mapping VM, huge pages, the O(1) scheduler, ACPI 2.0, 4G/4G memory split, asynchronous I/O, TUX, filesystem ACLs, cryptographic API, IPSec, etc.) along with a very current set of applications. See the announcement for details.

Full Story (comments: 2)

Xandros Desktop

Xandros, Inc. has released a 1.1 edition of Xandros Desktop Deluxe. It's got the Mozilla communications suite 1.3.1 with spell checking and spam filtering; the OpenOffice.org office suite 1.0.3; the Evolution groupware client 1.2.4; Enhanced hardware detection; plus printed documentation and 30 days of e-mail support.

Xandros has announced a giveaway of Xandros Desktop Deluxe to attendees of the San Francisco LinuxWorld convention.

Comments (2 posted)

Debian GNU/Linux

The Debian Project had a successful conference in Oslo. According to Debian Project Leader, Martin Michelmayr, Debcamp was particularly impressive. ""This year's debconf and especially the preceding debcamp were a great success. The idea of having a debcamp in which people can work on various projects together was born during last year's debconf and got realised this year. We have seen that it is very effective when you can put people who normally work together via the Internet into a single room. Many design and implementation issues have been discussed and have successfully been resolved. We will try to hold more debcamps in the future, possibly smaller ones in different countries.""

The Debian Weekly News for July 29, 2003 is out. This week's issue looks at the Open Group's new strategy; a review of the CheckInstall tool; and much more.

The ZopeMembers site reports that a Debian package for OpenFlow is available for download from the Icube website.

Comments (none posted)

Gentoo Weekly Newsletter -- Volume 2, Issue 30

The Gentoo Weekly Newsletter for July 28, 2003 is out. This week looks at radical changes to Perl module handling; the first Gentoo Bug Day on August 2; Gentoo Linux 1.4 for PowerPC now available for pre-order; and Indonesian documentation team in need of translators.

Full Story (comments: none)

Slackware Linux

This week Slackware Linux has upgraded USB modules to 2.4.21, and packages such as gawk, dvd+rw-tools, binutils, distcc, apache, mod_ssl, and nfs-utils. As usual the details can be found in the slackware-current changelog.

Comments (none posted)

New Distributions

SPB-Linux

SPB-Linux is a USB distribution that boots from a memory stick. The current stable version is 2.0, but the most recent version is 2.1 beta 1 which features kernel 2.4.21 with usb 2 support, X, mozilla and more. (Thanks to Fred Mobach)

Comments (none posted)

ScummLinux

ScummLinux creates a bootable Linux CD which includes ScummVM and your favorites Scumm games, so you can play them anywhere. The initial version of ScummLinux is 0.1, released July 27, 2003.

Comments (none posted)

Minor distribution updates

Damn Small Linux

Damn Small Linux has released v0.4.1 with minor feature enhancements. "Changes: This release offers a choice of two X servers, Xvesa and Xfbdev. Xfbdev uses the framebuffer provided by the Linux framebuffer device, which can be a much better choice for older laptops. Also new is the emelFM file manager." Version 0.4.2 is also out.

Comments (none posted)

Fli4l (Floppy ISDN/DSL)

Fli4l (Floppy ISDN/DSL) has released development v2.1.3 with major feature enhancements. "Changes: You can now specify MX entrys in the nameserver configuration. The packet filter config is much-improved, and you can also switch to an alternate configuration scheme for enhanced packet filter configuration. Portforwarding now works with whitelists and you can forward a whole protocol (e.g., GRE). You can now do DSL with the Fritz!DSL from AVM and use the in-kernel PPPoE to reduce your CPU load. It is now also possible to install and boot on DiscOnChip and USB-Memory-Sticks. Included in the ISDN package is the CAPI for ISDN cards from AVM."

Comments (none posted)

Knoppix

Knoppix has released v3.2-2003-07-26 with major feature enhancements. "Changes: Many software upgrades, new drivers, and boot options."

Comments (none posted)

System-Down::Rescue

System-Down::Rescue has released v1.035 with minor feature enhancements. "Changes: This release should be considered a release candidate for 1.0. The uncompressed ISO image has been reduced in size to only about 18 MByte, with a lot of free space on the CD-cards available for upgrades. The scripts and the library directory have been cleaned and the various file systems have been changed. Ext2 is now used for the initrd image and cramfs is used for the images to allow them to be mounted runtime, reducing RAM usage and improving general performance. Many bugfixes were made to the net libraries, so ping and ftp now work."

Comments (none posted)

Page editor: Rebecca Sobol

Development

Python 2.3 is out

Following last week's release of Python 2.3c2, the final Python 2.3 release has been announced.

Some of the highlights of this release include:

• A new version of the Python IDE, IDLE.
• A large collection of new and improved library modules.
• Lots of new and improved built-in functions.
• Deprecation of obsolete functions.
• New doctest extensions.
• Extended slice capabilities.
• A universal newline mode for reading files with different newline types.
• Source code encoding declarations.
• The ability to import from zip files.
• FutureWarnings for performing unsigned operations on integers.
• Improved list.sort() speed.
• Sped up multiplication of longs.
• A more efficient pickling protocol.
• Optional timeouts on all socket module operations.
• Tkinter GUI improvements.
• A new boolean type.
• Better support for comma-delimited files.

A.M. Kuchling has put together a detailed list of PEPs and changes in his What's New in Python 2.3 document. For those who wish to give Python 2.3 a spin, the official Python 2.3 home page has source code and more documentation.

