LWN.net Logo

LWN.net Weekly Edition for September 4, 2003

A quick look at Conglomerate 0.70

The DocBook format is often promoted as the format of choice for free (and non-free) documentation. DocBook, as an SGML and XML standard, is compliant with as many buzzwords as anybody could wish for. The standard is well developed and highly expressive. And DocBook, of course, is all about structure. More, perhaps, than any other markup language, DocBook forces the author to concentrate on the structure of the language without thinking about how a document will be rendered in any particular medium.

Anybody who has had to create a serious work in full frontal DocBook knows the rest of the story, however. DocBook is complex and verbose. Like PostScript, DocBook requires that the author maintain a deep stack in mind to track the current state of the document. And, like PostScript, DocBook is best used as the output of a higher-level tool, rather than created directly by the author.

Unfortunately, given the current state of the tools available, manipulating DocBook directly with a text editor is often the only option available. So your editor, who is currently in the process of updating a substantial book which is, of course, in DocBook format, was more than usually interested in the recent announcement that Conglomerate 0.70 had been released. As stated in the announcement:

Congomerate is a free, user-friendly XML editor. It is particularly aimed at DocBook editing, but should be able to handle arbitrary XML document types.

For authors working in DocBook, a nice editor would be worth a great deal. So Conglomerate seemed worth checking out.

The first challenge with bleeding-edge software, of course, is getting it installed and running. For Conglomerate, an attempted install on Debian sid proved doomed to failure; the maze of dependencies proved too twisted, and the packaged version in experimental had not been updated. On the other hand, version 0.70 configured, built, and installed on a Red Hat Linux 9 system without trouble. There are advantages to having a variety of distributions sitting around.

What resulted was a tool that shows some serious promise, but which is not yet ready for production use. The sample text used (Chapter Two of Linux Device Drivers, Third Edition) required significant editing (with a text editor) before Conglomerate would accept it. Conglomerate does not recognize common entities (e.g. &ndash;), and there are differences of opinion on how certain types of tag (such as <indexterm>) should be terminated in some situations. The tool spews out an unending series of Gtk warnings, crashes occasionally, [Screenshot] and is generally slow. It is missing fundamental features, such as an "undo" operation. It does, however, work well enough to give a good idea of where the developers are going.

True to the basic premise of DocBook, Conglomerate is all about structure. Looking at a document in DocBook will not tell you much about how it will appear in printed (or web) form, but it is full of information on how the document goes together. To that end, the window (see the screen shot on the right) is divided into two panes. The left side shows the overall structure of the document, in the usual tree presentation. The main window, on the right, shows the text. But this is no WYSIWYG presentation; instead, the document is presented as a set of nested boxes showing, once again, how things are structured. Subtrees of the document can be expanded or hidden at will, providing a sort of zoom feature.

[menu entry] At the structural element level, the right mouse button yields an impressive array of new elements (86 of them) which can be added as subelement or sibling elements. Once you get below the paragraph level, however, a whole new menu with various types of low-level markup (e.g. <emphasis>) appears instead. Conglomerate does not, of course, change the presentation of the text to reflect this sort of [literal] markup. So, for example, rather than italicizing text marked <literal>, it simply indicates that the tag is present. The tool displays internal comments in a highlighted form, but does not appear to provide a way to add or edit comments.

There is no shortage of features that this tool still needs: undo, an easy way to join paragraphs, the ability to read and fix not-quite-perfect files, entity definitions, and some sort of way to quickly see what formatted output would look like. The performance and stability issues need some work. But none of this should detract from the fact that the Conglomerate developers have made substantial progress toward the creation of a desperately needed tool. Conglomerate is headed in the right direction; we're looking forward to the next release.

Comments (31 posted)

European software patent vote delayed

Last week we reported on the impending software patent vote in the European Parliament. That vote, set for September 1, did not happen as scheduled. Thanks, at least in part, to protests in various forms, the vote has been pushed back to the September 22 Strasbourg session.

What remains unclear is what will be voted on at that time. By some reports, the entire software patent proposal has been pushed back for a rewrite before the vote. By others, it is a simple delay, and the same proposal will be voted upon in Strasbourg. Real information, however, seems hard to come by.

Either way, now is not the time to let up the pressure on software patents. The next few weeks should be used, by Europeans, to make sure their MEPs understand how they feel about software patents and the threats patents pose to European businesses. The "software patent factsheet" being distributed by MEP Arlene McCarthy should be challenged. It is also necessary to provide a counter to the pro-patent forces, which are evidently pressing for a removal of the interoperability exemption in the proposed law. This battle, perhaps, can be won - but it is not over yet.

Comments (7 posted)

Software Customer Bill of Rights

[This article was contributed by Joe 'Zonker' Brockmeier]

In the last week or so, Cem Kaner's Software Customer Bill of Rights has been making the rounds of the "blogosphere" and getting quite a bit of attention. Essentially, Kaner proposes ten basic rights that should be enjoyed by any user of commericial software. As End User License Agreements (EULAs) have become increasingly onerous over the last few years, Kaner's bill of rights has struck a chord with users.

For the most part, the rights proposed by Kaner are already enjoyed by users of open source software. They already have the right to transfer free software to other users. They don't need to reverse engineer the software to check for security holes or to fix bugs and security glitches -- they already have the source code. (Nothing in any open source license would prevent a user from choosing to do it the hard way, however.) Kaner proposes that users should have the "right to see and approve all transfers of information from her computer." While "spyware" is a constant danger posed by proprietary software, with access to source code, users can make sure that a program isn't secretly sending data off of their computer to another machine.

However, there are a few rights that would benefit users of open source software. Firstly, the unfettered right to reverse-engineer proprietary software would be a major boon to the open source software community. As Kaner points out, courts have been willing to enforce clauses against reverse-engineering in software licenses. This poses a problem for open source developers looking to achieve interoperability with commercial software, operate embedded devices with open source software or simply a way to access data saved in a proprietary format.

Another right that Kaner proposes is "mass-market software should be transferrable." As mentioned previously, users already enjoy the right to transfer software that is licensed under a FOSS license. However, most users of open source software still end up dealing with proprietary software. How many open source users have purchased a laptop or desktop computer with software preinstalled that will never be use by the purchaser? The cost of a Windows XP license is built into the price of a brand-new machine. The user should have the right to transfer that software to another user who will make use of the software, if we so choose.

The first item on Kaner's list, however, is "let the customer see the contract before the sale." This is particularly timely in light of Dell's hidden license policy. Even some of the Linux vendors have started using the "clickthrough" mechanism, with some of the Linux installers requiring the user to agree to the terms of the open source licenses, without allowing the user to read them first. This is probably done because of the number of licenses involved -- most distributions include software under the GNU General Public License (GPL), Lesser GPL, Artistic License, Apache License, Mozilla License, BSD License and so on.

One potentially dangerous clause in Kaner's bill of rights is number ten, "When software is embedded in a product, the law governing the product should govern the software." Generally, this would be a good thing. A hardware manufacturer should not be able to use licensing terms to forbid the transfer of a router or network appliance by forbidding the transfer of embedded software. Car manufacturers shouldn't be able to exclude embedded software from warranties.

However, one wonders if this might make open source developers liable in some way if their software is "embedded" in a product. Most, if not all, FOSS licenses disclaim any warranty because the software is being given away. What happens, however, if a court decides that embedded software qualifies as "goods" and that developers can be held liable for defects -- even if they have not charged for the software in the first place? This may seem like a stretch, but we do live in a very litigious society.

Kaner's proposed rights would be a dramatic improvement for users of proprietary software, but they leave out many rights that FOSS users take for granted. For example, users of FOSS software expect to have access to source code. They also expect to be able to modify the software, to add or remove features that they deem necessary or desirable, and to be able to distribute the changes.

Despite the fact that the Software Customer Bill of Rights doesn't quite match the average FOSS license in terms of customer rights, it would be good to see it become reality. It's time to start reversing the current legislative trends that have given far too much power, and too little accountability, to vendors of proprietary software.

Comments (5 posted)

Page editor: Jonathan Corbet

Security

Brief items

Advisories and relative security

A recent CNN article asks why the Linux community hasn't used the Blaster and SoBig worms for marketing purposes. The author concludes:

Etiquette and naiveté aside, however, perhaps the biggest reason Linux companies haven't touted their products' security advantages is that it's unclear right now how much of an advantage they really possess. Consider this: The Computer Emergency Response Team (CERT) released data showing that 16 of the 29 security advisories it released last year involved Linux or open-source products.

This seems like a good time to go and look at what these advisories really covered. CERT's 2002 advisories were:

Linux-relatedMicrosoftSomething else
2002-03 (SNMP)
2002-05 (PHP)
2002-06 (Radius)
2002-07 (zlib)
2002-12 (dhcpd)
2002-15 (BIND9)
2002-17 (Apache)
2002-18 (OpenSSH)
2002-19 (libresolv)
2002-21 (PHP)
2002-23 (OpenSSL)
2002-24 (OpenSSH trojan)
2002-25 (XDR)
2002-27 (mod_ssl worm)
2002-28 (sendmail trojan)
2002-29 (kerbd)
2002-30 (tcpdump trojan)
2002-31 (BIND8)
2002-02 (AOL ICQ)
2002-04 (IE)
2002-09 (IIS)
2002-13 (MSN Chat)
2002-22 (SQL Server)
2002-33 (MDAC)
2002-37 (Windows shell)
2002-01 (CDE)
2002-03 (SNMP)
2002-08 (Oracle)
2002-10 (rpc.walld)
2002-11 (cachefs)
2002-14 (JRun)
2002-16 (Yahoo Messenger)
2002-20 (CDE)
2002-26 (CDE)
2002-32 (OmniSwitch)
2002-34 (Solaris XFS)
2002-35 (RaQ Servers)
2002-36 (proprietary SSH)

Interestingly, we count 37 advisories for last year, not 29. There is no contesting the fact that the Linux-related column is significantly longer than the others. One could quibble a bit: the mod_ssl worm advisory covers the same vulnerability as the OpenSSL advisory, and the three trojan advisories are individual site compromises rather than widespread vulnerabilities. But that sort of quibbling wouldn't really change the situation.

On the other hand, it is a legimate question to ask why the mod_ssl worm (which affected very few systems) merits a CERT advisory, when worms like Klez, Bugbear, Badtrans, Nimda, and Sircam do not. The costs imposed by any one of those worms is likely to exceed that of all the Linux vulnerabilities put together.

The real point is that anybody who tries to make a security point by counting advisories is building a weak argument. A more honest look at the situation would ask how many vulnerabilities have been actively exploited, and how quickly they have been fixed.

That said, we couldn't resist putting together a 2003 table while we were at it:

Linux-relatedMicrosoftSomething else
2003-01 (dhcpd)
2003-02 (cvs)
2003-07 (sendmail)
2003-10 (XDR)
2003-12 (sendmail)
2003-13 (snort)
2003-21 (GNU FTP crack)
2003-03 (Locator)
2003-04 (SQL server worm)
2003-08 (Windows shares)
2003-09 (ntdll)
2003-14 (html32)
2003-16 (RPC)
2003-18 (DirextX)
2003-19 (RPC exploits)
2003-20 (Blaster)
2003-22 (IE)
2003-05 (Oracle)
2003-06 (SIP)
2003-11 (Lotus)
2003-15 (IOS)
2003-17 (IOS)

This table suggests that the record for Linux-related software is nothing to be all that proud of, but certain other operating systems are currently in the lead in the "advisory count" race. On the other hand, in the fast-changing free software world, it is somehow comforting to see that sendmail continues to give advisory writers something to do - as long as you're running a different MTA...

Comments (15 posted)

New vulnerabilities

gkrellm: buffer overflow

Package(s):gkrellm CVE #(s):
Created:August 29, 2003 Updated:September 3, 2003
Description: A buffer overflow was discovered in gkrellmd, the server component of the gkrellm monitor package, in versions of gkrellm 2.1.x prior to 2.1.14. This buffer overflow occurs while reading data from connected gkrellm clients and can lead to possible arbitrary code execution as the user running the gkrellmd server.
Alerts:
Mandrake MDKSA-2003:087 2003-08-28

Comments (none posted)

horde: session hijacking

Package(s):horde CVE #(s):
Created:September 1, 2003 Updated:September 3, 2003
Description: According to this advisory an attacker could send an email to a victim who used HORDE MTA, to get the victim to visit a website, which then logs all available information about the victim's system.
Alerts:
Gentoo 200309-02.1 2003-09-01
Gentoo 200309-02 2003-09-01

Comments (none posted)

mindi: insecure file creations

Package(s):mindi CVE #(s):CAN-2003-0617
Created:September 2, 2003 Updated:October 1, 2003
Description: Mindi versions prior to 0.86 creates files in /tmp which could allow local user to overwrite arbitrary files.