Comments (none posted)

System Applications

Audio Projects

Alsa 0.9.6 sound driver

Version 0.9.6 of the Alsa sound driver has been released. Change information is in the source code.

Comments (none posted)

Clusters and Grids

xCAT overview (IBM developerWorks)

IBM's alphaWorks has published an updated overview of xCAT, the Extreme Cluster Administration Toolkit. "xCAT (Extreme Cluster Administration Toolkit) is a tool kit that can be used for the deployment and administration of Linux clusters."

Comments (none posted)

Database Software

Druid 3.0 final released (SourceForge)

Version 3.0 final of Druid has been released. "This is mainly a bug fix release with only a few adds: a new PDF doc gen module and localization of the XHTML doc gen module (see changes in the files section). All the docs have been moved from HTML to PDF to be printed and have been revised and improved. Druid is a tool that helps the dba/developer to handle database tables."

Comments (none posted)

PostgreSQL Weekly News

The PostgreSQL Weekly News for July 25, 2003 has been published. "Well we are still technically in feature freeze, with beta now planned to start next week. Don't confuse feature freeze with no activity, far from it actually. In fact, there are now plans to release a 7.3.4 before beta testing begins. The need arises from a potentially serious (although extremely low probability) bug in 7.3.3 when restarting the server."

Full Story (comments: none)

PostgreSQL 7.3.4 Now Available

Version 7.3.4 of the PostgreSQL database is available. "The PostgreSQL Global Development Group has released PostgreSQL version 7.3.4. It is highly recommended that those running earlier version of the 7.3 branch upgrade at their earliest convenience."

Comments (none posted)

SAP DB Version 7.4.03.27 available now

A new version of the SapDB database is available. See the release info document for a full list of changes.

Comments (none posted)

Electronics

gEDA News

The latest news from the gEDA site includes new versions of the SAVANT VHDL analyzer, and the Icarus Verilog electronic simulation language compiler.

Comments (none posted)

Mail Software

First open source release of MailManager (ZopeMembers)

The first open-source release of MailManager has been announced on Zope Members News. "MailManager is a multi user system where all mail is stored centrally in the ZODB. This allows mail to be allocated between groups of users, provides tools for prioritising and answering mail quickly, allows service levels to be set and provides management reports on volumes of mail and user performance."

Comments (1 posted)

Defending Your Site Against Spam, Part 2 (O'Reilly)

Dru Nelson explains qmail spam filtering on O'Reilly. "This article is the second and final installment describing my efforts to defend my systems from spam. The first article explains some necessary concepts and terminology. This article will dig more into the details of an actual implementation with my mail system."

Comments (none posted)

Networking Tools

Etherboot 5.0.11 (production) released (SourceForge)

Production version 5.0.11 of Etherboot has been released. "Etherboot is Open Source code for creating boot ROMs for network booting x86 platforms. It is also a coordination point for information about free software related to network booting."

Comments (none posted)

Printing

PPR 1.51 released (SourceForge)

A new version of PPR has been released. "PPR is a print spooler especially designed to work with PostScript printers and with Ghostscript. It supports parallel ports, serial ports, SMB, TCP/IP, and AppleTalk."

Comments (none posted)

Web Site Development

Simplify Your Life with Apache Virtual Hosts (O'Reilly)

Russell Dyer writes about Apache virtual hosts on O'Reilly. "Web designers and systems administrators sometimes don't consider reconfiguring Apache to solve some of their web problems. Sometimes with the help of a few directives, web designing can be easier and server costs can be reduced. The VirtualHost directive is one of these helpful but often overlooked features. It can be used for running several domains on a single server with one or many static IP addresses. I can think of at least two scenarios in which this could be useful. One made web designing easier for me. The other cut my server costs significantly."

Comments (none posted)

GroupUserFolder 1.3 released (ZopeMembers)

A new version of GroupUserFolder, a Zope group-oriented component, is available. "This new version adds a very nice feature : groups nesting. GRUF Groups can now belong to other groups transparently. Also, this version includes nice ZMI improvements: groups and users displayed as a tree, a click-on-everything management interface, and minor bugfixes."

Comments (none posted)

Issue Dealer 0.9.1 released (ZopeMembers)

Version 0.9.1 of the Zope product Issue Dealer has been released. Changes include a name change, bug fixes, and more.

Comments (none posted)

mnoGoSearch 3.2.14 search engine released

Version 3.2.14 of mnoGoSearch, a web site search engine, is available. The development history page lists the changes, a number of bugs have been fixed.

Comments (none posted)

Rilke CMS 0.84 released! (SourceForge)

Version 0.8.4 of the Rilke CMS has been released. "Rilke CMS provides easy content management for non-geeks. It allows you to easily publish a weblog, update a public website, or collaborate on a private Intranet site."

Comments (none posted)

Tiki 1.7 RC3 released (SourceForge)

Version 1.7 RC3 of Tiki is available. "The rc3 replaces the rc2 and fixes the registration verification bug that is blocking in rc2. Tiki is a powerful CMS/Groupware. Features: article, forum, newsletter, blog, file/image gallery, wiki, drawing, tracker, directory, poll/survey & quiz, FAQ, chat, banner, webmail, calendar, category, ACL, etc in Single Sign-on or LDAP. (PHP/MySQL/Smarty)"

Comments (none posted)

Ninth Zope 3 Newsletter

Issue #9 of the Zope 3 Newsletter is out with the latest Zope 3 news.

Full Story (comments: none)

Zope 2.6.2 Beta 5 Available (ZopeMembers)

Zope Members has announced the availability of ZOPE 2.6.2 Beta 5. "Zope 2.6.2b5 represents a development step in the next Zope release formed with a large number of community contributions."

Comments (none posted)

Zope Tips

John Udell's Web Log features some tips on using the Zope web application platform. "Although Zope's written in Python, you lose this immediacy because like any Web application server, Zope introduces a bunch of intermediate layers: templates, scripts, the browser. But I learned of a few ways to make exploring Zope a more interactive affair."

Comments (none posted)

Miscellaneous

Barbecue 1.0.6b3 released (SourceForge)

Version 1.0.6b3 of Barbecue, a barcode generator, has been released. The announcement says: "Fixes bugs with Code 39 implementation and barcode heights. All b1 and b2 users should update to this release. Production users should remain at 1.0.5 or earlier."

Comments (none posted)

Squashfs1.3 released (SourceForge)

Version 1.3 of Squashfs is available. "Squashfs is a highly compressed read-only filestem for Linux. Release 1.3 adds support for FIFOs and sockets. It also has numerous optimisations and small bug fixes."

Comments (none posted)

Desktop Applications

Audio Applications

amSynth 1.0 rc4 available

Version 1.0 rc4 of amSynth, the Analogue Modelling SYNTHesizer, has been released. Changes include bug fixes and an improved startup procedure.

Full Story (comments: none)

gmorgan 0.06 released

Rapid development continues on gmorgan, an organ synthesizer with auto-accompaniment. Version 0.06 adds performance improvements, bug fixes, and some new features.

Full Story (comments: none)

CAD

Ninth Development Release of PythonCAD

A new release of PythonCAD has been announced. "The ninth release concentrated on internal improvements to the code. The storage and manipulation of optional values was heavily reworked. The first batch of changes regarding storing various drawing entities was finished, with the handling of colors having the largest number of changes. Linetypes and drawing styles will be updated in a similar manner to colors in future releases."

Full Story (comments: none)

Desktop Environments

KDE 3.1.3 released

KDE 3.1.3 has been released. The full list of changes can be found in the changelog, but it makes relatively dry reading - 3.1.3 is a maintenance release. (Thanks to Volker Blum).

Comments (none posted)

KDE-CVS-Digest

The July 25, 2003 edition of the KDE-CVS-Digest has been published. "This week's CVS-Digest: Find out who is paid to hack KDE. A new application, KLogo-Turtle, for teaching children. KPrinter adds access to online printer database. Kontact adds a to-do list plugin. A redesigned font installer. The beginning of KWallet. And many more features and bugfixes."

Comments (none posted)

Financial Applications

LinuxTag 2003: KSpread Development Roadmap

KDE.News covers the new KSpread Development Roadmap that resulted from discussions at LinuxTag 2003, with a look at the upcoming KSpread 1.3.

Comments (none posted)

Graphics

GIMP 1.3.17 Released (GnomeDesktop)

GnomeDesktop.org has the announcement for version 1.3.17 of the GIMP. "GIMP Lots of new features are being added while the GIMP developers are preparing for camp and GIMP is approaching feature freze."

Comments (none posted)

JFreeChart 0.9.10 released (SourceForge)

JFreeChart 0.9.10 is available. "The focus of this release is the support for multiple range axes (instead of the current limit of 2 range axes per chart). Some other minor enhancements and bug fixes are also included. JFreeChart is a class library, written in Java, for generating charts. Utilising the Java2D APIs, it currently supports bar charts, pie charts, line charts, XY-plots and time series plots."

Comments (none posted)

OpenRM Scene Graph 1.5.0 released (SourceForge)

SourceForge has an announcement for version 1.5.0 of OpenRM Scene Graph, a 2D/3D Scene Graph rendering engine. "New in OpenRM Scene Graph 1.5.0 is direct support for distributed memory parallel rendering when combined with Chromium (chromium.sourceforge.net)"

Comments (none posted)

GUI Packages

FLTK 1.1.4rc2 released

Version 1.1.4rc2 of FLTK, the Fast Light ToolKit, has been released. The development team is searching for bugs until August 12, 2003 at which point the 1.1.4 version will be released.

Comments (none posted)

Trolltech Releases Qt 3.2 (KDE.News)

KDE.News covers the release of Qt version 3.2. "User desktop improvements include a "completely re-written, faster font rendering engine." Developer improvements include new QSpashScreen and QToolBox objects." See the announcement from Trolltech for more information.

Comments (none posted)

GUI Toolkits for The X Window System (FreshMeat)

FreshMeat has reviewed a number of X window system GUI toolkits. "This article is aimed at Unix developers who already have some experience with programming languages and want to start developing GUI applications (mainly for The X Window System, though portability is discussed). It may also come in handy if you have used a particular GUI toolkit for some time and want to know whether others might suit your needs better. The main focus is comparison and introduction, but it serves as a bit of tutorial, as well."

Comments (none posted)

Mail Clients

Columba 0.12.0 (stable) released (SourceForge)

Version 0.12.0 of Columbia has been released. "Columba is an email client written in Java, featuring a user-friendly graphical interface with wizards and internalionalization support."

Comments (none posted)

Mozilla Thunderbird 0.1 Released (MozillaZine)

MozillaZine has an announcement for version 0.1 of Mozlla Thunderbird, a standalone mail and newsgroup client. The release notes detail all of the changes in this version.

Comments (none posted)

Office Applications

HylaFAX 4.1.7 Released

Version 4.1.7 of HylaFAX, a Fax modem utility, has been announced. "This is a corrective release that fixes the PageChop feature that we inadvertently broke in the 4.1.6 patch-level, and is otherwise identical to 4.1.6."