CAN-2003-0617

Alerts:
Gentoo 200309-05 2003-09-02
Debian DSA-362-1 2003-08-02

Comments (none posted)

node: buffer overflow, format string

Package(s):node CVE #(s):
Created:September 1, 2003 Updated:September 3, 2003
Description: Morgan alias SM6TKY discovered and fixed several security related problems in LinuxNode, an Amateur Packet Radio Node program. The buffer overflow he discovered can be used to gain unauthorised root access and can be remotely triggered.
Alerts:
Debian DSA-375-3 2003-08-29

Comments (none posted)

pam_ldap: non-functioning host restrictions

Package(s):pam_ldap CVE #(s):
Created:September 3, 2003 Updated:September 3, 2003
Description: pam_ldap 161 contains a bug in the pam_filter module which prevents host-based restrictions from working as advertised; version 1.62 fixes the problem.
Alerts:
Mandrake MDKSA-2003:088 2003-09-02

Comments (none posted)

phpwebsite: SQL Injection, DoS and XSS Vulnerabilities

Package(s):phpwebsite CVE #(s):
Created:September 2, 2003 Updated:September 3, 2003
Description: phpwebsite contains an sql injection vulnerability in the calendar module which allows the attacker to execute sql queries. In addition phpwebsite is also vulnerable to XSS. More information can be found in the full advisory.
Alerts:
Gentoo 200309-03 2003-09-02

Comments (none posted)

Updated vulnerabilities

2.4 kernel - several vulnerabilities

Package(s):2.4 kernel CVE #(s):CAN-2003-0461 CAN-2003-0462 CAN-2003-0464 CAN-2003-0476 CAN-2003-0501 CAN-2003-0550 CAN-2003-0551 CAN-2003-0552
Created:July 21, 2003 Updated:December 24, 2003
Description: Several security issues have been discovered affecting the Linux kernel:
  • CAN-2003-0461: /proc/tty/driver/serial reveals the exact character counts for serial links. This could be used by a local attacker to infer password lengths and inter-keystroke timings during password entry.

  • CAN-2003-0462: Paul Starzetz discovered a file read race condition existing in the execve() system call, which could cause a local crash.

  • CAN-2003-0464: A recent change in the RPC code set the reuse flag on newly-created sockets. Olaf Kirch noticed that his could allow normal users to bind to UDP ports used for services such as nfsd.

  • CAN-2003-0476: The execve system call in Linux 2.4.x records the file descriptor of the executable process in the file table of the calling process, allowing local users to gain read access to restricted file descriptors.

  • CAN-2003-0501: The /proc filesystem in Linux allows local users to obtain sensitive information by opening various entries in /proc/self before executing a setuid program. This causes the program to fail to change the ownership and permissions of already opened entries.

  • CAN-2003-0550: The STP protocol is known to have no security, which could allow attackers to alter the bridge topology. STP is now turned off by default.

  • CAN-2003-0551: STP input processing was lax in its length checking, which could lead to a denial of service.

  • CAN-2003-0552: Jerry Kreuscher discovered that the Forwarding table could be spoofed by sending forged packets with bogus source addresses the same as the local host.
Alerts:
Red Hat RHSA-2003:408-00 2003-12-19
Gentoo 200308-01 2003-08-14
Debian DSA-358-4 2003-08-13
SuSE SuSE-SA:2003:034 2003-08-12
Debian DSA-358-2 2003-08-05
Debian DSA-358-3 2003-08-04
Debian DSA-358-1 2003-07-31
EnGarde ESA-20032407-018 2003-07-24
Red Hat RHSA-2003:238-01 2003-07-21

Comments (none posted)

apache: multiple vulnerabilities in Apache HTTP server

Package(s):apache CVE #(s):CAN-2003-0192 CAN-2003-0253 CAN-2003-0254
Created:July 11, 2003 Updated:September 22, 2003
Description: The Apache Software Foundation and the Apache HTTP Server Project have announced the release of the Apache HTTP Server 2.0.47. This release fixes four security vulnerabilities:
  • Certain sequences of per-directory renegotiations and the SSLCipherSuite directive being used to upgrade from a weak ciphersuite to a strong one could result in the weak ciphersuite being used in place of the strong one. [CAN-2003-0192]

  • Certain errors returned by accept() on rarely accessed ports could cause temporal denial of service, due to a bug in the prefork MPM. [CAN-2003-0253]

  • Denial of service was caused when target host is IPv6 but ftp proxy server can't create IPv6 socket. [CAN-2003-0254]

  • The server would crash when going into an infinite loop due to too many subsequent internal redirects and nested subrequests. [VU#379828]
Alerts:
Red Hat RHSA-2003:243-01 2003-09-22
Red Hat RHSA-2003:240-01 2003-09-04
Mandrake MDKSA-2003:075-1 2003-08-28
Mandrake MDKSA-2003:075 2003-07-21
Conectiva CLA-2003:698 2003-07-21
Trustix 2003-0025 2003-07-11

Comments (none posted)

atari800: buffer overflows

Package(s):atari800 CVE #(s):CAN-2003-0630
Created:August 1, 2003 Updated:September 2, 2003
Description: Steve Kemp discovered multiple buffer overflows in atari800, an Atari emulator. In order to directly access graphics hardware, one of the affected programs is setuid root. A local attacker could exploit this vulnerability to gain root privileges.
Alerts:
Gentoo 200309-07 2003-09-02
Debian DSA-359-1 2003-07-31

Comments (none posted)

autorespond: buffer overflow

Package(s):autorespond CVE #(s):CAN-2003-0654
Created:August 18, 2003 Updated:October 1, 2003
Description: Christian Jaeger discovered a buffer overflow in autorespond, an email autoresponder used with qmail. This vulnerability could potentially be exploited by a remote attacker to gain the privileges of a user who has configured qmail to forward messages to autorespond. This vulnerability is currently not believed to be exploitable due to incidental limits on the length of the problematic input, but there may be situations in which these limits do not apply.

CAN-2003-0654

Alerts:
Debian DSA-373-1 2003-08-16

Comments (none posted)

bind buffer overflow vulnerability in DNS resolver libraries

Package(s):bind glibc CVE #(s):CAN-2002-0651 CAN-2002-0684
Created:July 8, 2002 Updated:October 1, 2003
Description: The BIND 4.9.8-OW2 patch and BIND 4.9.9 release (and thus 4.9.9-OW1) include fixes for a libc related vulnerability which does not affect Linux. Updates from the Internet Software Consortium (ISC) are available from here.

No release or branch of Openwall GNU/*/Linux (Owl) is known to be affected, due to Olaf Kirch's fixes for this problem getting into the GNU C library more than two years ago.

Unfortunatly that does not mean that Linux systems are not vulnerable. Similar code, without Olaf Firch's fixes, is in the glibc getnetbyXXX functions. These functions are described in the SuSE alert as " used by very few applications only, such as ifconfig and ifuser, which makes exploits less likely."

CERT Advisory: CA-2002-19 Buffer Overflow in Multiple DNS Resolver Libraries

CAN-2002-0651
CAN-2002-0684

Alerts:
Mandrake MDKSA-2002:050 2002-08-13
Yellow Dog YDU-20020810-3 2002-08-10
Eridani ERISA-2002:035 2002-08-09
Red Hat RHSA-2002:133-13 2002-08-08
SCO Group CSSA-2002-034.0 2002-08-05
Yellow Dog YDU-20020801-2 2002-08-01
Eridani ERISA-2002:028 2002-07-25
Red Hat RHSA-2002:139-10 2002-07-22
EnGarde ESA-20020724-018 2002-07-24
Mandrake MDKSA-2002:043 2002-07-16
Trustix 2002-0061 2002-07-15
Gentoo glibc-20020713 2002-07-13
Conectiva CLA-2002:507 2002-07-11
SuSE SuSE-SA:2002:026 2002-07-09
OpenPKG OpenPKG-SA-2002.006 2002-07-04

Comments (1 posted)

Canna server: exploitable buffer overrun

Package(s):canna CVE #(s):CAN-2002-1158 CAN-2002-1159
Created:December 10, 2002 Updated:October 1, 2003
Description: Canna is a kana-kanji conversion server which is necessary for Japanese language character input.

A buffer overflow bug in the Canna server up to and including version 3.5b2 allows a local user to gain the privileges of the user 'bin' which could lead to further exploits. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-1158 to this issue.

A lack of validation of requests has been found that affects Canna version 3.6 and earlier. A malicious remote user could exploit this vulnerability to leak information, or cause a denial of service attack. (CAN-2002-1159)

See also http://canna.sourceforge.jp/sec/Canna-2002-01.txt

CAN-2002-1158
CAN-2002-1159

Alerts:
SCO Group CSSA-2003-005.0 2003-01-21
Debian DSA-224-1 2002-01-08
Gentoo 200212-8 2002-12-20
Red Hat RHSA-2002:246-18 2002-12-04

Comments (none posted)

eroaster: insecure temporary file

Package(s):eroaster CVE #(s):CAN-2003-0656
Created:August 19, 2003 Updated:October 1, 2003
Description: A vulnerability was discovered in eroaster where it does not take any security precautions when creating a temporary file for the lockfile. This vulnerability could be exploited to overwrite arbitrary files with the privileges of the user running eroaster.

CAN-2003-0656

Alerts:
Gentoo 200309-04 2003-09-02
Mandrake MDKSA-2003:083 2003-08-19
Debian DSA-366-1 2003-08-05

Comments (none posted)

ethereal: security problems in Ethereal 0.9.12

Package(s):ethereal CVE #(s):CAN-2003-0428 CAN-2003-0429 CAN-2003-0431 CAN-2003-0432
Created:June 23, 2003 Updated:November 10, 2003
Description: Several security problems have been found in Ethereal 0.9.12. "It may be possible to make Ethereal crash or run arbitrary code by injecting a purposefully malformed packet onto the wire, or by convincing someone to read a malformed packet trace file."
Alerts:
SCO Group CSSA-2003-030.0 2003-11-07
Yellow Dog YDU-20030718-2 2003-07-18
Red Hat RHSA-2003:203-01 2003-07-03
Gentoo 200306-13 2003-06-25
Conectiva CLA-2003:662 2003-06-25
Mandrake MDKSA-2003:070 2003-06-23

Comments (none posted)

Filename disclosure vulnerability in fam

Package(s):fam CVE #(s):CAN-2002-0875
Created:August 19, 2002 Updated:January 5, 2005
Description: "fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible.
Alerts:
Red Hat RHSA-2005:005-01 2005-01-05
Debian DSA-154-1 2002-08-15

Comments (none posted)

fdclone: insecure temporary directory

Package(s):fdclone CVE #(s):CAN-2003-0596
Created:July 23, 2003 Updated:October 1, 2003
Description: fdclone creates a temporary directory in /tmp as a workspace. However, if this directory already exists, the existing directory is used instead, regardless of its ownership or permissions. This would allow an attacker to gain access to fdclone's temporary files and their contents, or replace them with other files under the attacker's control.

CAN-2003-0596

Alerts:
Debian DSA-352-1 2003-07-22

Comments (none posted)

fetchmail: buffer overflow

Package(s):fetchmail CVE #(s):CAN-2002-1365
Created:December 17, 2002 Updated:October 20, 2003
Description: Versions of fetchmail prior to 6.2.0 have (yet another) buffer overflow vulnerability which can be exploited remotely via a suitably crafted message. See this advisory for details.
Alerts:
Immunix IMNX-2003-7+-023-01 2003-10-17
Mandrake MDKSA-2003:011 2003-01-27
EnGarde ESA-20030127-002 2003-01-27
SCO Group CSSA-2003-001.0 2003-01-09
SuSE SuSE-SA:2003:001 2003-01-02
Debian DSA-216-1 2002-12-24
Red Hat RHSA-2002:293-09 2002-12-17
Conectiva CLA-2002:554 2002-12-16

Comments (3 posted)

gallery: cross-site scripting

Package(s):gallery CVE #(s):CAN-2003-0614
Created:July 31, 2003 Updated:September 2, 2003
Description: Larry Nguyen discovered a cross site scripting vulnerability in gallery, a web-based photo album written in php. This security flaw can allow a malicious user to craft a URL that executes Javascript code on your website.
Alerts:
Gentoo 200309-06 2003-09-02
Debian DSA-355-1 2003-07-30

Comments (none posted)

GDM allows local user to read any file

Package(s):GDM, XDMCP CVE #(s):CAN-2003-0547 CAN-2003-0548 CAN-2003-0549
Created:August 21, 2003 Updated:August 29, 2003
Description: GDM is the GNOME Display Manager for X.

Versions of GDM prior to 2.4.1.6 contain a bug where GDM will run as root when examining the ~/.xsession-errors file when using the "examine session errors" feature, allowing local users the ability to read any text file on the system by creating a symlink. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0547 to this issue.

Additional problems may be found in the X Display Manager Control Protocol (XDMCP) which allow a denial of service attack (DoS) by crashing the gdm daemon. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CAN-2003-0548 and CAN-2003-0549 to these issues.

Alerts:
Conectiva CLA-2003:729 2003-08-29
Slackware SSA:2003-236-01 2003-08-24
Mandrake MDKSA-2003:085 2003-08-21
Red Hat RHSA-2003:258-01 2003-08-21

Comments (none posted)

glibc: DNS stub resolvers contain buffer overflow vulnerability

Package(s):glibc CVE #(s):CAN-2002-1146
Created:November 7, 2002 Updated:February 5, 2004
Description: DNS stub resolvers from multiple vendors contain a buffer overflow vulnerability. The impact of this vulnerability appears to be limited to denial of service. (See CERT Vulnerability Note VU#738331)

The BIND 4 and BIND 8.2.x stub resolver libraries, and other libraries such as glibc 2.2.5 and earlier, libc, and libresolv, uses the maximum buffer size instead of the actual size when processing a DNS response, which causes the stub resolvers to read past the actual boundary ("read buffer overflow"), allowing remote attackers to cause a denial of service (crash).