Comments (none posted)

Web Browsers

gcjwebplugin 0.0.2 released

Version 0.0.2 of gcjwebplugin is available. "gcjwebplugin is a plugin for Mozilla and other web browsers for the execution of Java applets. It uses the JVM provided by GCJ." The project is still in the testing and proof of concept phase.

Comments (none posted)

Mozilla Firebird 0.6.1 Released (MozillaZine)

According to MozillaZine, verion 0.6.1 of the Firebird browser has been released. "mozilla.org has just released a minor upgrade to their Mozilla Firebird 0.6 milestone, to fix a few key issues regarding security and stability, including the autocomplete crash."

Comments (none posted)

Independent Status Reports (MozillaZine)

The Tuesday July 29th, 2003 Mozilla Independent Status Reports are out. "The latest set of status reports includes updates from Download Sort, Enigmail, Gnusto, mozdev, Java and BlackConnect."

Comments (none posted)

Word Processors

AbiWord Weekly News

Issue #154 of the AbiWord Weekly News is out. The summary says: "A possible standard for spell checking management, Enchant, is finally released after last week's announcement. The Open Text Summarizer reaches a level of complexity that will blow other summarisers out of the water. More GNOME HIGrrrification, help with OSX X11 and more we enter the week that will bring us 1.99.3."

Comments (none posted)

AbiWord 1.99.3 released! (GnomeDesktop)

GnomeDesktop.org has the announcement for version 1.99.3 of AbiWord. "Wow, just 3 weeks since the last release of our Word Processor and we have tons of improvements."

Comments (none posted)

Miscellaneous

gFTP 2.0.15rc1 has been released (GnomeDesktop)

A new release of gFTP, an ftp client, has been announced. A long list of changes is included.

Comments (none posted)

LilyPond 1.7.28 released

A new release candidate of GNU LilyPond, a music typesetting system, has been released. This version features bug fixes and installation improvements.

Full Story (comments: none)

Languages and Tools

C

Secure Cooking with C and C++, Part 2 (O'ReillyNet)

O'Reilly has published part two in a three part series on secure programming in C/C++ "In part two in this three-part series of sample recipes from Secure Programming Cookbook for C and C++, the authors discuss some of the factors to consider to properly decode a URL, and they provide example code programmers can use to securely decode URLs. " You may want to start off with part one of the series.

Comments (none posted)

Caml

Caml Weekly News

The July 22-29, 2003 edition of the Caml Weekly News is out, take a look for the latest Caml language news.

Full Story (comments: none)

FORTRAN

gcc-g95 integrated into the GCC CVS repository

The GNU Fortran 95 compiler has been integrated into a branch of the GCC CVS repository. "This branch of GCC will become part of official GCC releases by the time GCC 3.5 is released."

Comments (none posted)

Java

HTML Parser Integration Release 1.4-20030727 (SourceForge)

SourceForge has an announcement for a new version of HTML Parser, a Java library. "This release includes a preliminary drop of the new I/O subsystem (which isn't integrated yet), incorporates JUnit and Apache commons-logging liraries (also not used yet), and adds several new tests of the contents of the StringBean."

Comments (none posted)

Using the Jakarta Commons, Part 3 (O'Reilly)

O'Reilly has published Part 3 of Vikram Goyal's series on Jakarta Commons. "Jakarta Commons is a Jakarta subproject that creates and maintains independent packages unrelated to any other framework or product. The packages are a collection of components that serve small, useful purposes in their own right, and are usually server-centric."

Comments (none posted)

RSSOwl 0.3a released (SourceForge)

Version 0.3a of RSSOwl has been released. "RSSOwl is a RSS reader written complete in Java using SWT as fast graphic libary. Some features are saving of RSS favorites in different categories and a TabFolder that shows multiple RSS feeds. The following features were implemented in version 0.3a: Open RSS feed from URL or local file, save RSS feed favorites in categories, Change language english / german, Change fontsize."

Comments (none posted)

Lisp

SBCL 0.8.2 released

Version 0.8.2 of SBCL (Steel Bank Common Lisp) is available. "This is mostly a bug fix release, with changes featuring an improved MACHINE-VERSION, better ANSI compliance, optimizations to character compare routines, and improved disassembler functionality on PPC."

Full Story (comments: none)

Perl

Exegesis 6 (Perl.com)

Perl.com has published Damian Conway's Exegis 6. "This Exegesis explores the new subroutine semantics described in Apocalypse 6. Those new semantics greatly increase the power and flexibility of subroutine definitions, providing required and optional formal parameters, named and positional arguments, a new and extended operator overloading syntax, a far more sophisticated type system, multiple dispatch, compile-time macros, currying, and subroutine wrappers."

Comments (none posted)

gtk2-perl beta 0.91 released (SourceForge)

Version 0.91 beta of gtk2-perl is available. "This project provides perl bindings for gtk+ 2.x and a few related libraries. This release includes several bugfixes, portability issues, and missing functions in the latest betas for Gtk2 and Glib. Some dependency issues for Gnome2 and Glade were also fixed."

Comments (1 posted)

This Week on perl5-porters (use Perl)

The July 21-27, 2003 edition of This Week on perl5-porters has been published. "This week, a lot of porters went to YAPC::Europe in Paris, so the list traffic on the list was less important. It wasn't less interesting."