Alerts:
Mandrake MDKSA-2004:009 2004-02-04
Red Hat RHSA-2002:197-09 2002-11-06
Red Hat RHSA-2002:197-06 2002-10-03

Comments (none posted)

gnupg: key validation

Package(s):gnupg CVE #(s):CAN-2003-0255
Created:May 16, 2003 Updated:November 18, 2003
Description: A key validation bug was discovered in the GNU Privacy Guard (GPG) which would cause keys with more then one user ID to trust all user ID's with the amount of trust given to the most-valid user ID.
Alerts:
SCO Group CSSA-2003-034.0 2003-11-17
Conectiva CLA-2003:694 2003-07-11
Yellow Dog YDU-20030602-4 2003-06-02
Mandrake MDKSA-2003:061 2003-05-22
Slackware ssa:2003-141-04 2003-05-22
Red Hat RHSA-2003:175-01 2003-05-20
Gentoo 200305-04 2003-05-16
OpenPKG OpenPKG-SA-2003.029 2003-05-16
EnGarde ESA-20030515-016 2003-05-15

Comments (none posted)

gtkhtml: malformed messages cause crash

Package(s):gtkhtml CVE #(s):CAN-2003-0133 CAN-2003-0541
Created:April 14, 2003 Updated:April 18, 2005
Description: GtkHTML is the HTML rendering widget used by the Evolution mail reader.

GtkHTML supplied with versions of Evolution prior to 1.2.4 contain a bug when handling HTML messages. Alan Cox discovered that certain malformed messages could cause the Evolution mail component to crash.

Alerts:
Debian DSA-710-1 2005-04-18
Mandrake MDKSA-2003:093 2003-09-18
Conectiva CLA-2003:737 2003-09-12
Red Hat RHSA-2003:264-01 2003-09-09
Mandrake MDKSA-2003:046 2003-04-15
Red Hat RHSA-2003:126-01 2003-04-14

Comments (none posted)

kernel-utils: setuid vulnerability

Package(s):kernel-utils CVE #(s):CAN-2003-0019
Created:February 7, 2003 Updated:January 21, 2005
Description: The kernel-utils package contains several utilities that can be used to control the kernel or machine hardware. In Red Hat Linux 8.0 this package contains user mode linux (UML) utilities.

The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was incorrectly shipped setuid root. This could allow local users to control certain network interfaces, add and remove arp entries and routes, and put interfaces in and out of promiscuous mode.

All users of the kernel-utils package should update to these packages that contain a version of uml_net that is not setuid root.

Alternatively, as a work-around to this vulnerability issue the following command as root:

chmod -s /usr/bin/uml_net

Alerts:
Red Hat RHSA-2003:056-08 2003-02-07

Comments (none posted)

libpam-smb: exploitable buffer overflow

Package(s):libpam-smb, pam-smb CVE #(s):CAN-2003-0686
Created:August 26, 2003 Updated:October 1, 2003
Description: libpam-smb is a PAM authentication module which makes it possible to authenticate users against a password database managed by Samba or a Microsoft Windows server. If a long password is supplied, this can cause a buffer overflow which could be exploited to execute arbitrary code with the privileges of the process which invokes PAM services. See this advisory for more information.

CAN-2003-0686

Alerts:
Conectiva CLA-2003:734 2003-09-05
SuSE SuSE-SA:2003:036 2003-09-03
Gentoo 200309-01 2003-09-01
Red Hat RHSA-2003:261-01 2003-08-26
Debian DSA-374-1 2003-08-26

Comments (1 posted)

libpng, libpng3: buffer overflow

Package(s):libpng, libpng3 CVE #(s):CAN-2002-1363
Created:December 19, 2002 Updated:July 14, 2004
Description: Glenn Randers-Pehrson discovered a problem in connection with 16-bit samples from libpng, an interface for reading and writing PNG (Portable Network Graphics) format files. The starting offsets for the loops are calculated incorrectly which causes a buffer overrun beyond the beginning of the row buffer.
Alerts:
Gentoo 200407-06 2004-07-08
OpenPKG OpenPKG-SA-2004.030 2004-07-06
Mandrake MDKSA-2004:063 2004-06-29
Whitebox WBSA-2004:249-01 2004-06-21
Fedora FEDORA-2004-176 2004-06-18
Fedora FEDORA-2004-174 2004-06-18
Fedora FEDORA-2004-175 2004-06-18
Fedora FEDORA-2004-173 2004-06-18
Red Hat RHSA-2004:249-01 2004-06-18
Conectiva CLA-2003:564 2003-01-23
Mandrake MDKSA-2003:008 2003-01-20
OpenPKG OpenPKG-SA-2003.001 2003-01-15
Yellow Dog YDU-20030114-2 2002-01-14
SuSE SuSE-SA:2003:0004 2003-01-14
Red Hat RHSA-2003:006-06 2003-01-09
Debian DSA-213-1 2002-12-19

Comments (none posted)

lynx: CRLF injection vulnerability

Package(s):lynx CVE #(s):CAN-2002-1405
Created:November 19, 2002 Updated:October 1, 2003
Description: If lynx is given a url with some special characters on the command line, it will include faked headers in the HTTP query. This feature can be used to force scripts (that use Lynx for downloading files) to access the wrong site on a web server with multiple virtual hosts.

CAN-2002-1405

Alerts:
Conectiva CLA-2003:720 2003-08-11
Mandrake MDKSA-2003:023 2003-02-24
OpenPKG OpenPKG-SA-2003.011 2003-02-18
Red Hat RHSA-2003:029-06 2003-02-12
Trustix 2002-0085 2002-12-19
Debian DSA-210-1 2002-12-13
SCO Group CSSA-2002-049.0 2002-11-18

Comments (none posted)

perl-MailTools: remote command execution

Package(s):MailTools CVE #(s):CAN-2002-1271
Created:November 5, 2002 Updated:September 19, 2003
Description: The SuSE Security Team reviewed critical Perl modules, including the Mail::Mailer package. This package contains a security hole which allows remote attackers to execute arbitrary commands in certain circumstances. This is due to the usage of mailx as default mailer which allows commands to be embedded in the mail body.

Note that mail processing programs which use this package can be affected by this vulnerability; in particular, SpamAssassin is vulnerable if you use the -r or -w flags.

Alerts:
Debian DSA-386-1 2003-09-18
Gentoo 200302-01 2003-02-02
Mandrake MDKSA-2002:076 2002-11-07
Gentoo 200211-001 2002-11-06
SuSE SuSE-SA:2002:041 2002-11-05

Comments (none posted)

mikmod: buffer overflow

Package(s):mikmod CVE #(s):CAN-2003-0427
Created:June 16, 2003 Updated:June 16, 2005
Description: Ingo Saitz discovered a bug in mikmod whereby a long filename inside an archive file can overflow a buffer when the archive is being read by mikmod.
Alerts:
Fedora FEDORA-2005-405 2005-06-16
Red Hat RHSA-2005:506-01 2005-06-13
Fedora FEDORA-2005-404 2005-06-09
Gentoo 200307-01 2003-07-02
Debian DSA-320-1 2003-06-13

Comments (none posted)

mpg123 - buffer overflow

Package(s):mpg123 CVE #(s):CAN-2003-0577
Created:July 16, 2003 Updated:September 30, 2003
Description: The mpg123 utility contains a buffer overflow vulnerability which can allow an attacker to execute arbitrary code by way of a malicious MP3 file.
Alerts:
Gentoo 200309-17 2003-09-30
Mandrake MDKSA-2003:078 2003-07-23
Conectiva CLA-2003:695 2003-07-15

Comments (none posted)

Nessus NASL scripting engine security issues

Package(s):nessus CVE #(s):
Created:May 27, 2003 Updated:August 12, 2004
Description: Some some vulnerabilities exsist in the Nessus NASL scripting engine. To exploit these flaws, an attacker would need to have a valid Nessus account as well as the ability to upload arbitrary Nessus plugins in the Nessus server (this option is disabled by default) or he/she would need to trick a user somehow into running a specially crafted nasl script. Read the full advisory for additional information.
Alerts:
Gentoo 200305-10 2003-05-27

Comments (none posted)

netris: buffer overflow

Package(s):netris CVE #(s):CAN-2003-0685
Created:August 18, 2003 Updated:October 1, 2003
Description: Shaun Colley discovered a buffer overflow vulnerability in netris, a network version of a popular puzzle game. A netris client connecting to an untrusted netris server could be sent an unusually long data packet, which would be copied into a fixed-length buffer without bounds checking. This vulnerability could be exploited to gain the priviliges of the user running netris in client mode, if they connect to a hostile netris server.

CAN-2003-0685

Alerts:
Debian DSA-372-1 2003-08-16

Comments (none posted)

net-snmp: denial of service vulnerability

Package(s):net-snmp CVE #(s):CAN-2002-1170
Created:December 17, 2002 Updated:November 7, 2003
Description: The SNMP daemon included in the Net-SNMP package versions 5.0.1 through 5.0.4 can be caused to crash if it is sent a specially crafted packet.
Alerts:
Conectiva CLA-2003:778 2003-11-07
Red Hat RHSA-2002:228-11 2002-12-17

Comments (none posted)

nfs-utils xlog() off-by-one bug

Package(s):nfs-utils CVE #(s):CAN-2003-0252
Created:July 14, 2003 Updated:March 8, 2004
Description: Linux NFS utils package contains remotely exploitable off-by-one bug. A local or remote attacker could exploit this vulnerability by sending specially crafted request to rpc.mountd daemon. See this BugTraq post for more details.
Alerts:
Trustix TSLSA-2004-0009 2004-03-05
SCO Group CSSA-2003-037.0 2003-11-17
Conectiva CLA-2003:700 2003-07-22
Mandrake MDKSA-2003:076 2003-07-21
Gentoo 200307-07 2003-07-19
Yellow Dog YDU-20030718-1 2003-07-18
Slackware SSA:2003-195-01b 2003-07-15
Immunix IMNX-2003-7+-018-01 2003-07-14
SuSE SuSE-SA:2003:031 2003-07-15
Slackware SSA:2003-195-01 2003-07-14
Debian DSA-349-1 2003-07-14
Red Hat RHSA-2003:206-01 2003-07-14

Comments (none posted)

openssh: timing attack leads to information disclosure

Package(s):openssh CVE #(s):CAN-2003-0190
Created:May 2, 2003 Updated:November 30, 2004
Description: From the advisory: "During a pen-test we stumbled across a nasty bug in OpenSSH-portable with PAM support enabled (via the --with-pam configure script switch). This bug allows a remote attacker to identify valid users on vulnerable systems, through a simple timing attack. The vulnerability is easy to exploit and may have high severity, if combined with poor password policies and other security problems that allow local privilege escalation."
Alerts:
Ubuntu USN-34-1 2004-11-30
OpenPKG OpenPKG-SA-2003.035 2003-08-06
Red Hat RHSA-2003:222-01 2003-07-29
Gentoo 200305-02 2003-05-13
Gentoo 200305-01 2002-03-05

Comments (1 posted)

pam-pgsql: format string vulnerability

Package(s):pam-pgsql CVE #(s):CAN-2003-0672
Created:August 11, 2003 Updated:October 1, 2003
Description: Florian Zumbiehl reported a vulnerability in pam-pgsql whereby the username to be used for authentication is used as a format string when writing a log message. This vulnerability may allow an attacker to execute arbitrary code with the privileges of the program requesting PAM authentication.

CAN-2003-0672

Alerts:
Debian DSA-370-1 2003-08-08

Comments (none posted)

perl: cross site scripting vulnerability in CGI.pm module

Package(s):perl CVE #(s):CAN-2003-0615
Created:July 29, 2003 Updated:October 1, 2003
Description: obscure@eyeonsecurity.org reported a cross site scripting vulnerability in the CGI.pm perl module. This module is used to facilitate the creation of web forms and is part of the perl-modules RPM package.

CAN-2003-0615

Alerts:
Red Hat RHSA-2003:256-02 2003-10-03
Red Hat RHSA-2003:256-01 2003-09-22
OpenPKG OpenPKG-SA-2003.039 2003-09-15
Mandrake MDKSA-2003:084 2003-08-20
Debian DSA-371-1 2003-08-11
OpenPKG OpenPKG-SA-2003.036 2003-08-06
Conectiva CLA-2003:713 2003-07-29

Comments (none posted)

PHP: vulnerability in mail function

Package(s):php CVE #(s):CAN-2002-0985 CAN-2002-0986
Created:November 13, 2002 Updated:October 1, 2003
Description: Two vulnerabilities exists in the mail() PHP function. The first one allows the execution of any program/script bypassing safe_mode restriction, the second one may give an open-relay script if the mail() function is not carefully used in PHP scripts. See this Bugtraq report for more details. Note that this is a different vulnerability than the previous PHP mail() problem, which affected versions through 4.1.0.

CAN-2002-0985
CAN-2002-0986

Alerts:
SCO Group CSSA-2003-008.0 2003-03-04
Gentoo 200211-005 2002-11-20
EnGarde ESA-20021122-031 2002-11-22
Conectiva CLA-2002:545 2002-11-13
Red Hat RHSA-2002:213-06 2002-11-11

Comments (none posted)

phpgroupware - cross-site scripting and other exploits

Package(s):phpgroupware CVE #(s):CAN-2003-0504 CAN-2003-0582
Created:July 16, 2003 Updated:October 1, 2003
Description: Several vulnerabilities were discovered in all versions of phpgroupware prior to 0.9.14.006. This latest version fixes an exploitable condition in all versions that can be exploited remotely without authentication and can lead to arbitrary code execution on the web server. This vulnerability is being actively exploited.

Version 0.9.14.005 fixed several other vulnerabilities including cross-site scripting issues that can be exploited to obtain sensitive information such as authentication cookies.

See this Security Corportation report for more information.

CAN-2003-0504
CAN-2003-0582

Alerts:
Debian DSA-365-1 2003-08-05
Conectiva CLA-2003:703 2003-07-23
Mandrake MDKSA-2003:077 2003-07-23
Conectiva CLA-2003:697 2003-07-16

Comments (none posted)

postfix: denial of service vulnerabilities

Package(s):postfix CVE #(s):CAN-2003-0468 CAN-2003-0540
Created:August 5, 2003 Updated:May 27, 2004
Description: The postfix MTA, versions through 1.1.12 (but not 2.0) is subject to two remotely exploitable denial of service vulnerabilities; see this advisory from Michal Zalewski for details.
Alerts:
Mandrake MDKA-2004:028 2004-05-26
Trustix 2003-0029 2003-08-04
Mandrake MDKSA-2003:081 2003-08-04
EnGarde ESA-20030804-019 2003-08-04
Conectiva CLA-2003:717 2003-08-04
SuSE SuSE-SA:2003:033 2003-08-04
Red Hat RHSA-2003:251-01 2003-08-04
Debian DSA-363-1 2003-08-03

Comments (none posted)

PostgreSQL - more buffer overflows

Package(s):postgresql CVE #(s):
Created:February 12, 2003 Updated:November 7, 2003
Description: A new set of buffer overflows has been discovered in PostgreSQL 7.2.2; they affect the circle_poly(), path_encode(), and path_addr() functions. Exploiting these overflows requires that the attacker first obtain a connection to the PostgreSQL server.
Alerts:
Debian DSA-397-1 2003-11-07
Immunix IMNX-2003-7+-005-01 2003-04-08
Trustix 2003-0004 2003-02-20
Mandrake MDKSA-2002:062-1 2003-02-11

Comments (1 posted)

Local arbitrary code execution vulnerability in Python

Package(s):python CVE #(s):CAN-2002-1119
Created:August 28, 2002 Updated:October 1, 2003
Description: Zack Weinberg discovered that os._execvpe from os.py uses a predictable name which could lead to execution of arbitrary code. According to the Debian advisory, the problem was present in Python versions 1.5, 2.1 and 2.2.

CAN-2002-1119

Alerts:
Red Hat RHSA-2002:202-33 2003-02-12
OpenPKG OpenPKG-SA-2003.006 2003-01-23
Red Hat RHSA-2002:202-25 2003-01-21
Mandrake MDKSA-2002:082-1 2002-12-09
Mandrake MDKSA-2002:082 2002-11-25
SCO Group CSSA-2002-045.0 2002-11-14
Trustix 2002-0073 2002-10-17
Gentoo python-20021003 2002-10-03
Conectiva CLA-2002:527 2002-10-01
Debian DSA-159-2 2002-09-09
Debian DSA-159-1 2002-08-28

Comments (none posted)

Multiple-use vulnerability in Safe.pm

Package(s):Safe.pm CVE #(s):CAN-2002-1323
Created:October 9, 2002 Updated:February 20, 2004
Description: usePerl has a description of a vulnerability in the Safe.pm Perl module. It seems that if a Safe compartment is used more than once, it ceases to be safe. The problem is fixed in Safe 2.08.
Alerts:
SCO Group CSSA-2004-007.0 2004-02-20
Gentoo 200212-6 2002-12-20
Trustix 2002-0087 2002-12-19
OpenPKG OpenPKG-SA-2002.014 2002-12-16
Debian DSA-208-1 2002-12-12

Comments (none posted)

semi: insecure temporary file

Package(s):semi, wemi CVE #(s):CAN-2003-0440
Created:July 7, 2003 Updated:October 1, 2003
Description: semi, a MIME library for GNU Emacs, does not take appropriate security precautions when creating temporary files. This bug could potentially be exploited to overwrite arbitrary files with the privileges of the user running Emacs and semi, potentially with contents supplied by the attacker.

wemi is a fork of semi, and contains the same bug.

CAN-2003-0440

Alerts:
Gentoo 200308-02 2003-08-14
Yellow Dog YDU-20030723-2 2003-07-23
Red Hat RHSA-2003:234-01 2003-07-23
Debian DSA-339-1 2003-07-06

Comments (none posted)

sendmail: bad DNS reply causes crash

Package(s):sendmail CVE #(s):CAN-2003-0688
Created:August 26, 2003 Updated:October 1, 2003
Description: There is a potential problem in sendmail 8.12.8 and earlier sendmail 8.12.x versions with respect to DNS maps. The bug did not exist in versions before 8.12 as the DNS map type is new to 8.12. The bug was fixed in 8.12.9, released March 29, 2003. See this advisory for more information.

CAN-2003-0688

Alerts:
Conectiva CLA-2003:727 2003-08-29
Red Hat RHSA-2003:265-01 2003-08-28
OpenPKG OpenPKG-SA-2003.037 2003-08-28
SuSE SuSE-SA:2003:035 2003-08-26
Mandrake MDKSA-2003:086 2003-08-26

Comments (none posted)

stunnel: signal handler reentrancy DoS

Package(s):stunnel CVE #(s):CAN-2002-1563
Created:July 25, 2003 Updated:November 25, 2003
Description: Stunnel is a wrapper for network connections. It can be used to tunnel an unencrypted network connection over a secure connection (encrypted using SSL or TLS) or to provide a secure means of connecting to services that do not natively support encryption.

When configured to listen for incoming connections (instead of being invoked by xinetd), stunnel can be configured to either start a thread or a child process to handle each new connection. If Stunnel is configured to start a new child process to handle each connection, it will receive a SIGCHLD signal when that child exits.

Stunnel versions prior to 4.04 would perform tasks in the SIGCHLD signal handler which, if interrupted by another SIGCHLD signal, could be unsafe. This could lead to a denial of service.

Alerts:
Red Hat RHSA-2003:296-01 2003-11-24
SCO Group CSSA-2003-026.0 2003-10-03
Conectiva CLA-2003:736 2003-09-05
Trustix 2003-0030 2003-08-07
EnGarde ESA-20030806-020 2003-08-06
Red Hat RHSA-2003:221-01 2003-07-25

Comments (none posted)

sup: insecure temporary file

Package(s):sup CVE #(s):CAN-2003-0606
Created:July 29, 2003 Updated:October 1, 2003
Description: sup, a package used to maintain collections of files in identical versions across machines, fails to take appropriate security precautions when creating temporary files. A local attacker could exploit this vulnerability to overwrite arbitrary files with the privileges of the user running sup.

CAN-2003-0606

Alerts:
Debian DSA-353-1 2003-07-29

Comments (none posted)

File overwrite vulnerability in tar and unzip

Package(s):tar unzip CVE #(s):CAN-2001-1267 CAN-2001-1268 CAN-2001-1269 CAN-2002-0399
Created:October 1, 2002 Updated:April 10, 2006
Description: The tar utility does not properly filter file names containing "../", meaning that a hostile archive can, if unpacked by an unsuspecting user, overwrite any file that is writable by that user. GNU tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42 has the same vulnerability.
Alerts:
Fedora-Legacy FLSA:183571-1 2006-04-04
Red Hat RHSA-2006:0195-01 2006-02-21
Conectiva CLA-2002:538 2002-10-29
Mandrake MDKSA-2002:066 2002-10-10
Mandrake MDKSA-2002:065 2002-10-10
EnGarde ESA-20021003-022 2002-10-03
Gentoo unzip-20021001 2002-10-01
Gentoo tar-20021001 2002-10-01
Red Hat RHSA-2002:096-24 2002-09-18

Comments (1 posted)

teapop: SQL injection

Package(s):teapop CVE #(s):CAN-2003-0515
Created:July 9, 2003 Updated:October 1, 2003
Description: teapop, a POP-3 server, includes modules for authenticating users against a PostgreSQL or MySQL database. These modules do not properly escape user-supplied strings before using them in SQL queries. This vulnerability could be exploited to execute arbitrary SQL under the privileges of the database user as which teapop has authenticated.

CAN-2003-0515

Alerts:
Gentoo 200309-18 2003-09-30
Debian DSA-347-1 2003-07-08

Comments (none posted)

Multiple vendor telnetd vulnerability

Package(s):telnet Telnet netkit-telnet-ssl kerberos telnetd netkit-telnet nkitb/nkitserv/telnetd krb5 CVE #(s):
Created:May 21, 2002 Updated:October 5, 2004
Description: This vulnerability, originally thought to be confined to BSD-derived systems, was first covered in the July 26th Security Summary. It is now known that Linux telnet daemons are vulnerable as well.
Alerts:
Gentoo 200410-03 2004-10-05
Yellow Dog YDU-20010810-2 2001-08-10
Yellow Dog YDU-20010810-1 2001-08-10
SuSE SuSE-SA:2001:029 2001-09-03
Slackware sl-997726350 2001-08-09
Red Hat RHSA-2001:100-02 2001-08-09
Red Hat RHSA-2001:099-09 2002-02-07
Red Hat RHSA-2001:099-06 2001-08-09
Progeny PROGENY-SA-2001-27 2001-08-14
Mandrake MDKSA-2001:093 2001-12-17
Mandrake MDKSA-2001:068 2001-08-13
HP HPSBTL0202-023 2002-02-12
Debian DSA-075-2 2001-08-14
Debian DSA-075-1 2001-08-14
Conectiva CLA-2001:413 2001-08-24
SCO Group CSSA-2001-030.0 2001-08-10

Comments (none posted)

unzip: directory traversal vulnerability

Package(s):unzip CVE #(s):CAN-2003-0282
Created:July 1, 2003 Updated:November 13, 2003
Description: A vulnerabilitiy in unzip version 5.50 and earlier allows attackers to overwrite arbitrary files during archive extraction by placing invalid (non-printable) characters between two "." characters. These non-printable characters are filtered, resulting in a ".." sequence. See the full advisory for further information.
Alerts:
SCO Group CSSA-2003-031.0 2003-11-07
Debian DSA-344-2 2003-08-26
Slackware SSA:2003-237-01 2003-08-25
Mandrake MDKSA-2003:073-1 2003-08-19
Conectiva CLA-2003:724 2003-08-18
Red Hat RHSA-2003:199-02 2003-08-15
Yellow Dog YDU-20030710-1 2003-07-10
Gentoo 200307-02 2003-07-11
OpenPKG OpenPKG-SA-2003.033 2003-07-10
Debian DSA-344-1 2003-07-08
Mandrake MDKSA-2003:073 2003-07-07
Conectiva CLA-2003:672 2003-07-02
Immunix IMNX-2003-7+-017-01 2003-07-02
Red Hat RHSA-2003:199-01 2003-07-01

Comments (none posted)

vim - modeline vulnerability

Package(s):vim CVE #(s):CAN-2002-1377
Created:January 16, 2003 Updated:February 10, 2004
Description: VIM allows a user to set the modeline differently for each edited text file by placing special comments in the files. Georgi Guninski found that these comments can be carefully crafted in order to call external programs. This could allow an attacker to create a text file such that when it is opened arbitrary commands are executed.
Alerts:
Conectiva CLA-2004:812 2004-02-10
Mandrake MDKSA-2003:012 2003-02-03
Yellow Dog YDU-20030127-3 2003-01-27
Gentoo 200301-13 2003-01-22
OpenPKG OpenPKG-SA-2003.003 2003-01-21
Red Hat RHSA-2002:297-17 2003-01-15

Comments (4 posted)

vixie-cron: Local vulnerability

Package(s):vixie-cron CVE #(s):CVE-2001-0559
Created:April 17, 2003 Updated:October 3, 2003
Description: From the ISS advisory: "Vixie Cron is a scheduling daemon that ships with several Linux distributions. Vixie Cron version 3.0pl1 could allow a local attacker to gain root privileges. Crontab fails to properly drop privileges in certain cases after a crontab modification operation. A local attacker could exploit this vulnerability to gain root privileges on the system since crontab is installed setuid root."

Note: this vulnerability is dated May 07 2001, and was first mentioned in LWN on the May 10, 2001 security page.

Alerts:
Conectiva CLA-2003:758 2003-10-03
Conectiva CLA-2003:757 2003-10-03
Conectiva CLA-2003:628 2003-04-17

Comments (none posted)

vmware-workstation: vulnerability allows full host access

Package(s):vmware-workstation CVE #(s):CAN-2003-0480 CAN-2003-0631
Created:August 25, 2003 Updated:September 2, 2003
Description: According to this advisory vulnerabilities exist in VMware GSX Server 2.5.1 and earlier, and in VMware Workstation 4.0 and earlier releases. "By manipulating the VMware GSX Server and VMware Workstation environment variables, a program such as a shell session with root privileges could be started when a virtual machine is launched. The user would then have full access to the host."