Comments (none posted)

PHP

kses 0.2.0 released

Version 0.2.0 of kses is available. "kses is an HTML/XHTML filter written in PHP. It removes all unwanted HTML elements and attributes, no matter how malformed HTML input you give it. It also does several checks on attribute values. kses can be used to avoid Cross-Site Scripting (XSS), Buffer Overflows and Denial of Service attacks, among other things."

Full Story (comments: none)

PHP Weekly Summary for July 28, 2003

The PHP Weekly Summary for July 28, 2003 is out. Topics include: PHP 4.3.3 RC 2, PHP 5 TODO list, getenv() with THTTPD SAPI, Disabling @ operator, OCI8, temporary LOB, Apache2Filter, PHP 5 OO issues.

Comments (none posted)

phpMyAdmin 2.5.2 released (SourceForge)

Version 2.5.2 of phpMyAdmin has been released with security fixes. "phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the http://www."

Comments (none posted)

Turck MMCache for PHP version 2.3.20 is released (SourceForge)

SourceForge has an announcement for a new version of Turck MMCache. "Turck MMCache is a PHP Accelerator, Optimizer, Encoder and Dynamic Content Cache. It increases performance of PHP scripts by caching them in compiled state, so that the overhead of compiling is almost completely eliminated. Also it uses some optimizations for speed up of PHP scripts execution. Turck MMCache typically reduces server load and increases the speed of your PHP code by 1-10 times."

Comments (none posted)

Python

Dr. Dobb's Python-URL!

The July 28, 2003 edition of Dr. Dobb's Python-URL! has been published.

Full Story (comments: none)

Tcl/Tk

Dr. Dobb's Tcl-URL!

The July 28, 2003 edition Dr. Dobb's Tcl-URL! is available.

Full Story (comments: none)

XML

Why Choose RSS 1.0? (O'Reilly)

Tony Hammond illustrates the advantages of RSS for serials news feeds. "RSS, a set of lightweight XML syndication technologies primarily used for relaying news headlines, has been adapted to a wide range of uses from sending out web site descriptions to disseminating blogs. This article looks at a new application area for RSS: syndicating tables of contents for serials publications."

Comments (none posted)

Extending RSS (O'Reilly)

Danny Ayers talks about RSS flavors on O'Reilly. "This article shows how the RDF foundation of RSS 1.0 helps when you want to extend RSS 1.0 for uses outside of strict news item syndication, and how existing RDF vocabularies can be incorporated into RSS 1.0. It concludes by providing a way to reuse these developments in RSS 2.0 feeds while keeping the formal definitions made with RDF."

Comments (none posted)

IDEs

DrJava Stable Release (SourceForge)

A new version of DrJava, an open-source Java IDE, is available. "This release includes many large new features, including a more interactive debugger, Javadoc support, and support for reading input from System.in."

Comments (none posted)

Profilers

OProfile 0.6 released

Version 0.6 of OProfile, a system-wide source profiler for Linux, has been released.

Full Story (comments: none)

Miscellaneous

make++ version 1.19 (stable) released (SourceForge)

Sourceforge has an announcement for version 1.19 of make++. "make++ (or makepp) is a powerful but nearly 100% compatible replacement for make that includes many features required for reliable builds of complicated projects, such as automatic include file dependencies, automatic recompilation."

Comments (none posted)

Page editor: Forrest Cook

Linux in the news

Recommended Reading

Reconsidering Linux (News.com)

Ian Murdock says "Linux is not a product. It is a process.", in this article on News.com. "Let's step back a bit and look at why people are flocking to Linux. It's an open platform that is not owned or controlled by any single company. It comes with unmatched customization, optimization and integration possibilities. It is the ideal "invisible engine" for driving the next generation of applications and services. And it gives its users greater control over the evolution of the underlying platform, putting the user firmly in control of product release timelines and rollout schedules. In short, with Linux, the balance of power has finally shifted back from company to user."

Comments (6 posted)

SCO License Fees Would Hurt Linux Market (ZDNet)

Here is the latest Gartner pronouncement on SCO, via ZDNet. "Don't ignore the problem by hoping IBM will win or settle its lawsuit (that could take a year or more). An IBM win would not prevent SCO from pursuing individual claims, which, if successful, could cost far more in penalties than buying a SCO license would." The article as a whole is somewhat FUDdish, but it may well be true that the community is putting too much of its faith in IBM's lawyers.

Comments (25 posted)

Big Blue assuages customers about SCO (News.com)

News.com reports that IBM is sending memos to its customers. "SCO's latest actions broadened its case against Linux beyond the $3 billion lawsuit it has filed against IBM. Likewise, IBM's new message to its sales force--the chief way it communicates with customers--is a significant expansion of its defense over the narrower memos it sent earlier. Those memos said that IBM will stand by its customers and defend itself vigorously."

Comments (33 posted)

SCO's claims have absolutely no credibility (ZDNet)

Here's a ZDNet opinion column about SCO which pulls no punches. There's not much new there for LWN readers, but it's nice to see it all together in that forum. "SCO's System V copyrights do not include rights to any of the code they are discussing: RCU, NUMA, JFS, SMP. RCU is patented by IBM. NUMA is not present in System V, and was independently developed by Sequent, SGI, and IBM (not SCO). SMP in Linux was originally assisted by SCO Caldera, and newer work includes functionality that no SCO product has ever included. IBM authored JFS originally for OS/2, not System V."

Comments (23 posted)

Companies

Novell sets date for move towards Linux (vnunet)

Novell will support Linux with its next release of the NetWare platform. "The firm described the offering as "a key stepping stone as customers prepare for future NetWare versions when all NetWare features will also run on Linux". Novell recently detailed plans for the launch later this year of Novell Nterprise Linux Services, which extends many of the network services in NetWare 6.5 to Linux servers."