See also CAN-2003-0480 and CAN-2003-0631

Alerts:
Gentoo 200308-03.1 2003-09-01
Gentoo 200308-03 2003-08-25

Comments (1 posted)

webmin: session ID spoofing

Package(s):webmin CVE #(s):CAN-2003-0101
Created:June 13, 2003 Updated:November 18, 2003
Description: miniserv.pl in the webmin package does not properly handle metacharacters, such as line feeds and carriage returns, in Base64-encoded strings used in Basic authentication. This vulnerability allows remote attackers to spoof a session ID, and thereby gain root privileges.
Alerts:
SCO Group CSSA-2003-035.0 2003-11-17
Debian DSA-319-1 2003-06-12

Comments (none posted)

wget:directory traversal bug

Package(s):wget CVE #(s):CAN-2002-1344
Created:December 10, 2002 Updated:October 1, 2003
Description: Versions of wget prior to 1.8.2-4 contain a bug that permits a malicious FTP server to create or overwrite files anywhere on the local file system.

FTP clients must check to see if an FTP server's response to the NLST command includes any directory information along with the list of filenames required by the FTP protocol (RFC 959, section 4.1.3).

If the FTP client fails to do so, a malicious FTP server can send filenames beginning with '/' or containing '/../' which can be used to direct a vulnerable FTP client to write files (such as .forward, .rhosts, .shosts, etc.) that can then be used for later attacks against the client machine.

See also this Bugtraq article from 1997.

CAN-2002-1344

Alerts:
Immunix IMNX-2003-7+-011-01 2003-06-03
OpenPKG OpenPKG-SA-2003.007 2003-01-23
SCO Group CSSA-2003-003.0 2003-01-16
Gentoo 200212-7 2002-12-20
Trustix 2002-0089 2002-12-19
Conectiva CLA-2002:552 2002-12-13
Debian DSA-209-1 2002-12-12
Mandrake MDKSA-2002:086 2002-12-11
Red Hat RHSA-2002:229-10 2002-12-04

Comments (none posted)

wget: buffer overflow

Package(s):wget CVE #(s):CAN-2003-1565
Created:August 5, 2003 Updated:December 10, 2003
Description: The wget utility contains a buffer overflow which, when exploited with an over-long URL, can enable arbitrary code execution.
Alerts:
Red Hat RHSA-2003:372-01 2003-12-10
SCO Group CSSA-2003-025.0 2003-10-03
Conectiva CLA-2003:716 2003-08-04

Comments (1 posted)

wu-ftpd: off-by-one bug

Package(s):wu-ftpd CVE #(s):CAN-2003-0466
Created:July 31, 2003 Updated:October 5, 2003
Description: An off-by-one bug has been discovered in versions of wu-ftpd up to and including 2.6.2. On a vulnerable system, a remote attacker would be able to exploit this bug to gain root privileges. See this advisory for more details.
Alerts:
SCO Group CSSA-2003-024.0 2003-09-26
Immunix IMNX-2003-7+-019-01 2003-08-06
Conectiva CLA-2003:715 2003-08-01
Debian DSA-357-1 2003-07-31
SuSE SuSE-SA:2003:032 2003-07-31
Mandrake MDKSA-2003:080 2003-07-31
Red Hat RHSA-2003:245-01 2003-07-31

Comments (none posted)

Wwwoffle remote privilege escalation vulnerability

Package(s):wwwoffle CVE #(s):CAN-2002-0818
Created:August 14, 2002 Updated:October 1, 2003
Description: The wwwoffle web proxy incorrectly processes HTTP PUT and POST requests with negative Content Length values. "It is believed that an attacker could exploit this bug to gain remote wwwrun access to the system wwwoffled is running on."

CAN-2002-0818

Alerts:
SCO Group CSSA-2002-048.0 2002-11-18
Debian DSA-144-1 2002-08-06
SuSE SuSE-SA:2002:029 2002-08-01

Comments (none posted)

xinetd: Memory leak in xinetd 2.3.10

Package(s):xinetd CVE #(s):CAN-2003-0211
Created:May 13, 2003 Updated:November 13, 2003
Description: Xinetd is a 'master server' that is used to to accept service connection requests and start the appropriate servers.

Because of a programming error, memory was allocated and never freed if a connection was refused for any reason. An attacker could exploit this flaw to crash the xinetd server, rendering all services it controls unavailable.

In addition, other flaws in xinetd could cause incorrect operation in certain unusual server configurations.

All users of xinetd are advised to update to xinetd-2.3.11 which is not vulnerable to these issues.

Alerts:
Conectiva CLA-2003:782 2003-11-12
Yellow Dog YDU-20030602-1 2003-06-02
Gentoo 200305-08 2003-05-19
Mandrake MDKSA-2003:056 2003-05-14
Red Hat RHSA-2003:160-01 2003-05-13

Comments (none posted)

zblast: buffer overflow

Package(s):zblast CVE #(s):CAN-2003-0613
Created:August 11, 2003 Updated:October 1, 2003
Description: Steve Kemp discovered a buffer overflow in zblast-svgalib, when saving the high score file. This vulnerability could be exploited by a local user to gain gid 'games', if they can achieve a high score.

CAN-2003-0613

Alerts:
Debian DSA-369-1 2003-08-08

Comments (1 posted)

Resources

Open Source Security Testing Methodology Manual version 2.1 released

The Open Source Security Testing Methodology Manual (OSSTMM) is an open standard method for performing security tests, focusing on the items that need to be tested, what to do during a security test, and when different types of security tests should be performed.

Full Story (comments: none)

Page editor: Jonathan Corbet

Kernel development

Brief items

Kernel release status

The current development kernel is 2.6.0-test4; Linus has not released any kernels since August 22.

That situation may have changed by the time you read this, however; Linus is back from his vacation and has merged a great many changes into his BitKeeper tree. Patches there include a reworked de4x5 driver, "very basic" VIA 8237 serial ATA controller support, a set of MODULE_ALIAS() calls (see below), support for a software-implemented hard disk activity LED, Intel High Precision Event Timers support, Al Viro's first set of large dev_t support patches (covered here last week), some IDE work, a large USB update, lots of network driver fixes, a new set of iptables modules, and many other fixes.

The current stable kernel is 2.4.22. Marcelo released the second 2.4.23 prepatch on August 30; it contains a set of IDE patches, some USB and networking fixes, and a number of other updates. 2.4.23-pre3 followed on September 3, with a fair amount of networking work, a backport of the 2.6 request_firmware() interface, a DRI/DRM update, gcc-3.3 support, and various other fixes.

Marcelo also notes that he has left Conectiva; his kernel work is now being supported by Cyclades.

Comments (3 posted)

Kernel development news

Class-based Kernel Resource Management

The Class-based Kernel Resource Management (CKRM) project is an effort at IBM to provide the hooks for better control over resource consumption by processes. The CKRM project sees the existing resource management tools (nice, ulimit) as not being up to the task. So the CKRM hackers have set out to provide a whole new infrastructure for process control. The ideas were presented at the Ottawa Linux Symposium last July; now, the first set of patches has been posted. The overview posting describes the other patches in the set and gives some pointers to further information.

The core concept behind CKRM is the division of processes into distinct classes, each of which has a separate set of policies applied to it. A kernel API has been provided which enables the loading of classifier modules, enabling different sites to have entirely different ways of classifying processes. Most would likely stick with the rule-based classifier, which is provided with the CKRM patch set; it allows classification based on various task structure fields. So, for example, processes can be classified based on their UID, which program they are running, etc.

Tasks can be reclassified any number of times over their lifetime. The CKRM core patch places hooks in the logical spots where a process could change classification: when a user or group ID is changed, when a program calls exec(), when a new process is forked, etc. There is also a plan for a system call allowing a process to request reclassification at any time, but that call does not appear to be present in the current patches.

Once a task is classified, the system can apply policies to that task. So, for example, the CPU control patch enforces CPU usage policies on processes. Essentially, each class (as a whole) can be restricted to (and guaranteed) access to a administrator-specified percentage of the available processor time. To implement this policy, the patch modifies the scheduler by creating a new run queue for each class. Before the scheduler picks a new process to run, it first decides which class has the highest-priority claim on the CPU. The process to run can then be chosen from that class's queue in the usual way.

The memory control patch, instead, implements policies stating how much physical memory each class can use. The patch hooks into the page reclamation code, making that code rather more selective in how it choses pages to kick out of main memory. Whenever possible, the page reclaimer only choses pages from classes which are going over their maximum allowed share of physical memory. As memory gets tighter, each class will be trimmed down to its minimum share, as set up by the administrator. If there is no real pressure on memory, however, processes are allowed to grow beyond the bounds set for their class.

The memory control problem is complicated by shared pages: what happens when pages are shared between processes in different classes? The documentation on the CKRM web site describes an elaborate mechanism where classes are set up in a hierarchy and shared pages are divided across the appropriate parts of that hierarchy. What the current code appears to do, however, is to simply assign shared pages to the class with the largest share of physical memory.

The CKRM team also describes mechanisms which allow control over the disk I/O bandwidth used by each class and the number of incoming network connections each class can be handling at a given time. The I/O limitations are implemented by adding per-class queues to the disk I/O scheduler and merging requests into a single dispatch queue with the bandwidth policies taken into account. The networking policies involve the creation of yet another set of class-specific queues; in this case, incoming connections are divided into classes through the use of iptables rules. Patches for I/O bandwidth and incoming network connection control have not been released at this time, however.

CKRM is clearly a work in progress; much of the structure is in place, but not everything has been implemented and the code is full of "this needs to be cleaned up" comments. The CKRM hackers hope to get their work into 2.7, however, so they have some time yet to work things into shape.

Comments (4 posted)

Power management arrives

One of the surprises in 2.6.0-test4 was the merge of a pile of power management patches from Patrick Mochel. The patches themselves were not a surprise; their arrival has been expected for some time. In fact, at the Ottawa Linux Symposium, Patrick had promised to try to get them in by August 20. The surprising part is that they went straight to Linus, with no prior appearance on linux-kernel.

The -test4 patches made a number of changes. Perhaps the most significant were the move of the device suspend() and resume() methods out of the device structure and into the bus_type structure. Bus-level code now is explicitly responsible for handling power management operations on devices attached to the bus.

Also changed in -test4 was the software suspend code; this code has been massively reworked and cleaned up. A number of panic() calls have been removed, requirements have been made explicit, the underlying mechanisms are more flexible, and the code is somewhat easier to read. The only problem is that, in -test4, software suspend also no longer works. The various problems which were introduced are being fixed, but one kernel developer in particular - the 2.6 software suspend maintainer - has been very loud in his criticisms and complaints. As a result, Patrick has stated that he will no longer go anywhere near the software suspend code. He evidently has his own implementation which he has chosen not to merge so far; it may put in an appearance in the near future.

Patrick also took some grief for the removal of /proc/acpi/sleep, which no longer fits well into the power management structure. It is, however, an interface which has been present for a while, and can thus break user-space programs.

Given all that, it is perhaps not surprising that Patrick announced his next set of changes on linux-kernel before sending them off to Linus. With these changes, the various suspend states all work with ACPI - at least, on a system without much going on. There is still a lot of work to do, especially with regard to adding driver support. But things appear to be heading in the right direction.

The new set of patches restores /proc/acpi/sleep, and the older software_suspend() function (as a wrapper for the current pm_suspend() function) as well. A number of software suspend improvements have been added. And various other aspects of the code have been cleaned up. With one exception, the developers are not complaining about the new power management code. With luck, one of the remaining 2.6 rough edges will soon be smoothed out.

Comments (none posted)

MODULE_ALIAS

The Linux kernel has long had the capability to load modules on demand when external events make their presence necessary. In many cases, the kernel knows exactly which module is required, and can simply ask for it by name. So, for example, the IDE subsystem can call:

    request_module("ide-cd");

should it encounter a CD needing a driver. In many cases, however, the kernel does not know exactly which module should be loaded; in these cases it punts the question into user space. So, for example, if a user program tries to open a block device node with major number 100, and no driver has registered that number, the kernel will try to load a module called block-major-100. The job of finding a module then falls on modprobe, which will expect to find an alias line in /etc/modules.conf telling it what module should really be loaded.

The only problem with this scheme is that device drivers usually already know which device numbers they are prepared to support. Adding configuration information to /etc/modules.conf is, at best, redundant. It can also be misleading; the poor administrator who tries to connect a driver to a different device number via modules.conf is unlikely to experience much joy.

When the new module loader was added - almost one year ago, now - it included a new MODULE_ALIAS macro. The purpose of this macro is to allow driver authors to specify directly which aliases the module should be responsible for. It is an idea that makes sense, but uptake has been slow; a quick grep of the 2.6.0-test4 source shows that there is not a single use of MODULE_ALIAS in the kernel tree.

That situation appears to be about to change, now that Rusty Russell has released a set of patches which insert actual MODULE_ALIAS calls into the kernel source. The actual variants used depend on the subsystem; block drivers use MODULE_ALIAS_BLOCKDEV, for example, while char devices use MODULE_ALIAS_CHARDEV or MODULE_ALIAS_MISCDEV and network protocols use MODULE_ALIAS_NETPROTO.

There are still situations which require alias commands in the modules.conf file: there is no way for a driver author to know which module should be loaded to implement eth0, for example. But many of the boilerplate aliases can be, eventually, removed. Internal alias support has been present in module-init-tools for some time, so all that's needed before the alias commands can be cleaned up is to get rid of all those legacy 2.4 (and prior) kernels.

Comments (none posted)

Patches and updates

Kernel trees

  • Andrew Morton: 2.6.0-test4-mm5. "<span>Dropped out Con's CPU scheduler work, added Nick's. This is to help us in evaluating the stability, efficacy and relative performance of Nick's work.</span>" (September 3, 2003)
  • Andrea Arcangeli: 2.4.22aa1. (September 2, 2003)

Core kernel code

  • Con Kolivas: O19int. (August 29, 2003)
  • Con Kolivas: O20int. (September 3, 2003)

Development tools

Device drivers

Filesystems and block I/O

Janitorial

Kernel building

Memory management

Networking

Architecture-specific

Benchmarks and bugs

Miscellaneous

Page editor: Jonathan Corbet

Distributions

News and Editorials

Interview with Knut Yrvin, Project Leader of Skolelinux

[This article was contributed by Ladislav Bodnar]

September traditionally means back to school in many parts of the Northern Hemisphere and this year is no different. What will be different, however, is the operating system that many Norwegian pupils will find on their school's computers once they return to the classrooms. That's because despite the excruciating heat wave that hit much of Europe this summer, the Skolelinux developers did not take a break. Skolelinux? Yes, Skolelinux, a project to create a Linux distribution with the goal of replacing the proprietary operating systems in schools throughout Norway. The project's two primary objectives are the ability to run on low-end computer systems as well as a complete support for all Norwegian languages, including the minority ones.

Knut Yrvin, the Project Leader at Skolelinux kindly agreed to answer a few questions for LWN.

Knut, thank you very much for your time. Firstly, can you tell us about the beginnings of Skolelinux? What motivated the initiation of the project?

It all started when Petter [Reinholdtsen, the project's system architect] and myself, were attending a summer party one day in June 2001. We talked about how sad it was that most local schools had little besides old computers and a few applications running on Windows, and very little money for upgrades. We found it frustrating that closed-source software prevented our pupils interested in technical, under-the-hood things from learning by example - from source code written by expert programmers. That's when we decided to stop talking about it and simply do it. We had a start-up meeting on July 2, 2001, with 13 participants and 12 other interested parties who could not attend personally.

As the name suggests, Skolelinux is specifically designed for deployment in schools. How do you go about convincing schools to switch to Skolelinux?

We use the "seeing is believing" strategy. We let teachers try Skolelinux for themselves and make a decision only once they've used it. We also get a lot of help from the Unix/Linux User Groups around the country who are helping with deployment. The whole process is then self-propagating; we often get references and hear about installations in places we didn't even know existed!

We have also written a considerable amount of tailor-made documentation for teachers. We provide a day-to-day Operation Handbook, a Getting Started guide, a Get-to-know Skolelinux course, and other documents. Everything is written in Norwegian in a simple, non-technical language.

IBM Norway is helping as well. They started promoting Skolelinux in December 2002 and soon afterwards many more hardware vendors jumped on the bandwagon. Suddenly there seems to a be a lot of momentum behind the Skolelinux project!

How many schools are using Skolelinux at present?

Officially about 20. But unofficially we have reports of entire towns, municipalities and counties that are testing Skolelinux in one or two schools before making an official commitment. We know of an IT department responsible for all schools in one city which has agreed not to disclose their plans to deploy Skolelinux just to avoid the inevitable bureaucracy associated with such a transition. We also know of 8 or 9 communities, which are going to switch to Skolelinux later this year. We have asked them to do it slowly in the beginning to gain experience (and to let us sort out the 5 remaining release critical bugs ;-)).

What kind of response have you been getting from schools? Would you say that there is a lot of enthusiasm for Linux? Have you met with any resistance?

Yes, we have met with opposing ideas. These usually come from the administration in municipalities and Microsoft professionals who believe that "Windows is the answer, what's the question again?". We try to by-pass them and go straight to the schools' principals asking them about important values, such as the use of the Norwegian languages, IT budgets, and Internet-based solutions in cases where The Ministry of Education and Science mandates that schools conduct their examinations on the Internet.

In Spain, there are several provinces the governments of which have mandated exclusive use of Linux in all levels of schools. Is there a similar situation in Norway? Do you get any support from the Norwegian government?

The government helped financing the initial project report which discussed the use of free software in education and funding of associated activities. There is a will to continue contributing in the future so that the mostly voluntary work can be transformed into secure jobs for the people involved.

The development, translation, deployment, maintenance and support of Skolelinux costs money. How do you go about raising funds for your work?

Initially, it was the NUUG Foundation which helped funding the effort. They have covered the cost of travel to developer meetings from various parts of Norway and even from other countries. Now there are 4 or 5 of us on their payroll to ensure the continuity of the development, effective project leadership and translation work.

Every successful deployment of Skolelinux in a Norwegian school means a lost sale for Microsoft. Has there been any reaction from Microsoft Norway?

Well, we did receive a letter from Steve Ballmer wishing us good luck with the Skolelinux project. This was after a meeting with Microsoft and a round-table conference with some well known IT-personalities in Norway. The meeting was initiated by Microsoft Norway who invited us to join a 60-minute discussion to talk about some controversial issues regarding the way Microsoft conducts some of their business. It was interesting and Ballmer was up to speed on questions like security, intellectual property rights, etc. Unfortunately, he had to leave early, just when the discussion was beginning to heat up. Anyway, we are of the opinion that Microsoft people are nice, and hopefully they think the same about us. We don't agree on some crucial principles concerning the ownership of the source code, but we try to focus on our task, rather than politics. However, we know that Microsoft has offered some Norwegian schools huge discounts to undermine the advancements of Skolelinux.

You have chosen Debian GNU/Linux as a base for your distribution. Any particular reasons?

The openness, Debian project's acceptance of our contributions, apt-get, the conservative and well-tested packages and of course, the community - these were the main reasons.

From the technical point of view, what exactly is the main focus of your development work?

We currently work on a new Debian installer as well as an out-of-the-box services and network setup. We have also created a user administration system with LDAP, Webmin, and netgroups. This is because the IT coordinators in schools need an easy-to-use, web-based and secure system for creating and managing user accounts for pupils and teachers. Another essential area of our work is writing user-friendly documentation in local languages.

Knut, thank you very much for your time and good luck with your project!

Comments (2 posted)

Distribution News

Debian GNU/Linux

The Debian Weekly News for September 2, 2003 is out. This week's edition looks at software patents in Europe; a talk on Debian GNU/Linux as a Japanese language teaching platform; Opteron support; for Debian Developers; and much more.

Branden Robinson reports on the results of a survey which followed a lengthy debate on the debian-legal mailing list concerning whether the GNU Free Documentation License satifies the Debian Free Software Guidelines. Meanwhile, the debate continues.

Last October, Bdale Garbee arranged a group subscription to LWN.net for Debian developers, sponsored by HP. In response to questions, Bdale has recently noted that the Debian group subscription is still available. For those of you who have opted to keep your own subscription to help out LWN, you have our thanks. However, if you are a Debian developer and not currently subscribed to LWN you might want to take advantage of Debian's group subscription.

Comments (none posted)

Gentoo Weekly Newsletter

The September 1 Gentoo Weekly Newsletter is out; it looks at the availability of portage tarballs for OpenBSD and FreeBSD and the second Gentoo BugDay. The project is also looking for a new lead French translator.

Full Story (comments: none)

LinuxQuestions.org adds a Red Hat Forum

LinuxQuestions.org has announced the addition of a Red Hat forum that is officially recognized by Red Hat.

Comments (none posted)

Slackware Linux

At Slackware Linux the slackware-current changelog shows lots of activity. Lots of packages have been upgraded, including the Linux kernel (to 2.4.22). Bugs have been created and squashed in the process.

Comments (1 posted)

Interview: Morphix founder Alex de Landgraaf (NewsForge)

NewsForge interviews Alex de Landgraaf, founder of Morphix. "When did you start Morphix and why? I actually started playing around with Knoppix, was pretty active on knoppix.net, in December 2002. I had a remastered version called KnopNL, because I was planning to make a light-weight Dutch distribution. There was (and still is) a lively community working on making specific distributions using Knoppix, but I saw time and time again that people had to "put Knoppix on a diet" and merge new changes from Knoppix before they could do anything useful."

Comments (none posted)

FreeBSD portupgrade (O'ReillyNet)

O'ReillyNet looks at FreeBSD's portupgrade utility. "The ports collection is constantly being updated. New ports are added regularly, usually on a daily basis. If you're the curious type and like to see a layout of which ports were added when, you'll find FreshPorts an invaluable resource."

Comments (none posted)

Beehive Linux

Beehive Linux is dead. From the obituary:

My reasons for stopping Beehive are 1) Mac OSX simply kicks ass as a desktop. Been using it as my only desktop since 10.0 came out. No more futzing with configs, things just work. 2) Gentoo works well enough, and it's reasonably easy to mod the build configs for a given package (Apache, MySQL, Postgres, etc) to put the install where I want it. Overall it's 'good enough' and the Portage tool is really nice.

Comments (none posted)

Minor distribution updates

Astaro Security Linux

Astaro Security Linux has released v4.011 with minor security fixes and v4.012 with minor bugfixes. "Changes: This Up2Date added LOGACCEPT to packet filtering and year support for log files. It also fixed the WebAdmin port after importing a backup, the Autofilter bug with PSK authentication, an iptables rules/DNSproxy settings conflict when the proxy was disabled, and a PPTP daemon connection limitation. The POP3 proxy was fixed for clients that didn't terminate connections properly." Version 4.012 fixes a small issue with SMTP domain routing which occurs in very rare cases.

Comments (none posted)

BG-Rescue Linux

BG-Rescue Linux has released v0.2.0 with major feature enhancements. "Changes: This release updates uClibc to 0.9.20, e2fsprogs to 1.3.4, reiserfsprogs to 3.6.11, LILO to 22.5.7.2, and mdadm to 1.3.0. It adds cmdftp 0.62 and a new Linux kernel 2.4.22 (bzip2) with additional support for USB 2.0 EHCI, PCMCIA serial devices, and the following ethernet adaptors: 3c590/3c900, eepro100, VIA Rhine, TI ThunderLAN, USB-Realtek RTL8150, and USB-ASIX AX88172."

Comments (none posted)

bootE Linux

bootE Linux has released v0.20-r2 with minor feature enhancements. "Changes: In addition to a few minor adjustments, support for MS-DOS and VFAT file systems were compiled back into the kernel. Furthermore support for ReiserFS was added."

Comments (none posted)

Damn Small Linux

Damn Small Linux has released v0.4.5 with minor feature enhancements. "Changes: This version adds generic printer support. Fluxbox and most X applications are now running under user instead of root. sudo and Microcom were added. Oneko was added for the kids. The swap partition should now be properly recognized which makes DSL more compatible with low RAM systems. A tabs- and frames-enabled, patched version of Dillo was added. The icons were remapped so that they fit in the smallest resolution setting. The enhance feature is now smarter, so that it will not launch duplicate applications, but will bring bbpager into theme compliance."

Comments (none posted)

floppyfw

floppyfw has released stable v2.0.7 with minor bugfixes and the 2.4.22 kernel was included.

Comments (none posted)

Local Area Security Linux

L.A.S. Linux has released 0.4b MAIN of its 'live CD' distribution. "Changes in this latest version of L.A.S. include the addition of Ettercap-GTK, Clam Anti-Virus, MiniCOM, SpikeProxy, MRTG, and many of the Cisco-centric Open Source Exchange tools."

Full Story (comments: none)

MoviX

MoviX has released v0.8.0 with minor feature enhancements. "Changes: Support for remotes has been improved, the size of initrd has been reduced, and Italian translations have been added."

Comments (none posted)

Onebase Linux

Onebase Linux has released version 1.0 for x86 systems. Also Onebase is now set to form a Developer base for this project and everyone is invited to join.

Comments (none posted)

Recovery Is Possible! (RIP)

Recovery Is Possible! (RIP) has released v6.0 with major feature enhancements. "Changes: The kernel has been updated to 2.4.22. There are a lot of changes, and new floppy versions (1.44 MB and 1.68 MB)."

Comments (none posted)

Rock Linux

Rock Linux has released v2.0.0-rc1 with minor bugfixes. "Changes: In this release, more help text was added, a major cleanup of Emerge-Pkg was made, some new packages were added forming a total package count of nearly 900 packages, there were boot CD improvements, some init scripts were corrected for LSB conformance, and a better optimization selection for PowerPC resulting in better optimization settings, as well as many more cleanups and bugfixes."

dRock v2.0.0-rc1 is also out. "Changes: This release is based on ROCK Linux 2.0.0-rc1. It includes minor bugfixes and feature additions, including better optimization settings for PowerPC."

Comments (none posted)

Distribution reviews

A Galaxy of Possibility Part 1: Mandrake 9.1 ProSuite (OfB.biz)

Open for Business reviews Mandrake Linux 9.1 ProSuite. "For our evaluation of Mandrake Linux 9.1, we received a copy of Mandrake Linux ProSuite 9.1. ProSuite is Mandrake's high-end package that offers a number of useful features for enterprise deployment on both desktops and servers. Of particular interest is the DVD-ROM that is included, something that makes deploying Mandrake much more of a joy. Like SuSE's Professional Edition DVD (actually the latest SuSE includes two DVD's, but we only needed the one), Mandrake ProSuite's DVD allows you to use just one disc to install pretty much everything you could ever want on a GNU/Linux system."