Comments (1 posted)

SCO Group Gains Psychological Edge (ZDNet)

Yankee Group analyst Laura DiDio was one of the people who signed the SCO NDA and came away talking about what a great case SCO had. If there was any question of where she is coming from, this Yankee pronouncement (on ZDNet) should make things clear. "SCO has wisely elected to adopt a flexible and reasonable position on the licensing fees it seeks from IBM corporate customers... SCO is well advised to pursue its current course and not seek retroactive fees dating back two years ago when IBM first shipped Linux 2.4."

Comments (8 posted)

Legal commentators weigh SCO's chances (Inquirer)

Here's an article in the Inquirer on SCO's real mistake: upsetting the free software community. "Judging from its statements, SCO did not anticipate that Linux developers and users would oppose its schemes so passionately and publicly. But it should have known that it couldn't attempt to steal the work of thousands of people with impunity. SCO has miscalculated -- attacking Open Source will prove its undoing in the final reckoning."

Comments (12 posted)

Trade Practices Act Is Basis for Australian Complaint Against SCO (Linux Journal)

Con Zymaris explains how the Australian Trade Practices Act is being used against SCO in this Linux Journal article, and encourages similar action worldwide. "You should alert your consumer watchdog that you believe that SCO is entering into conduct both misleading and deceptive to all Linux users in your country. SCO has no verified claims whatsoever on Linux, and the company is using the press to scare Linux users into forking over money for protection."

Comments (3 posted)

SCO execs cash in on suit spotlight (ZDNet)

Bear with us as we put up one more SCO story. ZDNet has finally gotten around to looking at insider trading in SCO stock. "Considering the company has only 13.5 million shares floating around, it is conceivable that the issuance of 45 million shares at a tenth of a cent each may dilute the list price somewhat."

Comments (4 posted)

Sun Sees Road To Prosperity Paved With Its Own Products (TechWeb)

TechWeb looks at Sun's plans. "Although Sun no longer makes its own Linux distribution on the server side, it plans to release by October its open-source Mad Hatter desktop operating system. Sun claims to have 60 PC makers, including Dell and Sony, lined up for Mad Hatter."

Comments (65 posted)

Unilever Joins OSDL

The consumer products company Unilever has joined the Open Source Development Lab (OSDL). ""Unilever is a significant addition to OSDL's membership and is the first of many Global 2000 corporations that we expect will be joining us to contribute in improving Linux," said Stuart Cohen, CEO of OSDL. "We have expanded our charter to increase our participation in the Linux development community and with IT vendors, and with Unilever to begin investing in more programs for corporations to help ensure that Linux meets their requirements and solves their real-world business problems."" Thanks to Craig Oda.

Comments (3 posted)

SuSE, SAP team on customer support (News.com)

News.com reports on a partnership between SuSE and the database company SAP. "The new support deal between the two companies is aimed at streamlining the process for customers who run SAP business software on the SuSE Linux Enterprise Server. SuSE said those customers can now receive centralized support from engineers specifically trained in the combination of SuSE and SAP software. The engineers will provide assistance ranging from help with SAP applications to assistance with issues surrounding the Linux source code."

Comments (1 posted)

Linux Adoption

Web sites unfazed by SCO threats (News.com)

News.com reports that web sites continue to shift toward Linux, despite threats from SCO. "In May, SCO Group sent about 1,500 large companies letters alleging that Linux illegally includes Unix intellectual property SCO owns. SCO went a step further Monday, saying companies could avoid potential legal action by paying a licensing fee. But a survey shows that large companies are increasingly using Linux for their Web sites."

Comments (none posted)

Why governments should be allowed to specify Open Source software (NewsForge)

Robin 'Roblimo' Miller takes a look at some government and military specifications to show that open source specifications are not so outlandish. "If the federal government suddenly decided to acquire and use nothing but Open Source software, this would not stop Microsoft, Adobe, and other big proprietary software vendors from bidding on government contracts. It would simply mean they'd need to open some of their source code if they wanted to do business with the government."

Comments (none posted)

Open Asia: Under the radar, FLOSS thrives (NewsForge)

NewsForge looks at GNU/Linux in Asia. "GNU/Linux is already reporting some interesting deployments in the populous cash-strapped countries of the region. In India, it is no coincidence that a number of low-cost PCs hitting the market are now opting for Free Software-based solutions. China has already worked out national distros of GNU/Linux that are in the local language and also meet national concerns in terms of security. Pakistan has seen government initiatives to boost the role of FLOSS, so as to become less dependent on proprietary software, with it accompanying allegations of piracy against countries with low incomes and poor conversion rates against the dollar. Thailand is finding GNU/Linux a useful solution in its Schoolnet program."

Comments (1 posted)

Interviews

Galeon Developers Interview (Galeon)

Here's an interview with some of the Galeon developers on the Galeon website. This MozillaZine article has a pointer to the article and to discussions on the article. When asked about the health of the project Yanko Kaneti wrote: "Pretty healthy all things considered. Not being "the official GNOME browser". Excluded from Red Hat rawhide. Dissed for all the wrong reasons by uninformed people. - Yet people still seem to be interested and most importantly "external" patches seem to have picked up recently, which is just great. Many thanks."