Comments (none posted)

Page editor: Rebecca Sobol

Development

Coming soon: GNOME 2.4

The second beta release of the GNOME 2.4 desktop is now available; see the announcement on FootNotes for download information. Given that the real 2.4 release is intended to happen in early September, it seems like a good idea to have a look at what this release will bring. It would appear, however, that the GNOME folks have been too busy hacking to put together a comprehensive document on what's been done in the 2.3 development series. So the best place to look is this writeup by Sayamindu Dasgupta, who played around with the 2.3.5 release for a bit.

One enhancement in 2.4 will be a new set of system administration tools. There have been a number of attempts at graphical adminstration tools for Linux over the years; with mixed success. Combining the numerous utilities, configuration files, and setup schemes into a unified interface is a hard problem. It is good to see that work is continuing in this area, however. Eventually somebody will get it right.

A good step in that direction is the new "change screen resolution" dialog. Linux doesn't require constant tweaking of the display settings the way certain other desktop operating systems seem to, but it's still a good idea to make it easy when the need arises.

On the browser front, Galeon is gone. Epiphany is now the browser bundled with GNOME. Some quick tests here in LWN labs (where Galeon has long ruled supreme) show that Epiphany pretty much works as expected; it is a reasonable, functioning browser. But we'll probably keep Galeon around for a while yet.

Accessibility is an important theme with 2.4; the "gnopernicus" screen reader has been improved and fixed up. There's a new set of "assistive technology" preferences which control which accessibility tools are started up at the beginning of a session. And, to help keep people from needing assistance in the future, GNOME now includes the obnoxious "time to take a typing break" nagging utility.

There's many other additions, of course; gedit has syntax highlighting, nautilus is improved, etc. See the writeup for more information. Or, better, download the beta and help shake out the last bugs so that 2.4 can be a truly stable release.

Comments (5 posted)

System Applications

Audio Projects

JACK 0.80.0 released

Version 0.80.0 of the JACK Audio Connection Kit is available. Changes include improved portability, a new transport API, support for asymmetric sound cards, and more.

Comments (2 posted)

Database Software

PostgreSQL Weekly News

The August 28, 2003 edition of the PostgreSQL Weekly News has been published. Take a look for the latest PostgreSQL database news.

Full Story (comments: none)

Education

Moodle 1.1 is now available! (SourceForge)

Version 1.1 of Moodle has been released. "Moodle 1.1, the best system for managing and conducting online courses, is now available. Highlights include: A completely new packaging system for backup, transfer and restore of courses."

Comments (none posted)

Printing

Ghostscript releases

AFPL Ghostscript (i.e. the one with a "not quite entirely free" license) 8.11 has been released; this is the first stable release since 8.00. Improved font rendering is the most significant new feature this time around.

The second release candidate of ESP Ghostscript 7.07.1 is available. ESP Ghostscript is the "Easy Software Products" version, which has been patched to work well with the CUPS print system.

Comments (1 posted)

Desktop Applications

Audio Applications

KGuitar Release 0.4.9 (SourceForge)

Version 0.4.9 of KGuitar is available. "KGuitar aims to develop a free, full-featured guitarist helper program, focusing on tabulature editing and MIDI synthesizers support." This version adds support for KDE 3.0.

Comments (none posted)

Ecasound 2.3.0

Ecasound 2.3.0 has been released. It includes a number of important bug fixes, JACK 0.80 support, and numerous other enhancements; see the announcement for details.

Comments (none posted)

Desktop Environments

KDE Traffic #62

Issue #62 of KDE Traffic is online. The KDE.News summary says: "A whole lot of news in this one, including some discussion on the new KPrefs, GConf2, quick tab access in Konqueror, a lot of KOffice news (beta 3 feature freeze, better support for Word 6 and Word 95), and mention of the new pim.kde.org design. Thanks Russell!"

Comments (none posted)

August 29 KDE-CVS-Digest

The August 29 KDE-CVS-Digest is available. "Some new applications: Knot, a service location server, Kickme, a lightweight dcop messenger and event viewer, kio-ldap kioslave, KWifiManager, for monitoring wireless cards, the new Plastik widget style, an snmp plugin for Ksim. ARts adds Media Application Server output support."

Comments (none posted)

GNOME Network 1.99.1 released (GnomeDesktop)

As seen on FootNotes: version 1.99.1 of the GNOME Network package - a set of network-oriented tools - has been released. This is a development release, and thus may not be for everybody.

Comments (none posted)

Graphics

GIMP 1.3.19 Released (GnomeDesktop)

Version 1.3.19 of the Gimp has been announced. "GIMP is now very close to a 2.0 prerelease, so your testing efforts are particularly appreciated." The announcement lists the changes in detail.

Comments (none posted)

Interoperability

Samba-3.0.0 RC2 available for download

The second release candidate of Samba 3.0.0 is available. See the release notes for change information.

Full Story (comments: none)

Mail Clients

Balsa 2.0.14 released (GnomeDesktop)

Version 2.0.14 of Balsa, and email client for GNOME, is available. New features include message wrapping improvements, delsp draft support, experimental LDAP write support, and bug fixes.

Comments (none posted)

Mahogany 0.65 released (SourceForge)

Version 0.65 of Mahogany, an email client, has been released. "All existing users should upgrade to this version, it adds many new features (real Drafts folder with automatic messages saving in case of crash; TLS and PGP/GPG support; many, many UI enhancements) and fixes tons of bugs."

Comments (none posted)

Multimedia

GStreamer ''Mother Theresa'' 0.6.3 (GnomeDesktop)

Version 0.6.3 of GStreamer, an open-source extendable multimedia framework, has been announced. "This, along with the merge of netRhythmbox into Rhythmbox is excellent news for the open-source community. With the development of Totem, sound-juicer, and gnome multimedia support GStreamer is getting to be nearing a point where it can be used for everyday media playing. The Pipeline Editor is also becoming quite stable."

Comments (none posted)

Office Applications

AbiWord Weekly News #159

The August 31 edition of the AbiWord Weekly News is out; it includes a call for assistance with the Windows port along with the usual summary of AbiWord development themes and activities.

Comments (none posted)

Web Browsers

Linky 2.0.0 Released (MozillaZine)

Version 2.0.0 of Linky has been announced. "Linky is an add-on for the Mozilla Application Suite and Mozilla Firebird that adds extra link-related items to the standard page context menu. It allows users to perform tasks such as opening all links on a page in new tabs or copying selected links to the clipboard."

Comments (none posted)

Mozilla 1.5 beta released

Mozilla 1.5 beta is out. A number of fixes and enhancements have gone in since the 1.5 alpha release; see the release notes for details.

Comments (none posted)

Miscellaneous

A new gDesklets site

gDesklets is a GNOME architecture for desktop applets. A new site has popped up at gdesklets.gnomedesktop.org to support desklet development. Have a look for the latest release from the desklet hackers.

Comments (none posted)

Languages and Tools

C++

QuantLib 0.3.3 released (SourceForge)

QuantLib 0.3.3 (a financial modeling library) has been released. "Major additions of this release are an extensive test suite, a partial port to the new Pricing Engine framework, and the support of low-discrepancy Monte Carlo simulation."

Comments (none posted)

Java

JGraph 3.0 released

Version 3.0 of the JGraph "powerful, lightweight, feature-rich, and thoroughly documented open-source graph component" for Java has been released. It is accompanied by the JGraphPad diagram editor.

Comments (none posted)

Lisp

SBCL 0.8.3 released

Steel Bank Common Lisp version 0.8.3 is out. "This version, which now also builds on MacOS X, features new optimizations, improved compiler validation, support for automatic dowload and installation of code from CCLAN, the SB-THREAD:INTERRUPT-THREAD function and the usual bug fixes."

Full Story (comments: 2)

CL-GD 0.14 released

Version 0.14 of CL-GD - a Common Lisp library for dynamic image creation - has been released. This is the first public release of CL-GD, which is built on top of the classic "GD" graphics library.

Full Story (comments: none)

Macho 0.2 released

Macho is a web archiving system for electronic mail, written in Lisp. Version 0.2 has just been released, with new support for better quoting highlighting, an improved message parser, and improved performance.

Full Story (comments: none)

Perl

This Week on perl5-porters

This week on perl5-porters for August 31 is out, with looks at the Cwd module, base.pm, next and dynamic labels, Spambench, and more.

Comments (none posted)

Code Review Ladder Mailing List (use Perl)

use Perl has an announcement from Simon Cozens on the creation of the Perl code ladder review mailing list. The idea is to create a forum where Perl code can be reviewed by interested hackers before being submitted to CPAN or whatever else may be its eventual destination. With luck, the list will lead to a higher-quality CPAN in the future.

Comments (none posted)

Esperanto Translation Mailing List Created (use Perl)

usePerl notes the creation of a mailing list to support the Esperanto translation, which, it seems, beat out Swedish_Chef to be the official YAPC::Europe language.

Comments (none posted)

PHP

PHP Weekly Summary for September 1, 2003

The PHP Weekly Summary for September 1, 2003 is out. Topics include: 4.3.3 ships, Servlet SAPI, phpize broken, libxml2, and Zend Engine optimizations.

Comments (none posted)

PHP Security, Part 2 (O'ReillyNet)

John Coggeshall continues his O'Reilly series on PHP security with part two. "Welcome back to PHP Foundations. In my previous article, I continued my mini-series on best practices in PHP by introducing you to some of the ways that security can be compromised in your PHP scripts. This article continues that discussion with more examples of potential security holes and the tools and methods you can use to help plug them. Today I'll start by talking about one of the more critical potential security holes in PHP development writing scripts that make calls to the underlying operating system."

Comments (none posted)

Python

This week's Python-URL

Dr. Dobb's Python-URL for September 1 is out with the latest from the Python development community.

Full Story (comments: none)

Cleese - an operating system in Python

"And now for something completely different..." Cleese is a project to write a new operating system entirely in Python - or, at least, as much as possible. The project is young, but it has recently released "HalfPy," a stripped-down version of the Python interpreter, and a bootloader setup that works within Bochs.

Comments (none posted)

Tcl/Tk

This week's Tcl-URL

Dr. Dobb's Tcl-URL for September 1 is available, with the usual summary of happenings in the Tcl/Tk development community.

Full Story (comments: none)

Debuggers

Learning the JavaScript debugger Venkman (st.com)

Svend Tofte has put together a tutorial on Venkman, a JavaScript Debugger that is integrated into the Mozilla browser. "Realizing that most people who program JavaScript are not programmers, and thus might not be familiar with debuggers in general, I wanted to make a visual guide, that together with a bunch of screenshots and files, would explain how to use Venkman. For while a debugger is usually an arcana piece of software, most webdevelopers couldn't care less about, using Venkman can improve your productivity, by finding the bugs faster."

Comments (none posted)

Page editor: Jonathan Corbet

Linux in the news

Recommended Reading

Linux gains ground on aging Unix (Globe and Mail)

The Globe and Mail reports that Linux is gaining ground on proprietary UNIX. "A major factor in Linux adoption is support from application software vendors. For instance, Ms. Day says Red Hat Linux is widely used to run Oracle Corp.'s popular database software. One reason, Mr. Dean says, is that Oracle has promoted the fact that its software supports Linux. More and more application vendors are doing so." (Thanks to Jim Gallacher)

Comments (36 posted)

Ian Clarke on Freenet and his Decision to Leave the USA (GrepLaw)

GrepLaw interviews Ian Clarke. "Freenet is in active use in countries such as China to permit the free distribution of information there despite government censorship. A group, Freenet-China has taken Freenet and translated it to Chinese for this very purpose. Freenet is also actively used in other countries, including the United States, to distribute censored information such as the Church of Scientology 'Operating Thetan' documents." (Thanks to Joe "Zonker" Brockmeier).

Comments (6 posted)

Interview: Andrew Tridgell, the heart beat of Samba (LinuxWorld.com.au)

LinuxWorld.com.au interviews Samba creator Andrew Tridgell. "Andrew Tridgell: Over the last seven months I have been building the basic infrastructure for Samba version 4. As you know, Samba version 3 is only now nearing its final release, but while that is an important release its scope is much narrower than what we are aiming for in Samba4." (Thanks to Sydney King)

Comments (3 posted)

The SCO Problem

Of monkeys and penguins (Economist)

The Economist catches up with the SCO case. "Indeed 'the SCO case' of 2003 sounds increasingly like the famous Scopes Monkey Trial of 1925, which pitted religious fundamentalists against progressives wanting to teach Darwin alongside the Bible in American classrooms. The SCO case plays the same role in a culture war now consuming the software industry. On one side are the equivalents of the fundamentalists -- buttoned-down types clinging to proprietary and closed computer systems. Facing them are today's evolutionists -- the pony-tailed set championing collaboration and openness in the form of Linux, an operating system that anybody can download and customise for nothing."

Comments (58 posted)

SCO fined in Germany (Heise)

There is a brief article (in German) on Heise Online stating that SCO has been found to be in violation of a court order prohibiting the company from stating (without proof) that Linux contains stolen SCO property. SCO has been fined EUR 10,000. English text is available via Babelfish. (Thanks to Florian Kuhnke).