Comments (none posted)

Interview with Brian Kernighan (Linux Journal)

Linux Journal has an interview with Brian Kernighan, one of the creators of AWK and AMPL. "LJ: You have worked in Bell Labs, alongside Bjarne Stroustrup, Ken Thompson and Dennis Ritchie. What kind of relations do you have with them? Were you like a big, wise family? BK: We were all friends and close colleagues for many years, all in the same small group at Bell Labs. Ken, Dennis and I are all about the same age, and we all came to the Labs about the same time; Bjarne came 10 years later. I wouldn't call it family, but it was definitely good friends, and I miss seeing them all every day, which is the way it was for many years."

Comments (5 posted)

Interview with Bruce Eckel

The Borland developer network features an interview of Bruce Eckel. "OOP guru Bruce Eckel talks about his initial skepticism about C# (but now calls it "a better Java"), wishes Borland would create a Python IDE, explains why he's suspicious of Mono, and asks us to click the wombat."

Comments (1 posted)

Resources

Making Mac and Linux play nicely together (NewsForge)

Joe Barr writes about his experiences networking an eMac to a Linux box. "I recently decided to start making more use of a neglected computer of mine. It's an eMac that has been sitting quietly on my kitchen table the past two years. I decided to explore how best to share files, printers, and applications between a Macintosh and my desktop Linux box."

Comments (none posted)

Building a wireless access point on Linux (IBM developerWorks)

Peter Seebach shows how to set up a Linux-based wireless access point on IBM's developerWorks. "n this article, I'll take you through the process of building a wireless access point running Linux. I won't cover every last line of code, every intermediate step, or every detail of hardware; that would take a book and would be obsolete by the time you read it. The goal is to show you what kinds of concerns and pitfalls you'll face should you want to do this. For this piece, we build the access point to operate as a bridge; simply forwarding packets between the wireless network and a local ethernet. This allows wireless devices to simply be turned on and attached using your existing network -- no new configuration, no special routing."

Comments (none posted)

Reviews

Scribus excels at DTP (NewsForge)

NewsForge reviews Scribus 1.0. "It still has bugs to be found and fixed, features to be added, distribution-specific installation and quirks to be resolved, and documentation to be written. But even with that to-do list, it's starting in much better shape than Seabiscuit did. Scribus is destined to join the GIMP as one of the crown jewels of the free software world."

Comments (none posted)

Zinf: The Linux Answer to iTunes

A review of Zinf, with comparisons to other Linux music players, as been published. "Zinf is a fairly new arrival on the scene of Linux music players. Yet, it already has the grace and feature set of a mature application. This is due to the fact that is a descendent of the defunct freea*p project. Zinf smoothly handles playing sound files, CD tracks and streams from the Internet."

Comments (none posted)

Miscellaneous

WorldWatch Week in Review (Linux Journal)

This week's WorldWatch Week in Review from Linux Journal covers FUD-slinging from SCO, Linux in Afganistan and a guest editorial reprint from LinuxFrench.net on the EU patent vote, and other news from around the world.

Comments (none posted)

Page editor: Forrest Cook

Announcements

Non-Commercial announcements

An Open Source Strategy for the Open Group

The Open Group, owner of the Unix trademark, has been working with Bruce Perens to develop an Open Source strategy for the Group. Now a draft strategy document is out, and the Open Group is soliciting comments. "The Open Group is faced with challenges and opportunities regarding Open Source software. Foremost is the organization's responsibility to guide its members in use of, and participation in, Open Source. Secondarily, as an organization we must catch up: we couldn't have known that Open Source would be this successful, and it brings profound changes to our main areas of practice: Open Systems and Standards. We must now fully integrate Open Source into our operation. If not, it's time to change the name of our organization."

Comments (13 posted)

Road to Lisp Survey

If you are using the Lisp language, you may want to take a few minutes to fill out a few questions on Kenny Tilton's The Road to Lisp Survey.

Full Story (comments: none)

Commercial announcements

IBM sells Opteron cluster in Japan

Here's a press release from IBM announcing yet another Linux cluster sale; this one is going to the Japanese Institute of Advanced Industrial Science and Technology. The announcement is interesting in that the cluster is made up of IBM's eServer 325 systems, which will be announced at LinuxWorld. The 325 is based on AMD's Opteron ("Hammer", "x86-64", "AMD64") processor, and it will be, it is said, the most powerful Linux cluster in the world.

Comments (none posted)

MandrakeSoft shareholder newsletter

MandrakeSoft has posted a shareholder newsletter for the first half of fiscal 2003. The company lost EUR 1.2 million on EUR 2.1 million in revenue over that time. Despite the loss, the company claims to be cash-flow positive since January. MandrakeSoft's bankruptcy period ends on July 27, but the company is looking to extend it for another six months.

Comments (none posted)

Sleepycat Software Bundled with Latest Python and Zope

Sleepycat Software has announced that their Berkeley DB database software now ships with Python 2.3 and a recent version of Zope.

Comments (none posted)

SuSE teams with SAP

SuSE Linux and SAP have announced a a support agreement that is aimed at supporting corporate customers around the world. "Under the agreement, SuSE will collaborate with SAP on support for joint enterprise customers -- providing optimum support for mission-critical SAP(R) business solutions on SuSE Enterprise Server, powered by United Linux."

Comments (none posted)

ZopeMag available at a discount (ZopeMembers)

Subscriptions to the print magazine ZopeMag are available at a discount for several weeks.

Comments (none posted)

New Books

"Building Wireless Community Networks, Second Edition" Released by O'Reilly

O'Reilly has released the second edition of "Building Wireless Community Networks".

Full Story (comments: none)

"Secure Programming Cookbook for C and C++" Released by O'Reilly

O'Reilly has published the "Secure Programming Cookbook for C and C++".

Full Story (comments: none)

PNG book FDL'd, online

O'Reilly has published an online version of "PNG: The Definitive Guide", by Greg Roelofs.

Full Story (comments: none)

Resources

GNOME Installation Guide Updated (GnomeDesktop)

GnomeDesktop.org mentions the availability of an updated GNOME Installation Guide. This version includes information on GNOME 2.2.2.

Comments (none posted)

LDP Weekly News

The July 29, 2003 edition of the LDP Weekly News is out with the latest Linux documentation updates.

Full Story (comments: none)

Contests and Awards

LinuxWorld Names Finalists for Product Excellence Awards

IDG World Expo has announced the finalists for the LinuxWorld Product Excellence Awards, to be presented at LinuxWorld Conference & Expo next week.

Comments (none posted)

Nominations are now open for the Open Source Awards

Nominations are open for the first Open Source Awards, to be presented at OSCON 2004.

Full Story (comments: none)

Event Reports

GUADEC Desktop BOF Slides and post-paper posted (GnomeDesktop)

A set of slides and a post-BOF conclusion paper have been posted for the GUADEC BOF session, "KDE, Mac Os X, Windows: What can we learn (copy or improve) from them?".

Comments (none posted)

Upcoming Events

Bruce Perens Press Event at LinuxWorld

Open-source evangelist Bruce Perens will give a speech entitled the "Open Source State of the Union" on August 6, 2003 during the LinuxWorld Conference.

Full Story (comments: none)

Silicon Valley Linux Picn*x12

Several Bay Area Linux groups will be holding an event known as Picn*x12 on August 9 in Sunnyvale, CA, following the LinuxWorld Expo conference. The theme is the celebration of the birthday of the Linux operating system. "The picnic event is completely free, and free food will be served. It's a family-oriented gathering, so bringing the spouse and kids is encouraged! You must RSVP in advance, however."

Full Story (comments: none)

YAPC::EU::2004 Venue Chosen (use Perl)

According to Use Perl, the YAPC::Europe 2004 conference will be held in Belfast, Northern Ireland.

Comments (none posted)

YAPC::Israel::2004 - first call for papers (use Perl)

Use Perl has an announcement for the YAPC::Israel::2004 conference, to be held in February. "After the successful year of 4 YAPCs we would like to announce the first call for participation, papers and sponsorship of YAPC::Israel::2004".

Comments (none posted)

GUADEC 5 - Host Wanted! (GnomeDesktop)

The GNOME Foundation is looking for a host city for the GUADEC 2004 conference.

Comments (none posted)

Events: July 31 - September 25, 2003

Date	Event	Location
July 31 - August 3, 2003	UKUUG Linux Developers' Conference(LINUX 2003)	(George Watson's College)Edinburgh Scotland
July 31 - August 2, 2003	The 10th Annual Tcl/Tk Conference	Ann Arbor, Michigan
August 4 - 7, 2003	LinuxWorld Conference and Expo 2003	(Moscone Convention Center)San Francisco, CA
August 5 - 7, 2003	5th Annual CERT Conference(NEbraskaCERT)	(Scott Conference Center)Omaha, NE USA
August 7 - 10, 2003	Chaos Communication Camp 2003	Paulshof, Altlandsberg, Germany
August 18 - 21, 2003	New Security Paradigms Workshop 2003(NSPW 2003)	(Centro Stefano Francini)Ascona, Switzerland
August 22 - 30, 2003	KDE Developers' Conference	(Zamek Castle)Nove Hrady, Czech Republic
August 27 - 29, 2003	International Conference on Principles and Practice of Declarative Programming(PPDP 2003)	(Uppsala University)Uppsala, Sweden
September 3 - 4, 2003	LinuxWorld Conference & Expo (Cancelled)	(The NEC)Birmingham, UK
September 8, 2003	Boundaryless Information Flow: Open Source in the Enterprise	(Hilton London Paddington)London, UK
September 11 - 12, 2003	Python for Scientific Computing Workshop(SciPy'03)	(CalTech)Pasadena, CA
September 15 - 18, 2003	LogOn Web Days	Across Europe
September 15 - 18, 2003	Embedded Systems Conference(ESC)	(Hynes Convention Center)Boston, Mass

Comments (none posted)

Web sites

Project Aims to Combine Mozilla and Java (MozillaZine)

MozillaZine examines the new java.mozdev.org site. "Brad GNUberg writes: "The goal is simple. Build a Mozilla application so that a Java backend can be used to interact with a Mozilla/XUL front-end. It makes sense. Combine the power of Java's server libraries with the interactivity and user interface capability of Mozilla. Kevin Burton and Brad GNUberg are proud to announce java.mozdev.org, a central repository for open-source projects making this vision true."

Comments (none posted)

French Geckozone Site Launches (MozillaZine)

MozillaZine mentions the launch of a new French language Mozilla site, Geckozone. "Initiated by several members of the Frenchmozilla localization team, this new site is targeted to French-speaking people seeking information, help and tutorials on Mozilla-based products."

Comments (none posted)

Software announcements

This week's software announcements

Here are the software announcements, courtesy of Freshmeat.net. They are available in two formats:

• Sorted alphabetically,
• Sorted by license.

Comments (none posted)

Miscellaneous

zWebit interface engine released as GNU/GPL (LinuxMedNews)

According to LinuxMedNews, HSC has released their zWebit interface engine under the GPL. "zWebit has proven stable and reliable in a 250 bed hospital supporting twelve interface connections."

Comments (none posted)

Page editor: Forrest Cook