Comments (11 posted)

Dell: No shelter against SCO suits (News.com)

News.com reports on a speech by Michael Dell in which he states that Dell will not be offering indemnification for its Linux customers. He also talks about other directions being taken by the company: "'Eight-way (servers) are less than 1 percent of the market and shrinking pretty dramatically,' Dell said. 'If our competitors want to claim they're No. 1 in eight-ways, that's fine. We want to lead the market with two-way and four-way (processor machines).'" This comment has already rekindled the "how far should we scale" debate on linux-kernel.

Comments (12 posted)

Companies

Brunswick Integrates Code Expertise (TechWeb)

TechWeb covers an open source project from an unlikely source. "Brunswick Corp., maker of billiard tables, boats, and bowling balls, has produced an open-source code engine to exchange business data over the Internet, and the Securities and Exchange Commission is an early adopter. The SEC will use the engine to feed a system that analyzes stock trades as part of its regulation of insider trading."

Comments (3 posted)

IBM to release new Eclipse to run on Jikes VM (NewsForge)

NewsForge covers an IBM announcment that the latest version of the open source Eclipse development platform will now run on the Java-based, open-source Jikes Research Virtual Machine.

Comments (4 posted)

Motorola picks Linux for phone of the future (Register)

The Register looks inside Motorola phone software. "The fact that Motorola is selling its stake in Symbian (the corporation) doesn't mean that Motorola is stopping selling Symbian (the software) in its phones. But it does mean that Motorola thinks the future in phone software is elsewhere. Linux, to be precise."

Comments (none posted)

HP waves Red Flag for corporate Linux (ZDNet)

ZDNet has a brief report on a new partnership between HP and Chinese distributor Red Flag. "HP will support the Red Flag Server 4 series operating system and its subsequent products on the HP Integrity and ProLiant server lines. Red Flag will work with HP on product quality control, market sales, applications research, management training and applications support services."

Comments (none posted)

Eclipse revamp to forge path for Sun (News.com)

News.com reports that the Eclipse project is separating from IBM. "Given the organizational changes under way at Eclipse, Sun is considering joining the open-source project, according to a company representative. Sun wants a number of issues to be addressed before it joins, however. The company may push for a change in the organization's name, along with a resolution of technical problems over how Java applications present information, the representative said."

Comments (5 posted)

Business

Linux Set to Break Through in Consumer Electronics (NYTimes)

The NYTimes has picked up a Reuters article about Linux in consummer electronics. "Linux's key advantage over other operating systems is that the core software is freely available and widely embraced. In the cut-throat electronics business where profit margins are one or two percent at the best of times, every saving is welcome." (Registration required)

Comments (10 posted)

Linux Adoption

Linux: Is free really cheaper? (InfoWorld)

InfoWorld is running a lengthy report on the costs and benefits of switching to Linux. "The more fully an enterprise adopts Linux across its infrastructure, the more financial leverage it is likely to get out of up-front investments in the OS. Those investments, which can be considerable, include Linux training and tools, and the costs of migrating from a Unix or Windows environment. And that financial leverage is improving steadily as better management tools, more third-party vendor support, and more skilled Linux system administrators arrive on the market." (Thanks to Max Hyre).

Comments (1 posted)

Open Asia: Open source in Burma, Cambodia, and China (NewsForge)

NewsForge looks into the availability of open source software in Burma (also known as Myanmar), Cambodia, and China. "The PeguNC-Linux distribution, aimed at Myanmar, is intended to encourage native data processing. According to a message in the Myanmar Linux Users Club Yahoo! group, Myanmar has just a font, but no language support with sorting and searching. Byteklay, a member of the project, says, "(We) started with a so-called PeguNC-linux project at mmlinux.org . When I couldn't continue mmlinux, friends from mm carried that project on myanmarlug.org, a site developed and maintained by Ko Wiston [Compunut].""

Comments (1 posted)

Legal

Controversy over software patents (Heise)

Heise Online is running an article (in German) on the delay of the vote on software patents in Europe. Among other things, it notes that pro-patent forces are still hard at work trying to get an interoperability exemption removed from the proposed law. English text of a sort is available via Babelfish. (Thanks to Dirk Hillbrecht). Dirk has also supplied this translation.

Comments (none posted)

Interviews

Interview with Bjarne Stroustrup (Linux Journal)

Linux Journal interviews Bjarne Stroustrup, the creator of the C++ programming language. "LJ: Did you have a computer at home when you were growing up?
BS: No, it was too early for that. Computers were very expensive and lived in university departments and large companies. The first computer I saw was my university's Math department's GIER. It was an old Danish computer that filled a room and was fed programs on paper tape. I learned to program in Algol 60 on that one.
"

Comments (8 posted)

New Gnumeric

GnomeDesktop points to two articles about Gnumeric, which plans to release version 1.2.0 soon.

Here is a review of Gnumeric beta 1.1.19 is available from ILUG-Cal. (Found here)

LinMagAu has an interview with Jody Goldberg and Andreas L. Guelzow. (Found here)

Comments (2 posted)

Resources

Five Lessons Open Source Developers Should Learn from Extreme Programming (O'ReillyNet)

This O'ReillyNet article looks at how Extreme Programming lessons can benefit open source programmers. "Open source projects usually don't have the time or budget constraints to require hard and fast release dates, but getting frequent feedback from users and customers is vital to the survival of the project. Since "customers" are often potential developers, having a good feedback loop can increase the resources at your disposal. Keeping the source code public with regular snapshots or anonymous CVS or Subversion access helps, but if features take a long time to land or to stabilize, it can be difficult to know when the code is worth using."

Comments (none posted)

Reviews

Mozilla's New Focus: The End User (eWeek)

eWeek reviews Mozilla 1.5 beta. "With the Mozilla 1.5 Beta, the project is promising improvements in performance, stability, standards support and Web compatibility. But new features are not the primary focus. The beta release marks the beginning of the project's journey to focus more energy on end users and promotion of its efforts now that it is an independent organization, Mozilla President Mitchell Baker said."

Comments (13 posted)

Page editor: Rebecca Sobol

Announcements

Non-Commercial announcements

Test Environment Toolkit, TET3.6 now available

The Open Group has announced that the latest update to the Test Environment Toolkit, TET3.6, is now available. TET is used to drive the LSB Certification tests for Linux distributions.

Full Story (comments: none)

LinuxFocus.org September/October 2003 issue

The September/October issue of LinuxFocus is available. This month you can learn how to model a 3D train in Blender, explore the MySQL C API, see why older people love Linux, enhance photos with Gimp, and much more.

Comments (none posted)

LPI-Newsletter August 2003

The Linux Professional Institute's newsletter for the month of August is available. Look for LPI at TechXNY New York, Linux Expo UK, and Wow-Gao Canada; LPI-Brazil becomes an official affiliate; Update on Linux World San Francisco; LPI in Vietnam and Australia; and much more.

Full Story (comments: none)

Linux Gazette issue #94, September 2003

The September 2003 edition of Linux Gazette is out. Articles include From C To Assembly Language by Hiran Ramankutty; Linux based Radio Timeshifting by Yan-Fa Li; Python Weather Station by Phil Hughes; SCO Interview by Anonymous; and more.

Comments (3 posted)

ibiblio designates September as "Linux Month"

ibiblio.org has announced the designation of September as "Linux Month", in celebration of the twelfth anniversary of the birth of the Linux software created by developer Linus Torvalds.

Full Story (comments: none)

Commercial announcements

Linux in the Library of Congress

IBM has sent out a press release announcing that the Library of Congress Moving Images Collection - a project of three university libraries - will be hosted on IBM servers and, of course, Linux.

Full Story (comments: none)

Wing IDE for Python 1.1.10 Released

Version 1.1.10 of Wing, a commercial IDE for Python has been announced. This is a maintenance release.

Full Story (comments: none)

Opera delivers triplets for *nix

Opera Software has released Opera 7.20 Beta versions for the Unix variances Linux, Solaris and FreeBSD. These three beta releases all add support for bidirectional languages such as Arabic and Hebrew.

Full Story (comments: none)

New Books

The Linux Web Server CD Bookshelf

O'Reilly has released The Linux Web Server CD Bookshelf, Version 2.0, a bookshelf of LAMP technology on a single CD.

Full Story (comments: none)

"Perl Cookbook, Second Edition" Released by O'Reilly

O'Reilly has released the second edition of the Perl Cookbook.

Full Story (comments: none)

Contests and Awards

Perl Programming Contest (use Perl)

Use Perl reports on a perl programming contest for the WebGUI content management system. The contest lasts for 3 months and ends on December 1.

Comments (none posted)

Event Reports

GNOME-ms at fosscon 2003 (GnomeDesktop)

GnomeDesktop has a report from the GNOME-ms booth at the Free and Open Source Conference 2003 (Fosscon 2003) that was held last week in Subang Malaysia.

Comments (none posted)

Upcoming Events

Linux.Conf.Au 2004 Registration Opens

Registration is now open for linux.conf.au. IBM has signed on as the event's Penguin Sponsor. The conference will be held at the University of Adelaide in South Australia, January 14 - 17, 2004. Click below for more information.

Full Story (comments: none)

Linux Users Group of Davis: 'Uber TiVo' - hacking & upgrades

The September 15 LUGOD meeting will feature a talk on TiVo hacking.

Full Story (comments: none)

Events: September 4 - October 30, 2003

Date Event Location
September 8, 2003Boundaryless Information Flow: Open Source in the Enterprise(Hilton London Paddington)London, UK
September 11 - 12, 2003Python for Scientific Computing Workshop(SciPy'03)(CalTech)Pasadena, CA
September 15 - 18, 2003
October 7 - 8, 2003
LogOn Web DaysAcross Europe
September 15 - 18, 2003Embedded Systems Conference(ESC)(Hynes Convention Center)Boston, Mass
September 26 - 27, 2003Third DZUG-ConferencePaderborn, Germany
October 12 - 15, 2003International Lisp Conference 2003(ILC 2003)New York, NY
October 15 - 17, 2003The First Plone Conference(Tulane University)New Orleans, Louisiana
October 26, 2003
October 27 - 31, 2003
Large Installation Systems Administration Conference(LISA)(Town & Country Resort Hotel)San Diego, CA

Comments (none posted)

Web sites

Server Central Sponsors PHP.net Open Source Site

Server Central, a provider of managed hosting, announced it will sponsor PHP by hosting a server for PHP.net.

Comments (none posted)

New Mozilla Links Newsletter Launching Tuesday (MozillaZine)

The new Mozilla Links Newsletter has been launched. It is a bi-weekly publication, spawned from the nascent Mozilla marketing effort, featuring headlines, tips and information about third-party projects.

Comments (none posted)

MozillaZine is Five: 1998-2003

MozillaZine celebrates five years online, with a special fifth anniversary section.

Comments (none posted)

Software announcements

This week's software announcements

Here are the software announcements, courtesy of Freshmeat.net. They are available in two formats:

Comments (none posted)

Miscellaneous

'Perl' Added to Oxford English Dictionary (use Perl)

Use Perl reports that Perl has been added to the Oxford Dictionary of English. "Perl. noun [mass noun]. Computing. a high-level programming language used especially for applications running on the World Wide Web.

Comments (none posted)

Page editor: Rebecca Sobol

Letters to the editor

Of monkeys and penguins

From:  Pete Flugstad <peteflugstad@mchsi.com>
To:  letters@economist.com, letters@lwn.net
Subject:  Of monkeys and penguins
Date:  Fri, 29 Aug 2003 09:31:51 -0500

Dear Editors of Economist:
 
   Your article (author UNKNOWN - how about some attribution for this
article):
 
http://economist.com/printedition/displayStory.cfm?Story_ID=2020889
 
about SCO and attempting to compare it to something as fundamental as
the Scopes monkey trial is about as off base as it could possibly be.
 
   The SCO trial is about one thing and one thing only: money. SCO is
using the PR and buzz they themselves are stiring up by kicking the
hornets nest that is the Open Source movement. They're doing this
purely in order to pump up their stock price, which they are
proceeding to sell as fast as possible. Numerous news and web sites
have pointed this out and highlighted the sales SCO execs and share
holders have been making, but apparently the oldest motive on the
books is too opaque for some magazine called the "Economist".
 
   Everything SCO is doing, from refusing to actually disclose what
code may or may not have infringed, to sending letters to 1500 large
corporate Linux users, to calling the open source movement
"communist", is designed to generate buzz (good or bad) and that
results in increasing stock price. The whole "open source is
communist" line is sold old and defunct now, I'm stunned your editors
let you print it. Don't you know the new bogeyman is called a
"terrorist" now? I'm surprised SCO didn't try and label the open
source movement with that one (they probably did and I just missed it
in the avalance of press releases they send out).
 
   Please, make an attempt to actually do a little research on stories
before you snap off a silly puff piece like this about it. You've
just contributed to the SCO cause: your uncritical piece, attempting
to "glorify" the SCO case, is *exactly* what they want.
 
Pete Flugstad
Iowa City
 

[Editor's note: The Economist, as a matter of policy, does not put bylines on its articles]

Comments (12 posted)

Page editor: Jonathan Corbet

Copyright © 2003, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds