LWN.net Weekly Edition for November 26, 2003

Examining an attack on the GPL

On November 21, a law firm called Wolf, Greenfield & Sacks, P.C saw fit to issue a press release on the evils of the GPL. By the reckoning of Steve Henry, a "senior intellectual property lawyer" with the firm, the GPL is indeed scary:

We found this reading of the GPL to be interesting, so we asked Mr. Henry to explain his reasoning a bit. We thank him for getting back to us; for the curious, we have put his full response on a separate page. We'll just look at the core of his claims here. What Mr. Henry tells us is:

So, if you see the GPL as a contract, those who have received GPL-licensed software can enforce that contract's provisions against you. How could that be a problem? According to Mr. Henry:

Mr. Henry's point (a) is not controversial; if you use copyrighted work in violation of the license that applies to that work, you are infringing the copyright. There is nothing unique to the GPL there. Point (c) is the crux of the matter: Mr. Henry claims that, if you distribute a product containing GPL-licensed code, anybody receiving that code could sue to have your proprietary code relicensed. The fact that nobody has ever attempted to do this is irrelevant by this analysis; in the future somebody could make a try at it.

One could argue that, even if this reasoning holds, there is no real problem here. If a company does not wish to abide by the terms of the GPL, it should simply avoid incorporating GPL-licensed code into its products. Once again, the GPL does not differ from any other software license in this regard: if you do not like the license, nobody forces you to use the code. But the fact is that, by this argument, GPL-licensed code is more actively dangerous than other code. If you get caught using somebody's proprietary code, all you have to do is settle the copyright infringement claims and get on with life. With GPL-licensed code, you still have the infringement issue, but you could also be forced to give your proprietary products away. That would be a heavy price for a company to pay just because one of its employees slips some GPL-licensed code into its product.

But does this reasoning hold water? We dropped a note to FSF counsel Eben Moglen to get his opinion on Mr. Henry's argument. His response was:

If the GPL is not a contract, what is it? If you look at §106 of the U.S. copyright code, it states:

One of the rights given to copyright holders is to authorize others to create copies and derivative works. The GPL is that authorization: you have the right to create certain kinds of copies and derived products from GPL-licensed code. You have not signed a contract with the copyright holder, and you have not paid any sort of consideration, which is a required part of any legal contract. So you, as the recipient of GPL-licensed code, do not have any contract rights against those who distributed that code to you. Even the copyright holder lacks such rights, though the holder does have the right to claim infringement if the provisions of the GPL are not followed.

Mr. Moglen concluded with: "This talk about 'incorporating' GPL'd code in a product leading to forcing the rest of the product open is scare-mongering." We are inclined to agree. Anybody who is truly concerned about such issues, however, should discuss it with their own lawyer rather than taking our word for it.

Comments (55 posted)

Lawyers in charge

Anybody following the SCO Group story is aware that, in the last couple of weeks, the company has issued a new set of threats. Among other things, SCO claims that it will, soon, file suit against at least one Linux user. It is tempting to disregard these threats as just more bluster coming out of the company. Threats against other Unix vendors have failed to come to pass, the deadline for the company's "half-price Linux License" promotion continues to recede, the flood of invoices they promised us never appeared, etc. Why should things be different this time? When the weakness of SCO's case and the fact that a copyright suit would require a rather more straightforward unveiling of the company's evidence is considered, more lawsuits may seem unlikely.

There is, however, a recent Gartner Group pronouncement which is relevant here:

Of course, one could rephrase the above more succinctly: the company has no revenue stream and the lawyers are running the show. SCO has no real alternatives to income from litigation at this point, and its lawyers have nothing to lose from filing more lawsuits. Gartner could be right: SCO might indeed try to open up more legal fronts in the near future. If the company chooses its targets carefully, it might just succeed in finding one that will decide to settle rather than get involved in a long intellectual property case.

Or so SCO management must hope. At this point, however, there is enough information about the company's claims out there that any SCO target which takes the time to research the situation may well turn out to be less of a pushover than SCO might wish. In fact, as SCO carries out its search for the softest targets, chances are good it will pass over any company which makes it clear that it will fight back. Potential recipients of SCO licensing claims would do well to bear that in mind.

Comments (7 posted)

The CAN-SPAM bill examined

The U.S. House of Representatives passed a version of the "Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003," on Saturday. Commonly referred to as the "CAN-SPAM" bill, the House agreed on a version of the bill very similar to the bill passed by the Senate in October. This makes it likely (but not certain) that the U.S. will soon have a national law governing unsolicited commercial e-mail (UCE) -- better known as "spam" (or any number of less polite terms) by the rest of us.

Very few outside of the Washington beltway or the Direct Marketing Association (DMA) seem convinced that the CAN-SPAM bill is going to put a halt to spam. A number of people, including several state Attorneys General have argued that CAN-SPAM will make matters worse, rather than better. There is a fair amount of evidence to support this opinion.

The CAN-SPAM bill actually has the effect of legitimizing spam so long as it is non-fraudulent and provides the recipient with a means to "opt-out" of future e-mails. This is a big win for the DMA, and a major loss for the rest of us. Having to opt-out of receiving spam from each and every "legitimate" source of spam is a burden that should not be placed on the user. Given that there are thousands of legitimate businesses that will seek to make use of e-mail marketing, users are going to be doing a lot of opting out.

What about a "do-not-spam" list? The CAN-SPAM Act does contain a provision to create a national "do-not-spam" list. This can only be seen as a tactical error of gargantuan proportions. While a "do-not-call" list may succeed in reducing or eliminating unwanted telemarketing calls, spammers operating beyond U.S. borders are unlikely to be deterred by the CAN-SPAM provisions. Indeed, getting a copy of the the "do-not-spam" list will likely be a high priority for offshore spammers looking for a roster of known-good e-mail addresses. Users who place their e-mail addresses on a "do-not-spam" list may avoid spam from legitimate businesses, but will still find themselves subjected to unwanted e-mail from offshore spammers. Happily, the CAN-SPAM bill does not require the Federal Trade Commission to create a "do-not-spam" list, it only permits the creation of such a list. Given that the FTC has objected to this provision, implementation seems unlikely.

Even worse, the bill overrides state legislation that may be more stringent than the CAN-SPAM bill. This is presented as a solution to the difficulty for "law-abiding businesses" to comply with anti-spam laws, but complying with multiple state laws is a cost of doing business. This should not be an excuse to shift the burden to users and organizations rather than businesses seeking to advertise their goods or services. By overriding state laws that require "opt-in" rather than "opt-out," the CAN-SPAM Act is giving merchants free reign to send unwanted spam, at least until the user asks to be left alone. While one may argue that any laws against spam are unlikely to be effective, at least laws like those passed in California are stacked in favor of the user rather than the spammers.

Some have claimed that the CAN-SPAM Act may make anonymous e-mails illegal altogether. John Gilmore argues that the bill would make it a crime "to use any false or misleading information in a domain name or email account application, and then send an email." However, this is a somewhat liberal interpretation of the bill, which actually says:

A close reading of this language indicates that merely sending an anonymous e-mail or e-mail with a falsified header would not automatically be a crime. The provisions only apply to those "in or affecting" commerce, which would seem to exclude a user who sends an anonymous e-mail for non-commercial purposes. It might be that the language could be abused to include someone who has sent an anonymous e-mail that may have some impact on a business, perhaps a whistleblower or disgruntled customer sending out negative commentary about a company, but then the user would have to send a relatively large number of e-mails. Further on, the bill classifies "multiple" as "more than 100 electronic mail messages during a 24-hour period," up to 10,000 during a 1-year period.

Unlike some of the state laws, which allow users to sue spammers directly, the CAN-SPAM Act seems to put users at the mercy of others to take action against spammers who do not comply. The Act explicitly addresses the ability of state and federal agencies to prosecute spammers under the provisions of the Act, and provides authorization for ISPs to bring action against spammers.

There are a few good things about the CAN-SPAM Act. The bill specifically states that nothing in the bill requires an ISP to carry or deliver spam. This prevents spammers from claiming that an ISP is in any way required to deliver spam, even if it is explicitly legal. The bill also contains a provision that allows the court to force a spammer to pay legal fees for the party that initiates proceedings. This may make it more likely that prosecutors will take on spammers who violate provisions of the bill.

CAN-SPAM also makes it illegal to for spammers to use open relays or other methods of hijacking computers to send spam, and requires a working method to opt-out of e-mail. Again, these provisions are unlikely to deter offshore spammers, but the provisions are welcome nonetheless.

Finally, the bill provides for vendor liability. This means that if a vendor contracts with a third party to send e-mail on their behalf, the vendor can be held liable for failure to comply with the CAN-SPAM provisions. This prevents companies from contracting with offshore spammers to escape legal liability.

In all, however, the CAN-SPAM Act is disappointing legislation. It fails to affirm users' rights to consent to e-mail marketing, and instead burdens them with the responsibility of opting out of unwanted marketing. The bill will negate tougher state laws against spam that have the backing of the general populace in favor of weakened provisions that are backed by lobbyists. After more than six years of Congressional foot-dragging, we will likely be stuck with a law that does little good, and may even serve to exacerbate the problem. It may well be that the spam problem is not solvable by legislation, but, even if it is, the CAN-SPAM act is not the law we need.

(For those who are interested, the full text of the proposed law is available in PDF format.)

Comments (21 posted)

Page editor: Jonathan Corbet

Security

Brief items

Infrastructural attacks on free software

The recent compromise of several Debian servers has been well publicized. It appears that the Debian archive was unaffected, and Debian users need not be worried about malware entering their systems by that path. Certainly this event, like the recent kernel backdoor attempt, has raised awareness of the vulnerability of our software repositories. An attacker who is able to slip a bit of evil code into the wrong place could compromise many thousands of systems.

Less attention has been paid to the cost of having the Debian servers be unavailable for the better part of a week. Your editor, waiting for a working version of psycopg to be uploaded to unstable, was merely inconvenienced. Other users, who may have planned significant installations or upgrades, or who were trying to discuss problems with Debian developers will have been rather more inconvenienced. Debian developers, trying to get 3.0r2 out the door, were stopped dead for a while. These consequences are costly enough by themselves, but consider what could happen. Had a major security incident broken out while the Debian servers were unavailable, it would have been difficult or impossible for the project to respond quickly.

Linux systems are living things; even the most stable systems need occasional updates to stay secure. Linux users depend on the availability of their distributions' supporting infrastructure to keep their systems up to date. This sort of attack, by making that infrastructure unavailable, hurts users worldwide, and could leave them unable to respond quickly to serious security problems. Once again, we have been warned that our infrastructure is too fragile and insufficiently secure.

Comments (17 posted)

New vulnerabilities

iproute: local denial of service

Package(s):	iproute net-tools	CVE #(s):	CAN-2003-0856
Created:	November 25, 2003	Updated:	December 14, 2004
Description:	The iproute utility is susceptible to spoofed netlink messages sent by local users, with the result that denial of service attacks are possible.
Alerts:	Mandrake MDKSA-2004:148 2004-12-13 Fedora FEDORA-2004-154 2004-06-03 Fedora FEDORA-2004-115 2004-05-11 Debian DSA-492-1 2004-04-18 Gentoo 200404-10 2004-04-09 Red Hat RHSA-2003:316-01 2003-11-24

Comments (none posted)

opera buffer overflows

Package(s):	opera	CVE #(s):	CAN-2003-0870
Created:	November 20, 2003	Updated:	November 24, 2003
Description:	The Opera browser can cause a buffer allocated on the heap to overflow under certain HREFs when rendering HTML. The mail system is also deemed vulnerable and an attacker can send an email containing a malformed HREF, or plant the malicious HREF on a web site. Please see this advisory for further details. These vulnerabilities are fixed in Opera 7.22.
Alerts:	Gentoo 200311-02 2003-11-19

Comments (1 posted)

Pan: denial of service

Package(s):	Pan	CVE #(s):	CAN-2003-0855
Created:	November 25, 2003	Updated:	December 10, 2003
Description:	Pan is a Gnome/GTK+ newsreader. A bug in Pan versions prior to 0.13.4 can cause Pan to crash when parsing an article header containing a very long author email address. This bug causes a crash (denial of service) but is not further exploitable.
Alerts:	Red Hat RHSA-2003:312-01 2003-12-10 Red Hat RHSA-2003:311-01 2003-11-24

Comments (none posted)

phpSysInfo directory traversal

Package(s):	phpsysinfo	CVE #(s):	CAN-2003-0536
Created:	November 25, 2003	Updated:	November 25, 2003
Description:	phpSysInfo contains two vulnerabilities which could allow local files to be read or arbitrary PHP code to be executed, under the privileges of the web server process.
Alerts:	Gentoo 200311-06 2003-11-22

Comments (none posted)

Updated vulnerabilities

2.4 kernel - several vulnerabilities

Package(s):	2.4 kernel	CVE #(s):	CAN-2003-0461 CAN-2003-0462 CAN-2003-0464 CAN-2003-0476 CAN-2003-0501 CAN-2003-0550 CAN-2003-0551 CAN-2003-0552
Created:	July 21, 2003	Updated:	December 24, 2003
Description:	Several security issues have been discovered affecting the Linux kernel: CAN-2003-0461: /proc/tty/driver/serial reveals the exact character counts for serial links. This could be used by a local attacker to infer password lengths and inter-keystroke timings during password entry. CAN-2003-0462: Paul Starzetz discovered a file read race condition existing in the execve() system call, which could cause a local crash. CAN-2003-0464: A recent change in the RPC code set the reuse flag on newly-created sockets. Olaf Kirch noticed that his could allow normal users to bind to UDP ports used for services such as nfsd. CAN-2003-0476: The execve system call in Linux 2.4.x records the file descriptor of the executable process in the file table of the calling process, allowing local users to gain read access to restricted file descriptors. CAN-2003-0501: The /proc filesystem in Linux allows local users to obtain sensitive information by opening various entries in /proc/self before executing a setuid program. This causes the program to fail to change the ownership and permissions of already opened entries. CAN-2003-0550: The STP protocol is known to have no security, which could allow attackers to alter the bridge topology. STP is now turned off by default. CAN-2003-0551: STP input processing was lax in its length checking, which could lead to a denial of service. CAN-2003-0552: Jerry Kreuscher discovered that the Forwarding table could be spoofed by sending forged packets with bogus source addresses the same as the local host.
Alerts:	Red Hat RHSA-2003:408-00 2003-12-19 Gentoo 200308-01 2003-08-14 Debian DSA-358-4 2003-08-13 SuSE SuSE-SA:2003:034 2003-08-12 Debian DSA-358-2 2003-08-05 Debian DSA-358-3 2003-08-04 Debian DSA-358-1 2003-07-31 EnGarde ESA-20032407-018 2003-07-24 Red Hat RHSA-2003:238-01 2003-07-21

Comments (none posted)

apache: buffer overflows in mod_alias, mod_rewrite

Package(s):	apache	CVE #(s):	CAN-2003-0542 CAN-2003-0789
Created:	October 28, 2003	Updated:	February 13, 2004
Description:	André Malo discovered buffer overflows in the mod_alias and mod_rewrite modules of the Apache webserver. These occurred if a regular expression with more than 9 capturing parenthesis was configured. To exploit this, an attacker would need to be able to locally create a carefully crafted configuration file (.htaccess or httpd.conf). CAN-2003-0542 Another buffer overflow in Apache 2.0.47 and earlier in mod_cgid's mishandling of CGI redirect paths could result in CGI output going to the wrong client when a threaded MPM is used. CAN-2003-0789.
Alerts:	Whitebox WBSA-2004:015-01 2004-02-12 Fedora FEDORA-2003-004 2004-01-08 Red Hat RHSA-2003:405-00 2003-12-18 Red Hat RHSA-2003:320-01 2003-12-16 Red Hat RHSA-2003:360-01 2003-12-10 Gentoo 200310-03 2003-10-28 Trustix 2003-0041 2003-11-15 Conectiva CLA-2003:775 2003-11-05 Slackware SSA:2003-308-01 2003-11-03 EnGarde ESA-20031105-030 2003-11-05 Mandrake MDKSA-2003:103 2003-11-03 Gentoo 200310-04 2003-10-31 Immunix IMNX-2003-7+-025-01 2003-10-28 OpenPKG OpenPKG-SA-2003.046 2003-10-28

Comments (none posted)

apache2: Denial of Service vulnerability

Package(s):	apache2	CVE #(s):
Created:	September 29, 2003	Updated:	March 25, 2004
Description:	A problem was discovered in Apache2 where CGI scripts that write more than 4k to the standard error stream will hang the script's execution. This problem can lead to a denial of service situation. See this bug report for additional details.
Alerts:	Gentoo 200403-04 2004-03-22 Netwosix NW-2004-0006 2004-03-25 Mandrake MDKSA-2003:096-1 2003-10-24 Mandrake MDKSA-2003:096 2003-09-26

Comments (none posted)

CUPS: denial of service

Package(s):	CUPS	CVE #(s):	CAN-2003-0788
Created:	November 3, 2003	Updated:	March 4, 2004
Description:	Paul Mitcheson reported a situation where the CUPS Internet Printing Protocol (IPP) implementation in CUPS versions prior to 1.1.19 would get into a busy loop. This could result in a denial of service. In order to exploit this bug an attacker would need to have the ability to make a TCP connection to the IPP port (by default 631).
Alerts:	SCO Group CSSA-2004-012.0 2004-03-03 Conectiva CLA-2003:779 2003-11-07 Mandrake MDKSA-2003:104 2003-11-05 Red Hat RHSA-2003:275-01 2003-11-03

Comments (none posted)

epic4: buffer overflow

Package(s):	epic4	CVE #(s):	CAN-2003-0328
Created:	November 10, 2003	Updated:	November 25, 2003
Description:	Jeremy Nelson discovered a remotely exploitable buffer overflow in EPIC4, a popular client for Internet Relay Chat (IRC). A malicious server could craft a reply which triggers the client to allocate a negative amount of memory. This could lead to a denial of service if the client only crashes, but may also lead to executing of arbitrary code under the user id of the chatting user.
Alerts:	Red Hat RHSA-2003:342-01 2003-11-17 Fedora FEDORA-2003-008 2003-11-12 Debian DSA-399-1 2003-11-10

Comments (none posted)

ethereal: multiple remote and local vulnerabilities

Package(s):	ethereal	CVE #(s):	CAN-2003-0925 CAN-2003-0926 CAN-2003-0927
Created:	November 10, 2003	Updated:	December 17, 2003
Description:	Multiple vulnerabilities have been found in ethereal versions below 0.9.16. Remote attackers can craft packets, and local users can build corrupt trace files, resulting denial of service and remote code execution.
Alerts:	Mandrake MDKSA-2003:114 2003-12-10 Fedora FEDORA-2003-022 2003-11-25 Gentoo 200311-04 2003-11-22 Red Hat RHSA-2003:323-01 2003-11-10 Conectiva CLA-2003:780 2003-11-07

Comments (none posted)

Filename disclosure vulnerability in fam

Package(s):	fam	CVE #(s):	CAN-2002-0875
Created:	August 19, 2002	Updated:	January 5, 2005
Description:	"fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible.
Alerts:	Red Hat RHSA-2005:005-01 2005-01-05 Debian DSA-154-1 2002-08-15

Comments (none posted)

fetchmail may crash on specially crafted message

Package(s):	fetchmail	CVE #(s):	CAN-2003-0792
Created:	October 17, 2003	Updated:	April 8, 2004
Description:	A bug was discovered in fetchmail 6.2.4 where a specially crafted email message can cause fetchmail to crash.
Alerts:	OpenPKG OpenPKG-SA-2004.012 2004-04-08 Gentoo 200403-10 2004-03-30 Netwosix NW-2004-0002 2004-02-20 SCO Group CSSA-2004-004.0 2004-02-19 Slackware SSA:2003-300-02 2003-10-22 Mandrake MDKSA-2003:101 2003-10-16

Comments (none posted)

fileutils/wu-ftpd: denial of service

Package(s):	fileutils	CVE #(s):	CAN-2003-0854
Created:	October 22, 2003	Updated:	March 2, 2004
Description:	There is, it seems, an integer overflow vulnerability in "ls" which can be exploited via wu-ftpd to create a denial of service situation. See this advisory from Georgi Guninski for details.
Alerts:	SCO Group CSSA-2004-006.0 2004-03-01 Trustix 2003-0042 2003-11-15 Mandrake MDKSA-2003:106 2003-11-12 Red Hat RHSA-2003:309-01 2003-11-03 Immunix IMNX-2003-7+-026-01 2003-10-31 Conectiva CLA-2003:771 2003-10-24 Conectiva CLA-2003:768 2003-10-22

Comments (none posted)

glibc - buffer overflow

Package(s):	glibc	CVE #(s):	CAN-2003-0689
Created:	October 15, 2003	Updated:	November 25, 2003
Description:	The GNU C library contains a buffer overflow in the getgrouplist() function. If the user belongs to more groups than the calling application expects, the allocated storage will be overrun.
Alerts:	Gentoo 200311-05 2003-11-22 Mandrake MDKSA-2003:107 2003-11-18 Trustix 2003-0039 2003-11-15 Red Hat RHSA-2003:325-01 2003-11-12 Conectiva CLA-2003:762 2003-10-14

Comments (none posted)

glibc: local DoS vulnerability

Package(s):	glibc	CVE #(s):	CAN-2003-0859
Created:	November 15, 2003	Updated:	November 19, 2003
Description:	Herbert Xu reported that various applications can accept spoofed messages sent on the kernel netlink interface by other users on the local machine. This could lead to a local denial of service attack. The glibc function getifaddrs uses netlink and could therefore be vulnerable to this issue. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0859 to this issue.
Alerts:	Fedora FEDORA-2003-002 2003-11-14

Comments (none posted)

glibc: DNS stub resolvers contain buffer overflow vulnerability

Package(s):	glibc	CVE #(s):	CAN-2002-1146
Created:	November 7, 2002	Updated:	February 5, 2004
Description:	DNS stub resolvers from multiple vendors contain a buffer overflow vulnerability. The impact of this vulnerability appears to be limited to denial of service. (See CERT Vulnerability Note VU#738331) The BIND 4 and BIND 8.2.x stub resolver libraries, and other libraries such as glibc 2.2.5 and earlier, libc, and libresolv, uses the maximum buffer size instead of the actual size when processing a DNS response, which causes the stub resolvers to read past the actual boundary ("read buffer overflow"), allowing remote attackers to cause a denial of service (crash).
Alerts:	Mandrake MDKSA-2004:009 2004-02-04 Red Hat RHSA-2002:197-09 2002-11-06 Red Hat RHSA-2002:197-06 2002-10-03

Comments (none posted)

gnupg: key validation

Package(s):	gnupg	CVE #(s):	CAN-2003-0255
Created:	May 16, 2003	Updated:	November 18, 2003
Description:	A key validation bug was discovered in the GNU Privacy Guard (GPG) which would cause keys with more then one user ID to trust all user ID's with the amount of trust given to the most-valid user ID.
Alerts:	SCO Group CSSA-2003-034.0 2003-11-17 Conectiva CLA-2003:694 2003-07-11 Yellow Dog YDU-20030602-4 2003-06-02 Mandrake MDKSA-2003:061 2003-05-22 Slackware ssa:2003-141-04 2003-05-22 Red Hat RHSA-2003:175-01 2003-05-20 Gentoo 200305-04 2003-05-16 OpenPKG OpenPKG-SA-2003.029 2003-05-16 EnGarde ESA-20030515-016 2003-05-15

Comments (none posted)

gtkhtml: malformed messages cause crash

Package(s):	gtkhtml	CVE #(s):	CAN-2003-0133 CAN-2003-0541
Created:	April 14, 2003	Updated:	April 18, 2005
Description:	GtkHTML is the HTML rendering widget used by the Evolution mail reader. GtkHTML supplied with versions of Evolution prior to 1.2.4 contain a bug when handling HTML messages. Alan Cox discovered that certain malformed messages could cause the Evolution mail component to crash.
Alerts:	Debian DSA-710-1 2005-04-18 Mandrake MDKSA-2003:093 2003-09-18 Conectiva CLA-2003:737 2003-09-12 Red Hat RHSA-2003:264-01 2003-09-09 Mandrake MDKSA-2003:046 2003-04-15 Red Hat RHSA-2003:126-01 2003-04-14

Comments (none posted)

hylafax: remote code execution

Package(s):	hylafax	CVE #(s):	CAN-2003-0886
Created:	November 10, 2003	Updated:	November 20, 2003
Description:	Hylafax is an Open Source fax server which allows sharing of fax equipment among computers by offering its service to clients by a protocol similar to FTP. The SuSE Security Team found a format bug condition during a code review of the hfaxd server. It allows remote attackers to execute arbitrary code as root. However, the bug can not be triggered in hylafax's default configuration. The "capi4hylafax" packages also need to be updated as a dependency where they are available. Upgrading to version 4.1.8 fixes the problem; see this advisory for details.
Alerts:	Gentoo 200311-03 2003-11-10 Debian DSA-401-1 2003-11-17 Conectiva CLA-2003:783 2003-11-12 Mandrake MDKSA-2003:105 2003-11-11 SuSE SuSE-SA:2003:045 2003-11-10

Comments (none posted)

KDE: Two issues in KDM

Package(s):	kde, xfree86	CVE #(s):	CAN-2003-0690 CAN-2003-0692
Created:	September 16, 2003	Updated:	December 19, 2003
Description:	According to this advisory two issues have been discovered in KDM: CAN-2003-0690: Privilege escalation with specific PAM modules. The XDM display manager that ships with XFree86 prior to 4.3 is also vulnerable. CAN-2003-0692: Session cookies generated by KDM are potentially insecure All versions of KDM as distributed with KDE up to and including KDE 3.1.3 are affected.
Alerts:	Mandrake MDKSA-2003:118 2003-12-19 Gentoo 200311-01 2003-11-15 Debian DSA-388-1 2003-09-19 Conectiva CLA-2003:747 2003-09-19 Mandrake MDKSA-2003:091 2003-09-16 Red Hat RHSA-2003:269-01 2003-09-16

Comments (none posted)

kernel-utils: setuid vulnerability

Package(s):	kernel-utils	CVE #(s):	CAN-2003-0019
Created:	February 7, 2003	Updated:	January 21, 2005
Description:	The kernel-utils package contains several utilities that can be used to control the kernel or machine hardware. In Red Hat Linux 8.0 this package contains user mode linux (UML) utilities. The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was incorrectly shipped setuid root. This could allow local users to control certain network interfaces, add and remove arp entries and routes, and put interfaces in and out of promiscuous mode. All users of the kernel-utils package should update to these packages that contain a version of uml_net that is not setuid root. Alternatively, as a work-around to this vulnerability issue the following command as root: chmod -s /usr/bin/uml_net
Alerts:	Red Hat RHSA-2003:056-08 2003-02-07

Comments (none posted)

libnids: remotely exploitable buffer overflow

Package(s):	libnids	CVE #(s):	CAN-2003-0850
Created:	October 29, 2003	Updated:	January 6, 2004
Description:	libnids (a NIDS plugin which emulates the Linux 2.0 IP stack) contains a buffer overflow vulnerability which can be exploited remotely. Version 1.18 fixes the problem.
Alerts:	Debian DSA-410-1 2004-01-05 Gentoo 200311-07 2003-11-22 Conectiva CLA-2003:773 2003-10-29

Comments (none posted)

libpng, libpng3: buffer overflow

Package(s):	libpng, libpng3	CVE #(s):	CAN-2002-1363
Created:	December 19, 2002	Updated:	July 14, 2004
Description:	Glenn Randers-Pehrson discovered a problem in connection with 16-bit samples from libpng, an interface for reading and writing PNG (Portable Network Graphics) format files. The starting offsets for the loops are calculated incorrectly which causes a buffer overrun beyond the beginning of the row buffer.
Alerts:	Gentoo 200407-06 2004-07-08 OpenPKG OpenPKG-SA-2004.030 2004-07-06 Mandrake MDKSA-2004:063 2004-06-29 Whitebox WBSA-2004:249-01 2004-06-21 Fedora FEDORA-2004-176 2004-06-18 Fedora FEDORA-2004-174 2004-06-18 Fedora FEDORA-2004-175 2004-06-18 Fedora FEDORA-2004-173 2004-06-18 Red Hat RHSA-2004:249-01 2004-06-18 Conectiva CLA-2003:564 2003-01-23 Mandrake MDKSA-2003:008 2003-01-20 OpenPKG OpenPKG-SA-2003.001 2003-01-15 Yellow Dog YDU-20030114-2 2002-01-14 SuSE SuSE-SA:2003:0004 2003-01-14 Red Hat RHSA-2003:006-06 2003-01-09 Debian DSA-213-1 2002-12-19

Comments (none posted)

mikmod: buffer overflow

Package(s):	mikmod	CVE #(s):	CAN-2003-0427
Created:	June 16, 2003	Updated:	June 16, 2005
Description:	Ingo Saitz discovered a bug in mikmod whereby a long filename inside an archive file can overflow a buffer when the archive is being read by mikmod.
Alerts:	Fedora FEDORA-2005-405 2005-06-16 Red Hat RHSA-2005:506-01 2005-06-13 Fedora FEDORA-2005-404 2005-06-09 Gentoo 200307-01 2003-07-02 Debian DSA-320-1 2003-06-13

Comments (none posted)

minimalist: unsanitized input

Package(s):	minimalist	CVE #(s):	CAN-2003-0902
Created:	November 17, 2003	Updated:	November 19, 2003
Description:	A security-related problem has been discovered in minimalist, a mailing list manager, which allows a remote attacker to execute arbitrary commands.
Alerts:	Debian DSA-402-1 2003-11-17

Comments (none posted)

mpg123: heap overflow

Package(s):	mpg123	CVE #(s):	CAN-2003-0865
Created:	November 12, 2003	Updated:	February 19, 2004
Description:	Versions of mpg123 through 0.59s contain a heap overflow which may be exploited remotely (by a hostile server). See this advisory for details.
Alerts:	SCO Group CSSA-2004-002.0 2004-02-19 Debian DSA-435-1 2004-02-06 Conectiva CLA-2003:781 2003-11-12

Comments (none posted)

mplayer: remotely exploitable buffer overflow vulnerability

Package(s):	mplayer	CVE #(s):	CAN-2003-0835
Created:	September 29, 2003	Updated:	April 6, 2004
Description:	A remotely exploitable buffer overflow vulnerability was found in MPlayer. A malicious host can craft a harmful ASX header, and trick MPlayer into executing arbitrary code upon parsing that header. Read the full advisory for details.
Alerts:	Mandrake MDKSA-2004:026 2004-04-05 Gentoo 200403-13 2004-03-31 Conectiva CLA-2003:760 2003-10-06 Mandrake MDKSA-2003:097 2003-09-30 Gentoo 200309-15 2003-09-27

Comments (none posted)

Nessus NASL scripting engine security issues

Package(s):	nessus	CVE #(s):
Created:	May 27, 2003	Updated:	August 12, 2004
Description:	Some some vulnerabilities exsist in the Nessus NASL scripting engine. To exploit these flaws, an attacker would need to have a valid Nessus account as well as the ability to upload arbitrary Nessus plugins in the Nessus server (this option is disabled by default) or he/she would need to trick a user somehow into running a specially crafted nasl script. Read the full advisory for additional information.
Alerts:	Gentoo 200305-10 2003-05-27

Comments (none posted)

nfs-utils xlog() off-by-one bug

Package(s):	nfs-utils	CVE #(s):	CAN-2003-0252
Created:	July 14, 2003	Updated:	March 8, 2004
Description:	Linux NFS utils package contains remotely exploitable off-by-one bug. A local or remote attacker could exploit this vulnerability by sending specially crafted request to rpc.mountd daemon. See this BugTraq post for more details.
Alerts:	Trustix TSLSA-2004-0009 2004-03-05 SCO Group CSSA-2003-037.0 2003-11-17 Conectiva CLA-2003:700 2003-07-22 Mandrake MDKSA-2003:076 2003-07-21 Gentoo 200307-07 2003-07-19 Yellow Dog YDU-20030718-1 2003-07-18 Slackware SSA:2003-195-01b 2003-07-15 Immunix IMNX-2003-7+-018-01 2003-07-14 SuSE SuSE-SA:2003:031 2003-07-15 Slackware SSA:2003-195-01 2003-07-14 Debian DSA-349-1 2003-07-14 Red Hat RHSA-2003:206-01 2003-07-14

Comments (none posted)

openssh: timing attack leads to information disclosure

Package(s):	openssh	CVE #(s):	CAN-2003-0190
Created:	May 2, 2003	Updated:	November 30, 2004
Description:	From the advisory: "During a pen-test we stumbled across a nasty bug in OpenSSH-portable with PAM support enabled (via the --with-pam configure script switch). This bug allows a remote attacker to identify valid users on vulnerable systems, through a simple timing attack. The vulnerability is easy to exploit and may have high severity, if combined with poor password policies and other security problems that allow local privilege escalation."
Alerts:	Ubuntu USN-34-1 2004-11-30 OpenPKG OpenPKG-SA-2003.035 2003-08-06 Red Hat RHSA-2003:222-01 2003-07-29 Gentoo 200305-02 2003-05-13 Gentoo 200305-01 2002-03-05

Comments (1 posted)

postfix: denial of service vulnerabilities

Package(s):	postfix	CVE #(s):	CAN-2003-0468 CAN-2003-0540
Created:	August 5, 2003	Updated:	May 27, 2004
Description:	The postfix MTA, versions through 1.1.12 (but not 2.0) is subject to two remotely exploitable denial of service vulnerabilities; see this advisory from Michal Zalewski for details.
Alerts:	Mandrake MDKA-2004:028 2004-05-26 Trustix 2003-0029 2003-08-04 Mandrake MDKSA-2003:081 2003-08-04 EnGarde ESA-20030804-019 2003-08-04 Conectiva CLA-2003:717 2003-08-04 SuSE SuSE-SA:2003:033 2003-08-04 Red Hat RHSA-2003:251-01 2003-08-04 Debian DSA-363-1 2003-08-03

Comments (none posted)

proftpd: remote root shell

Package(s):	proftpd	CVE #(s):	CAN-2003-0831
Created:	September 24, 2003	Updated:	January 2, 2004
Description:	The ASCII translation mechanism in ProFTPD 1.2.8 contains a vulnerability which will provide a remote attacker with a root shell - if the attacker is able to download a specially-crafted file. See this ISS advisory for more information.
Alerts:	Mandrake MDKSA-2003:095-1 2003-12-31 Conectiva CLA-2003:750 2003-09-29 Gentoo 200309-16 2003-09-28 Trustix 2003-0037 2003-09-27 Mandrake MDKSA-2003:095 2003-09-26 OpenPKG OpenPKG-SA-2003.043 2003-09-25 Slackware SSA:2003-259-02 2003-09-23

Comments (2 posted)

pstack: Buffer overflow

Package(s):	pstack	CVE #(s):
Created:	November 13, 2003	Updated:	November 19, 2003
Description:	pstack dumps a stack trace for a process, given the pid of that process. Versions prior to 1.2.3 contain a potential buffer overflow vulnerability.
Alerts:	Fedora FEDORA-2003-010 2003-11-12

Comments (none posted)

Multiple-use vulnerability in Safe.pm

Package(s):	Safe.pm	CVE #(s):	CAN-2002-1323
Created:	October 9, 2002	Updated:	February 20, 2004
Description:	usePerl has a description of a vulnerability in the Safe.pm Perl module. It seems that if a Safe compartment is used more than once, it ceases to be safe. The problem is fixed in Safe 2.08.
Alerts:	SCO Group CSSA-2004-007.0 2004-02-20 Gentoo 200212-6 2002-12-20 Trustix 2002-0087 2002-12-19 OpenPKG OpenPKG-SA-2002.014 2002-12-16 Debian DSA-208-1 2002-12-12

Comments (none posted)

sane-backends: several vulnerabilities

Package(s):	sane-backends	CVE #(s):	CAN-2003-0773 CAN-2003-0774 CAN-2003-0775 CAN-2003-0776 CAN-2003-0777 CAN-2003-0778
Created:	September 11, 2003	Updated:	February 20, 2004
Description:	Alexander Hvostov, Julien Blache and Aurelien Jarno discovered several security-related problems in the sane-backends package, which contains an API library for scanners including a scanning daemon (in the package libsane) that can be remotely exploited. These problems allow a remote attacker to cause a segfault fault and/or consume arbitrary amounts of memory. The attack is successful, even if the attacker's computer isn't listed in saned.conf. You are only vulnerable if you actually run saned e.g. in xinetd or inetd. If the entries in the configuration file of xinetd or inetd respectively are commented out or do not exist, you are safe. Try "telnet localhost 6566" on the server that may run saned. If you get "connection refused" saned is not running and you are safe. The Common Vulnerabilities and Exposures project identifies the following problems: CAN-2003-0773: saned checks the identity (IP address) of the remote host only after the first communication took place (SANE_NET_INIT). So everyone can send that RPC, even if the remote host is not allowed to scan (not listed in saned.conf). CAN-2003-0774: saned lacks error checking nearly everywhere in the code. So connection drops are detected very late. If the drop of the connection isn't detected, the access to the internal wire buffer leaves the limits of the allocated memory. So random memory "after" the wire buffer is read which will be followed by a segmentation fault. CAN-2003-0775: If saned expects strings, it mallocs the memory necessary to store the complete string after it receives the size of the string. If the connection was dropped before transmitting the size, malloc will reserve an arbitrary size of memory. Depending on that size and the amount of memory available either malloc fails (->saned quits nicely) or a huge amount of memory is allocated. Swapping and OOM measures may occur depending on the kernel. CAN-2003-0776: saned doesn't check the validity of the RPC numbers it gets before getting the parameters. CAN-2003-0777: If debug messages are enabled and a connection is dropped, non-null-terminated strings may be printed and segmentation faults may occur. CAN-2003-0778: It's possible to allocate an arbitrary amount of memory on the server running saned even if the connection isn't dropped. At the moment this can not easily be fixed according to the author. Better limit the total amount of memory saned may use (ulimit).
Alerts:	SCO Group CSSA-2004-005.0 2004-02-19 SuSE SuSE-SA:2003:046 2003-11-18 Conectiva CLA-2003:769 2003-10-22 Mandrake MDKSA-2003:099 2003-10-09 Red Hat RHSA-2003:278-01 2003-10-07 Debian DSA-379-1 2003-09-11

Comments (none posted)

sendmail: remotely exploitable buffer overflow

Package(s):	sendmail	CVE #(s):	CAN-2003-0694 CAN-2003-0681
Created:	September 17, 2003	Updated:	November 18, 2003
Description:	Michal Zalewski has reported a buffer overflow in sendmail. This overflow, apparently, may be exploited remotely, but only in certain (non-default) configurations. Sendmail 8.12.10 has the fix.
Alerts:	SCO Group CSSA-2003-036.0 2003-11-17 SuSE SuSE-SA:2003:040 2003-09-20 OpenPKG OpenPKG-SA-2003.041 2003-09-19 Conectiva CLA-2003:742 2003-09-18 Yellow Dog YDU-20030917-2 2003-09-17 Immunix IMNX-2003-7+-021-01 2003-09-17 Mandrake MDKSA-2003:092 2003-09-17 Debian DSA-384-1 2003-09-17 Red Hat RHSA-2003:283-01 2003-09-17 Slackware SSA:2003-260-02 2003-09-17 Gentoo 200309-13 2003-09-17

Comments (none posted)

stunnel: signal handler reentrancy DoS

Package(s):	stunnel	CVE #(s):	CAN-2002-1563
Created:	July 25, 2003	Updated:	November 25, 2003
Description:	Stunnel is a wrapper for network connections. It can be used to tunnel an unencrypted network connection over a secure connection (encrypted using SSL or TLS) or to provide a secure means of connecting to services that do not natively support encryption. When configured to listen for incoming connections (instead of being invoked by xinetd), stunnel can be configured to either start a thread or a child process to handle each new connection. If Stunnel is configured to start a new child process to handle each connection, it will receive a SIGCHLD signal when that child exits. Stunnel versions prior to 4.04 would perform tasks in the SIGCHLD signal handler which, if interrupted by another SIGCHLD signal, could be unsafe. This could lead to a denial of service.
Alerts:	Red Hat RHSA-2003:296-01 2003-11-24 SCO Group CSSA-2003-026.0 2003-10-03 Conectiva CLA-2003:736 2003-09-05 Trustix 2003-0030 2003-08-07 EnGarde ESA-20030806-020 2003-08-06 Red Hat RHSA-2003:221-01 2003-07-25

Comments (none posted)

File overwrite vulnerability in tar and unzip

Package(s):	tar unzip	CVE #(s):	CAN-2001-1267 CAN-2001-1268 CAN-2001-1269 CAN-2002-0399
Created:	October 1, 2002	Updated:	April 10, 2006
Description:	The tar utility does not properly filter file names containing "../", meaning that a hostile archive can, if unpacked by an unsuspecting user, overwrite any file that is writable by that user. GNU tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42 has the same vulnerability.
Alerts:	Fedora-Legacy FLSA:183571-1 2006-04-04 Red Hat RHSA-2006:0195-01 2006-02-21 Conectiva CLA-2002:538 2002-10-29 Mandrake MDKSA-2002:066 2002-10-10 Mandrake MDKSA-2002:065 2002-10-10 EnGarde ESA-20021003-022 2002-10-03 Gentoo unzip-20021001 2002-10-01 Gentoo tar-20021001 2002-10-01 Red Hat RHSA-2002:096-24 2002-09-18

Comments (1 posted)

Multiple vendor telnetd vulnerability

Package(s):	telnet Telnet netkit-telnet-ssl kerberos telnetd netkit-telnet nkitb/nkitserv/telnetd krb5	CVE #(s):
Created:	May 21, 2002	Updated:	October 5, 2004
Description:	This vulnerability, originally thought to be confined to BSD-derived systems, was first covered in the July 26th Security Summary. It is now known that Linux telnet daemons are vulnerable as well.
Alerts:	Gentoo 200410-03 2004-10-05 Yellow Dog YDU-20010810-2 2001-08-10 Yellow Dog YDU-20010810-1 2001-08-10 SuSE SuSE-SA:2001:029 2001-09-03 Slackware sl-997726350 2001-08-09 Red Hat RHSA-2001:100-02 2001-08-09 Red Hat RHSA-2001:099-09 2002-02-07 Red Hat RHSA-2001:099-06 2001-08-09 Progeny PROGENY-SA-2001-27 2001-08-14 Mandrake MDKSA-2001:093 2001-12-17 Mandrake MDKSA-2001:068 2001-08-13 HP HPSBTL0202-023 2002-02-12 Debian DSA-075-2 2001-08-14 Debian DSA-075-1 2001-08-14 Conectiva CLA-2001:413 2001-08-24 SCO Group CSSA-2001-030.0 2001-08-10

Comments (none posted)

vim - modeline vulnerability

Package(s):	vim	CVE #(s):	CAN-2002-1377
Created:	January 16, 2003	Updated:	February 10, 2004
Description:	VIM allows a user to set the modeline differently for each edited text file by placing special comments in the files. Georgi Guninski found that these comments can be carefully crafted in order to call external programs. This could allow an attacker to create a text file such that when it is opened arbitrary commands are executed.
Alerts:	Conectiva CLA-2004:812 2004-02-10 Mandrake MDKSA-2003:012 2003-02-03 Yellow Dog YDU-20030127-3 2003-01-27 Gentoo 200301-13 2003-01-22 OpenPKG OpenPKG-SA-2003.003 2003-01-21 Red Hat RHSA-2002:297-17 2003-01-15

Comments (4 posted)

webmin: session ID spoofing

Package(s):	webmin	CVE #(s):	CAN-2003-0101
Created:	June 13, 2003	Updated:	November 18, 2003
Description:	miniserv.pl in the webmin package does not properly handle metacharacters, such as line feeds and carriage returns, in Base64-encoded strings used in Basic authentication. This vulnerability allows remote attackers to spoof a session ID, and thereby gain root privileges.
Alerts:	SCO Group CSSA-2003-035.0 2003-11-17 Debian DSA-319-1 2003-06-12

Comments (none posted)

wget: buffer overflow

Package(s):	wget	CVE #(s):	CAN-2003-1565
Created:	August 5, 2003	Updated:	December 10, 2003
Description:	The wget utility contains a buffer overflow which, when exploited with an over-long URL, can enable arbitrary code execution.
Alerts:	Red Hat RHSA-2003:372-01 2003-12-10 SCO Group CSSA-2003-025.0 2003-10-03 Conectiva CLA-2003:716 2003-08-04

Comments (1 posted)

XFree86 4.3.0 integer overflows in font libraries

Package(s):	XFree86	CVE #(s):	CAN-2003-0730
Created:	September 12, 2003	Updated:	November 25, 2003
Description:	Several vulnerabilities were discovered by blexim(at)hush.com in the font libraries of XFree86 version 4.3.0 and earlier. These bugs could potentially lead to execution of arbitrary code or a DoS by a remote user in any way that calls these functions, which are related to the transfer and enumeration of fonts from font servers to clients. See the advisory for additional details.
Alerts:	Red Hat RHSA-2003:286-01 2003-11-25 Red Hat RHSA-2003:287-01 2003-11-25 Red Hat RHSA-2003:288-01 2003-11-17 Debian DSA-380-1 2003-09-12 Mandrake MDKSA-2003:089 2003-09-11

Comments (none posted)

zebra: denial of service vulnerability

Package(s):	zebra	CVE #(s):	CAN-2003-0795 CAN-2003-0858
Created:	November 13, 2003	Updated:	January 7, 2004
Description:	Zebra an open source implementation of TCP/IP routing software. Jonny Robertson reported that Zebra can be remotely crashed if a Zebra password has been enabled and a remote attacker can connect to the Zebra telnet management port. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0795 to this issue. Herbert Xu reported that Zebra can accept spoofed messages sent on the kernel netlink interface by other users on the local machine. This could lead to a local denial of service attack. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0858 to this issue.
Alerts:	Debian DSA-415-1 2004-01-06 OpenPKG OpenPKG-SA-2003.049 2003-11-25 Conectiva CLA-2003:786 2003-11-20 Red Hat RHSA-2003:307-01 2003-11-13

Comments (none posted)

Resources

Quarterly CERT Summary

The quarterly CERT Summary - which describes the security issues being most actively exploited - is out. Of the nine vulnerabilities, six affect only Windows systems. The summary does, however, point out ongoing problems with OpenSSL, OpenSSH, and sendmail.

Full Story (comments: none)

Page editor: Jonathan Corbet

Kernel development

Brief items

Kernel release status

The current development kernel is 2.6.0-test10, finally released by Linus on November 23. This patch contains a month's worth of accumulated fixes for serious bugs, and not a whole lot else. Linus notes that there is still a problem associated with preemption out there; the kernel preemption code itself is likely not at fault, but some subsystem or driver out there somewhere is not being entirely preempt-safe. That problem had not been tracked down as of this writing.

The long-format changelog contains the details for the patches incorporated in this release.

Incidentally, -test10 has been dubbed the "stoned beaver" release.

Linus also laid out his thinking for the future:

Linus's BitKeeper tree holds a small number of additional fixes.

The current stable kernel is 2.4.22, but its time is coming to an end. Marcelo released 2.4.23-rc3 on November 21, with the idea that it would become the final release. Reality dictated otherwise, with the result that 2.4.23-rc4 came out on the 24th, and 2.4.23-rc5 on the 25th. The idea, of course, is that this one will become the final release; stay tuned.

Comments (none posted)

Kernel development news

BSD security levels for Linux

The Linux Security Module (LSM) patch was intended to enable the creation of a wide variety of security regimes for Linux systems. So far, the main user of the LSM functionality has been the NSA SELinux module. But there are signs that other security-oriented developers are beginning to make use of LSM to implement different approaches.

The latest such is the BSD Secure Levels patch posted by Michael Halcrow. This patch is intended to create something resembling BSD's secure level capability for Linux. Thus it implements an integer security level, which has useful values of zero to two. At level zero, the system functions as always - as if the module were not present at all. Zero is the default level, but the level can be raised (but not lowered) by writing the new value to /proc/seclvl.

At level one, a number of actions become disallowed, including:

• Tracing the init process.
• Modifying an immutable file.
• Anything involving raw I/O to a device.
• Network administration tasks.
• Changing the user ID of a process.
• Loading or unloading modules.
• Writing directly to a mounted block device.
• Writing to /dev/mem or /dev/kmem.
• Changing the setuid or setgid bits of a file.

At security level two, a few additional actions are prohibited:

• Changing the system time - but only if you are trying to set it backward.
• Writing to any block device, whether mounted or not.
• Unmounting a filesystem.

The "secure level" patch is thus a way of raising the bar for any potential attacker. At the higher levels, even a process with root privileges cannot make certain kinds of changes to the system. Normally, higher levels are forever; the only way to lower the secure level is to reboot the system. Note, however, that this module allows the administrator to include a small back door by specifying an executable that, when run, causes the secure level to be reset to zero. This feature may be useful for administrators who are converting a system over to secure level operation. Leaving the "emergency reset" option enabled permanently would be dangerously counterproductive, however.

Comments (4 posted)

Review: Linux Kernel Development

Writing books about the Linux kernel is hard. The subject matter is vast, complex, and highly technical. It also is very much a moving target; today's kernel book becomes obsolete in a short period of time. So kernel authors have to pick their subject matter carefully, time things well, and enjoy their fifteen minutes of fame before somebody merges a patch and their words begin the inevitable slide into obsolescence.

The latest kernel book to hit the shelves is Linux Kernel Development by Robert Love. The goal of this book is perhaps best expressed by Andrew Morton in the foreword. He notes that kernel development has become increasingly complex as the kernel grows and scales to larger systems. That complexity increases the functionality and performance of the kernel, but it comes with a cost: the kernel is harder to understand than it once was.

The purpose of this book is to help developers get to where they can make a contribution.

Linux Kernel Development covers a lot of ground. There are chapters on process management and scheduling, how system calls work, interrupt handling (but not device drivers in general), delayed work mechanisms, locking and mutual exclusion, timers, memory management, filesystems and the block layer, the page cache, kernel debugging, and more. This book, however, is just over 300 pages long, so it necessarily does not cover any of these topics in any great depth. Thus, for example, you will see what each of the inode_operations methods is, but there is little information on how to write one. Linux Kernel Development is a starting point which will prove useful to any developer trying to get up to speed with one or more kernel subsystems. Completing that process, however, will still require setting down the book and diving into the source.

That said, this book is truly a good starting point. After having perused the text on a particular subsystem, the reader will have enough background to be able to make sense of the source much more quickly than before. The presentation is clear, the writing is enjoyable to read^*, and the information is accurate and useful. Linux Kernel Development belongs on the shelf of any developer who is interested in kernel work.

One small complaint that one might make is that it is hard to figure out just which version of the kernel this book covers. The fine print on the back notes that it covers 2.6. Of course, the book was published in September, and now, at the end of November, the 2.6 kernel has not yet been released, so that statement is not entirely accurate. A suitably attentive reader can find places where the current kernel diverges from the text of this book - the listing of struct inode lacks the i_cdev field, for example. Kernel books will always tend to be like that, however; they are only completely accurate when they are out of date. Mr. Love appears to have timed things pretty well with this one; the differences between the text and the current development kernel are minimal - so far. For the time being, Linux Kernel Development is the best description of the structure and API of the 2.6 kernel available.

[Disclaimer: your reviewer is the co-author of a Linux Kernel book which could be seen as competing with Linux Kernel Development, though he sees the two as being entirely complementary. Buy Both.]

---

^*Though sprinkled with rather more footnotes that your reviewer might have preferred...

Comments (5 posted)

A last-chance kernel message dumper

If you have spent enough time working with development kernels, you may well have experienced the joy of a system panic which brings the system to a complete halt. Depending on the nature of the problem, you may find that the only information on what has happened is to be found on the system console. At that point, you may be reduced to trying to transcribe an oops listing by hand - if you are lucky. It may be that the information you really need has scrolled off the screen and is no longer available.

A useful tool for situations like this is kmsgdump; a version for 2.6.0-test9 has just been announced. This patch, which includes a scary amount of assembly code, does nothing until the system panics. At that point it jumps in and dumps the kernel message buffer to a diskette or parallel port. Later, when your system is running again, you can look over the output at leisure - or forward it on to somebody who knows how to interpret it. No more pen and paper required.

Comments (3 posted)

Driver porting

Driver porting series update complete

The promised update of the LWN.net Driver Porting Series is now complete; all of the articles should be current with the 2.6.0-test10 kernel. This series now consists of 37 articles covering changes in almost every kernel interface of interest to driver programmers. More content may be added in the future, but, with luck, another massive updating (for 2.6, anyway) won't be necessary.

Comments (2 posted)

Patches and updates

Kernel trees

• Linus Torvalds: Linux 2.6.0-test10. (November 24, 2003)

• Andrew Morton: 2.6.0-test9-mm5. (November 22, 2003)

• Martin J. Bligh: 2.6.0-test9-mjb3. (November 22, 2003)

• Marcelo Tosatti: Linux 2.4.23-rc3. (November 21, 2003)

• Marcelo Tosatti: Linux 2.4.23-rc4. (November 24, 2003)

• Marcelo Tosatti: Linux 2.4.23-rc5. (November 25, 2003)

Core kernel code

• Nick Piggin: generalise scheduling classes. (November 23, 2003)

• Pavel Machek: FYI: My current suspend bigdiff. (November 24, 2003)

• Michal Wronski: 1/2 POSIX message queues. (November 25, 2003)

• Michal Wronski: 2/2 POSIX message queues. (November 25, 2003)

• Frederic Rossi: AEM v0.5.1, linux-2.6.0-test9. (November 25, 2003)

Development tools

• Randy.Dunlap: kmsgdump update: 2.6.0-test9. (November 22, 2003)

• cliff white: Announce: Kernel Tinderbox (OSDL). (November 25, 2003)

Device drivers

• Zinx Verituse: cuecat serio driver for linux 2.6.0-test9. (November 20, 2003)

• Len Brown: ACPI 2.6. (November 20, 2003)

• Jeff Garzik: 2.6.x experimental net driver queue. (November 23, 2003)

• Jeff Garzik: libata bug fix update. (November 24, 2003)

• Kannanthanam, Boji T: Announce: "iswraid" (ICH5R) ataraid sub-driver for 2.4.22. (November 25, 2003)

• James Bottomley: final SCSI updates (hopefully) for 2.6.0. (November 25, 2003)

• Takashi Iwai: ALSA 1.0.0pre3 release. (November 25, 2003)

Memory management

• Matthew Dobson: Make balance_dirty_pages zone aware (1/2). (November 22, 2003)

• Matthew Dobson: Make balance_dirty_pages zone aware (2/2). (November 22, 2003)

• Matthew Dobson: Simplify node/zone portion of page->flags. (November 22, 2003)

Architecture-specific

• Mikael Pettersson: perfctr-2.6.2 released. (November 23, 2003)

Security-related

• Michael A. Halcrow: BSD Secure Levels LSM. (November 24, 2003)

Benchmarks and bugs

• cliff white: Graphical reaim comparisons. (November 21, 2003)

Miscellaneous

• Greg KH: udev 007 release. (November 24, 2003)

Page editor: Jonathan Corbet

Distributions

News and Editorials

Interview with Andreas Typaldos, Xandros CEO

Two weeks ago, Xandros Corporation announced the release of Xandros Desktop OS 2.0, which will be available for purchase beginning December 9. We have taken this opportunity to ask the recently appointed CEO of Xandros Corporation Andreas Typaldos about the product features, plans for the future and other topics of interest.

Mr. Typaldos, thank you very much for your time. You have been with Xandros Corporation for less than a month. What are your first impressions? What motivated you to take up the challenge?

Let's talk about your upcoming 2.0 release. Your announcement has given us a preview of what to expect, such as your new drag and drop CD burning ability integrated into the Xandros File Manager and improved compatibility with Windows. Anything else we can look forward to?

A question about Xandros Networks. If I understand it correctly, this will be a repository of software, free or otherwise, available for a single-click installation, similar to Lindows.com's Click-N-Run. Do you mind revealing what applications can we expect to find there? Anything unique or worth paying for?

Besides the upcoming Xandros Desktop OS 2.0, will we see any other products in the near future? Just after your 1.0 release, there has been talk about Xandros Server, but this idea seems to have been dropped since. Or is it still on the cards?

It would appear that Xandros Desktop OS is a distribution designed predominantly for home users. Are there any plans to conquer the corporate desktop?

How is Xandros Corporation doing financially?

Excellent as Xandros 1.x was, it hasn't reached its potential in terms of market penetration. We haven't seen much marketing and advertising from Xandros. Is this going to change or do you believe that the "word of mouth" strategy works well enough?

The xandros.com website has some brief information about OEM deals and high-profile industry partnerships. Can you tell us more?

This is a subject often brought up by users on public forums: does Xandros contribute back to the Linux community? After all, much of what constitutes Xandros Desktop OS is free software developed by enthusiasts and packaged by Debian developers, so it's only fair that some of Xandros' work go back to the community for the benefit of the rest of us. Does Xandros do that? Does your company sponsor any open source projects?

Do you personally use Xandros Desktop as your primary operating system?

How would you answer this question from a Windows user who has just walked up to you: "I use Windows on my computer. Why should I spend $40 or $90 to switch to Xandros Desktop?"

Mr. Typaldos, thank you very much for your answers and all the best with your new job!

Comments (18 posted)

Distribution News

Debian GNU/Linux

The Debian Project has sent out an alert to the effect that several of its systems have been broken into. These include systems running the bug tracking system, mailing lists, web servers, CVS server, and some archives. The project claims that the Debian archive itself has not been affected, but some (in particular the security archive) are undergoing close inspection before being returned to the net. Everything should be back by the time you read this, however this page has been set up to provide status reports and other pertinent information. Wichert Akkerman has also provided this overview of the progress so far.

The Debian Project has released the anticipated 'woody' upgrade, officially named Debian GNU/Linux 3.0r2. This release contains many security fixes and other revisions that maintainers of stable 'woody' systems should have.

Debian Planet reports progress on the Debian GNU/NetBSD port, using the GNU C library as a base instead of NetBSD's libc.

Comments (none posted)

Gentoo Weekly Newsletter - Volume 2, Issue 47

The Gentoo Weekly Newsletter for the week of November 24, 2003 is available. Gentoo Managers' Meeting Summary - 17 November 2003 and the Gentoo Desktop update are among this week's topics.

Full Story (comments: none)

Mandrake Linux

The Mandrake Linux Community Newsletter for November 24 is out; it looks at the release of 9.2 ISO images, the LG drive problem, some new tutorials, and more.

The Multi Network Firewall 8.2 had a version of freeswan bundled with the latest kernel update which did not match the installed freeswan package, making freeswan unusable. This update brings the freeswan package up to date with the kernel version.

Comments (none posted)

Slackware Linux

The latest changes to slackware-current include an upgrade to mysql-4.0.16 and some KDE fixes among other things.

Comments (none posted)

SUSE Linux

SUSE has announced the availability of the download version of SUSE Linux 9.0. As usual, some non-free programs are missing, and it is not possible to download (or create) installation CD images.

SUSE also announced the release of Service Pack 3 for SUSE LINUX Enterprise Server 8.

Comments (none posted)

Using and Customizing Knoppix (O'ReillyNet)

Here's an O'ReillyNet article celebrating the joys of using and configuring Knoppix. "Klaus Knopper created Knoppix. Though this distribution is rather young, it stands out for its hardware detection and autoconfiguration abilities. The packages and OS structure are based on the Debian distribution, but the hardware-discovery process uses kudzu, Redhat's hardware probing utility."

Comments (2 posted)

New Distributions

Firenet mini linux

Firenet mini linux contains busybox and a Linux kernel. No other binary files are included. It supports inetd, telnetd, httpd, devfsd, networking, dhcpd, and more. The system uses busybox's init and implements a Debian-style SysV-init boot script, which is helpful when adding a new system service. The system is also a good example of using busybox in an embedded system. The initial public release of Firenet, version 0.1, was released November 23, 2003.

Comments (none posted)

Minor distribution updates

Devil-Linux v1.0.2b is available

Version 1.0.2b of Devil-Linux is available, with a bunch of bug fixes and added support for older computers which require ISAPNP support. Click below for more information.

Full Story (comments: none)

Fedora Core 1 Update

This update (redhat-config-packages-1.2.7-1) fixes problems with trying to use RedHat/RPMS instead of Fedora/RPMS on Fedora Core CDs with redhat-config-packages.

Full Story (comments: none)

LEAF Bering-uClibc 2.0

LEAF (Linux Embedded Appliance Firewall) has announced the release of Bering-uClibc 2.0. This version uses the Bering releases of LEAF, compiled with uClibc 0.9.20. Click below for more information.

Full Story (comments: none)

MoviX

MoviX has released v0.8.1pre5 with minor feature enhancements. "Changes: Supervesafb and NVidiaTV bugs have been fixed, remote support has been added to slideshows, GIF and PhotoCD are now displayable by slideshows, the switch to the MPlayer menu has been improved, and support for serial Hauppauge remotes has been added."

Comments (none posted)

Puppy Linux

Puppy live-CD version 0.7.8 has been released. The ISO is now 41M, and has the "kitchen sink" in it, including Mozilla web browser and Scribus desktop publishing. Click below to see the release notes.

Full Story (comments: none)

RxLinux

RxLinux has released v1.5.0 with major feature enhancements. "Changes: A package editor has been added to the rxmaster ("Edit packages"). Packages can now be copied from the site-wide repository to the group or host packages repository. Files inside packages can be modified using the rsmaster Web interface. A wait loop at boot time has been added to give time to auto negotiating switches. sz, rz, and rsync are included in the base system."

Comments (none posted)

SENTINIX

Sentinix 0.70.5 (beta 2) has been released. Click below for more information.

Full Story (comments: none)

SmoothWall

SmoothWall has released v2.0RC1 with minor bugfixes. "Changes: This is the first release candidate for SmoothWall Express 2.0. ipac was replaced with RRDtool. Custom DynDNS was fixed. Some changes were made to the Web UI. The updates list location has changed. More bugs were corrected."

Comments (none posted)

Snootix

Snootix has released v0.5-pre1 with major bugfixes. "Changes: This release should build an LFS system without trouble. If it builds LFS on three systems other than the author's, it will be moved to the default (stable) branch."

Comments (none posted)

Page editor: Rebecca Sobol

Development

The MlView XML editor for GNOME

The MLView project is putting together an XML editor for the GNOME desktop environment.

A typical set of editor features are included, some of these are copy/paste, drag/drop, support for multiple document views, and graphical error reporting. Some XML specific features include an xml element/attributes search, tree-based element addition, support for namespaces, input validation, and auto-completion. The editor works with, and without an XML DTD.

Features on the to-be-added list include an Undo operation, network support, views other than the XML tree view, and better documentation. Volunteer help is being requested.

To see MlView in action, take a look at the screenshots page.

GnomeDesktop.org has a look at the recently released MlView version 0.6.1. "A lot of features have been added in the release as a new tree editor, or some beautification and a lot of bugfixes."

See the release notes for more information on the new release.

Comments (none posted)

System Applications

Audio Projects

Ogg Vorbis 1.0.1 has been released

Version 1.0.1 of the Ogg Vorbis audio compression software is out. "It took longer than expected, but Vorbis 1.0.1 has finally been released. This release also coincides with the first beta of Icecast 2 and a Speex 1.0.3 bugfix release. Read all about these new releases, Xiph.org's trip to California, and more in this new edition of Ogg Traffic."

A new version of Icecast, an Ogg-Vorbis streaming audio system, is also available.

Comments (none posted)

Speex 1.0.3 and 1.1.2 Released

New stable and unstable versions of Speex, a voice codec application, are out. The changes note for the stable version says: "In this bugfix release: a fix for a multithreading bug and a correction for an underflow problem that could slow decoding dramatically on x86 processors."

Comments (none posted)

CORBA

omniORB 4.0.3 and omniORBpy 2.3 released

New releases of omniORB and omniORBpy are available. These are bug-fix releases.

Comments (none posted)

Database Software

PgManage now Open Source

The PgManage project has been switched to the Open Software License. "PgManage, the graphical interface to the Mammoth PostgreSQL product line is now Open Source."

Full Story (comments: none)

PostGIS 0.8.0 Released

Version 0.8.0 of PostGIS, a package that adds geographic object support to PostgreSQL, is available. "Refractions Research is pleased to announce the release of PostGIS 0.8.0, the first version of PostGIS to support all the functions in the OpenGIS "Simple Features for SQL" specification."

Full Story (comments: none)

PostgreSQL Weekly News

The PostgreSQL Weekly News for November 24, 2003 is online. "Most of the action (or reaction) last week centered around the release of PostgreSQL 7.4. This release had some international coordination and saw news articles in several different countries; I've supplied several links to articles below, and a few links to more links regarding the release."

Full Story (comments: none)

Filesystem Utilities

ntfsprogs 1.8.0 released (SourceForge)

Version 1.8.0 of ntfsprogs, a set of NTFS utilities, is out. "Finally a stable release after a huge long wait. Lots of new utilities and the ntfs gnomevfs module."

Comments (none posted)

Libraries

Barbecue 1.0.6 Final released (SourceForge)

SourceForge has an announcement for version 1.0.6 final of Barbecue. "All existing users of previous versions are strongly encouraged to upgrade. Barbecue is a Java barcode solution that provides Java GUI components for creating barcodes that can be printed and displayed on screen, and used in servlets."

Comments (none posted)

QuantLib 0.3.4 released (SourceForge)

Version 0.3.4 of QuantLib, a cross-platform C++ library for quantitative finance, has been announced. "To celebrate the third anniversary of the QuantLib project, version 0.3.4 of the library has been released. Monte Carlo valuation of barrier and binary options has been added. More option pricers have been ported to the new Pricing Engine framework."

Comments (none posted)

Mail Software

Working with Bayesian Categorizers (O'Reilly)

Jon Udell explains Bayesian Categorizers on O'Reilly. "Months ago I wrote about how SpamBayes has solved my spam problem more effectively than I thought a pure content-based filter could. Time was the ultimate test, though. Would this razor lose its edge? It hasn't. Every day I sharpen it."

Comments (none posted)

Networking Tools

Net-SNMP 5.1 released (SourceForge)

Version 5.1 of Net-SNMP, a set of tools and libraries for working with the Simple Network Management Protocol, has been released. "This release contains a bunch of new features and optimizations, most of which are outlined below."

Comments (none posted)

Package Management

Red Carpet 2.2 and Open Carpet 0.1 released (GnomeDesktop)

New versions of the Red Carpet and Open Carpet package maintenance tools have been announced on GnomeDesktop.org. "These new versions of rcd, rug, and red-carpet allow you to now use any number of Red Carpet services, including ones set up by third-parties using the Open Carpet tools. This opens up the Red Carpet system to a very large body of software provided by the open source community that isn't shipped with Ximian products or your standard Linux distribution."

Comments (none posted)

Printing

CUPS 1.1.20 released

After a series of beta releases, version 1.1.20 of CUPS, the Common Unix Print System, is out. The release notes detail the changes.

Comments (none posted)

Foomatic 3.0.1rc1 released

Version 3.0.1rc1 of the Foomatic printer database has been released. "Compared to Foomatic 3.0.0 CUPS raster drivers can now be used with every spooler, many bug fixes were done, the multi-platform compatibility was improved, the compatibility of the PPDs with Windows clients is much better now, and several features were added."

Comments (none posted)

Web Site Development

Gallery v1.4.1 Release Candidate 4 Available (SourceForge)

Release Candidate 4 of Gallery, a web-based photo gallery system, has been announced. "This release has several critical changes to RC3. New features for this 1.4.1 include voting/ranking of images, user self-registration, lost password reset, e-mail notifications, support for "skins" to customize Gallery's look and feel, a clearer and easier to follow Config. Wizard and tons of other small improvements and bugfixes."

Comments (none posted)

Two Servlet Filters Every Web Application Should Have (O'Reilly)

Jayson Falkner explains servlet filters on O'Reilly. "Almost every single web application you will ever make will seriously benefit from using servlet filters to both cache and compress content. A caching filter optimizes the time it takes to send back a response from your web server, and a compression filter optimizes the size of the content that you send from your web server to a user via the Internet. Since generating content and sending content over the World Wide Web are the bread and butter of web applications, it should be no surprise that simple components that aid in these processes are incredibly useful."

Comments (none posted)

Tiki 1.8 -Polaris- RC2 released (SourceForge)

Version 1.8 RC2 of Tiki, a CMS/Groupware package, has been released. "This second candidate is mostly a developers release with full adodb support, and many new features essentially for testing their ability to be stable in final 1.8. Many bugs have been fixed and some new features found their way into RC2. So we have a new search engine and the tiki-integrator and many more."

Comments (none posted)

UnCommon Web 0.0 released

The initial release of UnCommon Web is available. "UnCommon Web is a web application development framework written in Common Lisp. Among its features are continuation-based page flow control, component-oriented user interface generation, programmer and designer-friendly HTML generation, backends for mod_lisp and Portable AllegroServe."

Full Story (comments: none)

Desktop Applications

Audio Applications

ecasound 2.3.1 released

Version 2.3.1 of ecasound, an audio recording and playing utility, is available. "Ecasound's emacs mode, ecasound.el, has been updated to version 0.8.3. Due to severe bugs found in the native Python ECI implementation, the C implementation has been again set as the default. Minor interoperability problems with older JACK releases and Ecasound have been fixed. A bug that caused builds against an external libreadline to fail, has been fixed. Also recording problems with the WinTv 401Dbx and other bt878-based devices have been fixed. This release is compatible with the upcoming alsa-lib-1.0 releases."

Full Story (comments: none)

Rhythmbox 0.6.1: ''Squish, Click, Squish, Squish, Click'' (GnomeDesktop)

Version 0.6.1 of Rhythmbox, a music player, has been announced. "Maybe you'll like the MP4 support, or maybe various crasher fixes will tickle your fancy; but rest assured, there's something for everybody in this release."

Comments (none posted)

Vstserver 0.2.8 and Ladspavst 0.1.5 released

Two Linux audio applications, Vstserver and Ladspavst, have had new releases. "These updates makes it possible to use windows vst plugins in linux applications getting very descent realtime performance."

Full Story (comments: none)

Desktop Environments

Expocity - efficient application switching (GnomeDesktop)

GnomeDesktop.org looks at Expocity: "expocity is an effort to integrate an efficient means of switching between applications into the window manager metacity. After pressing a keystroke, your window manager will present you a complete overview of all open windows and you can select the window, you want to switch to, visually."

Comments (none posted)

The GNOME Summary is back

The GNOME Summary traditionally comes out every week, but we've not seen an issue since last July. The Summary has restarted, however, with this issue, covering November 16 through 22. Topics covered include a patch to find out how much memory an application is using in the X server, various new application releases, the first "desktop integration bounty hunt," and more.

Comments (none posted)

KDE-CVS-Digest

The November 21, 2003 edition of the KDE-CVS-Digest is available. "Read about KJSEmbed and what it is good for. Image handling speedups in Khtml. Start of Oo table import support in KWord. Plus a continued focus on bugfixes."

Comments (none posted)

XFree86 4.4.0 Release Schedule

A release plan for the 4.4.0 version of the XFree86 window system has been published. The code is scheduled for freezing on November 28, and version 4.4.0 is scheduled for release on December 15.

Comments (none posted)

Desktop Publishing

Passepartout 0.3 is available

Version 0.3 of Passepartout, a desktop publishing system, is available. See the release notes for a list of changes.

Comments (none posted)

Electronics

New gnucap development snapshot

A new development snapshot of gnucap, an electronic circuit analysis application, has been announced.

Comments (none posted)

XCircuit 3.1.28 released

Version 3.1.28 of XCircuit, an electronic schematic drawing package, is out. Change information is in the source code.

Comments (none posted)

Financial Applications

ASPL Fact & AF Architecture version ML4 released (GnomeDesktop)

GnomeDesktop.org has an announcement for new versions of ASPL Fact and AF Architecture. "ASPL Fact is a new invoicing system for GNU/Linux (although it should compile and work on every platform where glib is available). It's based on AF Architecture, and it's licensed under the GNU/General Public License. The main new feature in this development milestone is the independent definition of the AF Architecture: a modular n-tier component architecture specifically designed for business-managing application design."

Comments (none posted)

Graphics

GIMP 1.3.23 Released (GnomeDesktop)

Version 1.3.23 of the Gimp has been announced. "This release fixes numerous bugs. It also gives the libgimp APIs as well as the user interface some final polishing." Many other changes are included.

Comments (none posted)

JSynoptic v0.4 released (SourceForge)

Version 0.4 of JSynoptic, a Java-based graph plotter and complex run-time monitoring environment, is available. "Version 0.4 brings in more plot types and features, usability improvements, and a look and feel plugin."

Comments (none posted)

GUI Packages

New FLTK Software

New software for FLTK, the Fast, Light ToolKit, includes version 1.2.2 of Gled, an automatic GUI generator, and version 181103 of Table, a table widget.

Comments (none posted)

Instant Messaging

French Language Version of ChatZilla 0.9.48 (MozillaZine)

A French version of the Chatzilla IRC client has been announced.

Comments (none posted)

Gaim v0.73 is out (GnomeDesktop)

GnomeDesktop.org has the announcement for Gaim 0.73, an instant messaging client. "The latest version of the Gaim IM client is out featuring a new logging format, spell checker fixes, translation updates and more."

Comments (none posted)

Interoperability

Wine Traffic

The November 21, 2003 issue of Wine Traffic is online with the latest Wine project news.

Comments (none posted)

Wine-20031118 released

Release 20031118 of Wine has been announced. Changes include printing improvements, run-time detection of NPTL threading code merges from Crossover Office 2.1, reorganization of the source tree, and bug fixes.

Comments (none posted)

Multimedia

Azureus 2.0.4.2 released (SourceForge)

Version 2.0.4.2 of Azureus, a Java-based BitTorrent client, has been released. "Version 2.0.4.2 brings mostly bugfixes to the recently-released, and greatly-enhanced 2.0.4.0 core. The multiplatform Azureus client greatly extends the original python clients feature set, with: managing multiple downloads at once from a single GUI window, detailed real-time download statistics with export to XML, auto-seeding and download queuing rules, initial configuration and torrent creation wizards, embedded tracker for easy hosting of your own torrents, PeerGuardian IP address filtering, optional web browser and command line interfaces, 19 available languages, plugins, and much much more."

Comments (none posted)

Music Applications

RTMix 0.75 released

Version 0.75 of RTMix is available. "RTMix is an interactive multimedia art performance, composition, and coaching interface capable of triggering various DSP applications and/or processes concurrently, as well as offering a tight coordination between computer(s) and live performers."

Full Story (comments: none)

Web Browsers

Independent Status Reports (MozillaZine)

The Mozilla Independent Status Reports for November 24, 2003 are online. "The latest set of status reports include updates from MozManual, Mozquery, Deepest Sender, Mycroft, Preferential, MessageID-Finder, ieview, Searchsidebar, ConQuery, HON and the Creating Applications with Mozilla book. These reports are presented in an improved format."

Comments (none posted)

Minutes of the mozilla.org Staff Meeting (MozillaZine)

The minutes from the November 17, 2003 Mozilla.org staff meeting are online. "Issues discussed include releases, localised builds, the new website, Mozilla Thunderbird tinderboxes and CVS over SSH."

Comments (none posted)

Word Processors

AbiWord Weekly News

Issue #171 of the AbiWord Weekly News is out with this week's round-up of AbiWord word processor news.

Comments (none posted)

Miscellaneous

BloGTK 0.8-5 Released (GnomeDesktop)

GnomeDesktop.org has the announcement for version 0.8-5 of BloGTK, a weblog client. "BloGTK 0.8-5 is now released for immediate download. The new release adds support for basic HTTP proxies for those using BloGTK behind a corporate or school firewall - making BloGTK the first Linux blog client to offer proxy support."

Comments (none posted)

Languages and Tools

Caml

Caml Weekly News

The November 18-25, 2003 edition of the Caml Weekly News has been published. Take a look for the latest Caml news.

Full Story (comments: none)

Java

Best Practices for Exception Handling (O'ReillyNet)

O'Reilly has published an article on Java exception handling. "Java's concept of exceptions and how they're used has led to controversy and, in some cases, bad programming practices. Gunjan Doshi seeks to lay down some best practices for using exceptions in Java."

Comments (none posted)

Perl

This Week on perl5-porters (use Perl)

The November 17-23, 2003 edition of This Week on perl5-porters has been published. "Due to my laziness, or perhaps to the lack of traffic on perl5-porters this week, this summary will be rather short, but hopefully long enough to provide your weekly dose of perl core information."

Comments (none posted)

Perl Slurp-Eaze (O'Reilly)

Uri Guttman explains Perl file slurping techniques on O'Reilly. "Slurping files has advantages and limitations, and is not something you should just do when line by line processing is fine. It is best when you need the entire file in memory for processing all at once. Slurping with in memory processing can be faster and lead to simpler code than line by line if done properly."

Comments (none posted)

PHP

PHP Weekly Summary for November 24, 2003

The PHP Weekly Summary for November 24, 2003 is out. Topics include: PHP Benchmarks (continued), SimpleXML XPath, Win32Std extension, Windows snapshots, E_STRICT, check_syntax and strip_whitespace.

Comments (none posted)

Python

Dr. Dobb's Python-URL!

The November 24, 2003 edition of Dr. Dobb's Python-URL has been published. Take a look for a week's worth of new Python articles.

Full Story (comments: none)

Ruby

The Ruby Garden

The Ruby Garden features new discussions on resume after raise and Interface Checking.

Comments (none posted)

Tcl/Tk

Dr. Dobb's Tcl-URL!

The November 24, 2003 edition of Dr. Dobb's Tcl-URL is out with the latest Tcl/Tk article links.

Full Story (comments: none)

XML

Introductory Tour of Mozilla's XUL

Nigel McFarlane introduces Mozilla's XUL on Informit.com. "XUL is an XML-based technology for expressing the GUI part of a software application. It has been used to express GUIs for applications as diverse as web browsers, email clients, calendars, calculators, spreadsheet editors, HTML editors, debuggers, and whole desktop environments. The free Mozilla platform—that is, the executable engine and libraries that accompany every Mozilla-based product—provides a fully-featured implementation of XUL. This article is a quick look at the main tags that Mozilla's XUL provides."

Comments (none posted)

Binary Killed the XML Star? (O'Reilly)

Kendall Grant Clark covers the W3C's binary XML workshop on O'Reilly. "There are at least two kinds of topics of permanent conversation in the XML development community: formally settled, and formally unsettled. In other words, members of the XML development community are perpetually discussing, on the one hand, issues which have been, more or less, formally settled by the relevant standards body and, on the other, issues not yet formally settled by the relevant standards body. As the canonical example of the first kind of permathread I tend to think of XML namespaces, which really are just here to stay, plain and simple. As the canonical example of the second kind, I tend to think of binary XML, which may or may not be blessed by the W3C, but which certainly engages the XML developer community in deep and fundamental ways."

Comments (none posted)

SVG and XForms: Rendering Custom Content

Antoine Quint introduces the SVG 1.2 XML-based extension mechanism on IBM's developerWorks. "The first Scalable Vector Graphics specification (SVG 1.0) laid the standard for XML-expressed two-dimensional interactive and animated graphics. Since then, the W3C SVG Working Group has made efforts to take SVG a step further with a strong focus on enhancing features that ease the work of using SVG for Web and desktop application development. One of the most promising features introduced in SVG 1.2 is Rendering Custom Content (RCC) -- it offers a clean XML-centric extension mechanism to mix and match different XML namespaces within an SVG document. This article takes you through the creation of a simple push-button widget while introducing the RCC mechanism."

Comments (none posted)

Cross Assemblers

gputils-0.11.8 Released

Version 0.11.8 of gputils, the GNU PIC Utilities for working with Microchip's PIC processors, is out. Changes include: "Fixed bugs."

Comments (none posted)

Editors

Bluefish 0.12 released

Version 0.12 of Bluefish, an html editor, has been announced. "Bluefish 0.12 features project management, a better user interface (for example a reworked menu, and improved keyboard navigation), support for remote files using gnome-vfs, a nicer user interface (many new icons and buttons, and general user interface cleanups), many bug fixes and much more."

See this article on GnomeDesktop.org for more information.

Comments (none posted)

Leo 4.1 beta 3 released (SourceForge)

Version 4.1 beta 3 of Leo, a programmer's editor and browser, has been released. "This is the third official release of the reorganized 4.1 code base. The code appears solid, and has not been widely tested. Please use caution when using this code."

Comments (none posted)

Mozedit 0.1.1 Final Released (MozillaZine)

Version 0.1.1 final of Mozedit, a text editor extension for Mozilla Firebird and the Mozilla suite, has been announced. "Significant features aimed at web development have been added. The extension is now compatible with both Mozilla and Firebird and an optional Emacs mode is available."

Comments (none posted)

IDEs

GtkADA 2.2.1, GNAT Programming System 1.4.0 Released (GnomeDesktop)

Version 2.2.1 of GtkAda, an ADA GUI Toolkit for GTK+, and GPS 1.4.0, a multi-language IDE, have been announced.

Comments (1 posted)

Page editor: Forrest Cook

Linux in the news

Recommended Reading

What Does 2004 Hold in Store for Linux? (LinuxWorld)

LinuxWorld asks others to predict what 2004 holds for Linux and has responses from Eric Raymond and John Terpstra. "I predict that during 2004 at least one significant USA government body will adopt Linux on the desktop. This adoption will make head-lines and will radically change the face of the Linux battle. We will see a number of government bodies adopt Linux, and by September 2004 there will be a rush of announcements of software applications finally being ported to Linux. At least two major accounting packages will announce support for Linux. PS: I could name one, but that would spoil the fun!" (John Terpstra)

Comments (5 posted)

Major vendors to push Linux to the desktop (InfoWorld)

InfoWorld says 2004 may be the year of the Linux desktop. "Sources said that once the acquisition [of SUSE] is finalized early next year, [Novell] will tightly stitch the Ximian Desktop with an enhanced version of SuSE 9.0, which would enable smooth connections to Novell's GroupWise collaboration server, ZENworks resource manager, and security and integration products. The company also claimed that it will more than double the number of engineers working on the Ximian Desktop and will focus on improving the Gnome desktop environment, the OpenOffice suite, and Mozilla browser."

Comments (13 posted)

Linus & the Lunatics, Part I (Linux Journal)

Doc Searls and Linux Journal present the first of three transcriptions of talks by Linus and friends during the latest Linux Lunacy Geek Cruise. "I am firmly convinced that if your source control doesn't support random people making their own branches, and then being able to merge as they do development with anybody else's branch, the source control is not worth bothering with. And if BitKeeper ever goes away, I will not go to Subversion or something like that. I will go back to tarballs and patches. Because at least that one doesn't have merge problems that most other projects have. Which is kind of strange, but.... It has been very productive. It has helped enormously having something that is truly distributed. But I did want to mention that."

Comments (10 posted)

Trade Shows and Conferences

Linux Lunacy 2003: Cruising the Big Picture, Part III (Linux Journal)

Linux Journal has posted part 3 of Doc Searls' "Linux Lunacy" travelogue. "Several microseconds after Linux Journal announced the itinerary for this cruise, we heard from VLUG, the Victoria Linux Users Group. We harvested the fruits of their labors as soon as we got off the boat in Victoria, British Columbia. Our visit to Victoria was about the shortest of the trip, as we arrived not long before sundown. But it also was one of the most fun, both for VLUG and for the lunatics on the cruise."

Comments (none posted)

Report: KDE at Comdex

Here's a report from the KDE booth at Comdex. "Among the visitors to the KDE booth were CIOs, CEOs, VPs and Presidents of major companies and smaller businesses, students, hobbyists, journalists, and professionals. I was stunned to see executives from Fortune 500 companies coming by for a demo of KDE, saying that it was their favorite desktop and that they hope that we continue to do such a good job so they can adopt KDE for desktop deployments in the future. I was most, and least, surprised by one class of visitor though. We had regular visits from Microsoft employees! They wanted demos of KDE, to see how it works and what we have. What an interesting situation. I soon discovered that this was not the only place that Microsoft people were doing investigations."

Comments (5 posted)

The SCO Problem

Did SCO Really Reveal the Code to IBM, as Darl Claims? (Groklaw)

Groklaw has reverse engineered the process by which the SCO Group came up with its list of files for the IBM case. "Essentially, that SCO searched for any reference in the Linux kernel source for SMP, JFS, RCU, and NUMA, and claimed all of those files as possibly infringing. They included the entire JFS source code, but, perhaps realizing that it would look really bad to claim a file that implicated SCO or Caldera by showing the names of their employees, removed those files."

Comments (11 posted)

A Heads Up to the Media (Groklaw)

Groklaw fills out recent reporting on a couple of SCO events. "Guess how many people went to hear Darl McBride's keynote address at CDXPO? No, really. Guess. According to Todd Weiss of ComputerWorld, there were only 80 people. Count them. 80." The article also looks at the "death threats" issue and comes to the same conclusion we had: just more SCO nonsense.

Comments (3 posted)

Interviews

Linux veteran tries again (News.com)

News.com talks with Ransom Love, former CEO of the company now called The SCO Group. "It's so ironic, the turn of events. (Caldera began discussing) what we can do through UnitedLinux to indemnify people who had used both Unix and Linux. Apparently Darl took that in a little different direction than we intended."

Comments (13 posted)

Interview with Sun Java Desktop Group (OSNews)

OSNews has an interview with the Sun Java Desktop Group. "[T]he Java Desktop System is envisioned as a set of applications that reside above the OS layer. While the first version of JDS is built on top of SuSE Linux Desktop 1.0, that does not mean that in the future there will not be versions of JDS running on other OSes (for instance, Solaris, Red Hat, etc are all possibilities). Therefore JDS 2003 -is- a version of SuSE. However, what we have done is add a desktop layer to the SuSE distribution which is uniquely Sun's desktop. If ported to Solaris, for instance, these same application versions and UI would still be available."

Comments (13 posted)

Interview with GNUstep Developer Nicola Pero (GNU-Friends)

GNU-Friends talks with Nicola Pero about the GNUstep project. "I still feel a big missing gap in the free software product set -- or in the available software in general -- which is that the "definitive" development environment is still missing. Producing such a definitive product is a great challenge. By "definitive" development environment I mean the "dream" development environment -- which would be based on some sort of simple and excellent compiled OO language with introspection and dynamical capabilities, and consist of a set of carefully designed libraries, build system and tools. All this available cross-platform." (Thanks to Ciaran O'Riordan)

Comments (none posted)

Interview with freedesktop.org Members (OSNews)

OSNews interviews the main members of freedesktop.org: founder Havoc Pennington, Keith Packard, Jim Gettys, Waldo Bastian and David Zeuthen. "David Zeuthen: First of all it might be good to give an overview of the direction HAL ("Hardware Abstraction Layer") is going post the 0.1 release since a few key things have changed. One major change is that HAL will not (initially at least, if ever) go into device configuration such as mounting a disk or loading a kernel driver."

Comments (3 posted)

Reviews

Dropline GNOME review (Linux Universe)

Linux Universe reviews Dropline GNOME 2.4.x, a desktop replacement for the standard Slackware environment. "Aside from these improvements, Dropline developers focus on desktop applications and their integration with Gnome 2.4. - currently at Gnome 2.4.1. The application suite added to the desktop is the real reason for deploying Dropline Gnome. Dropline supplies many packages that do not come with Slackware and these packages are well integrated with the desktop." (Found on Footnotes)

Comments (none posted)

Introduction to Mozilla Firebird Series continues (Nidelven-IT)

Kay Frode adds two more articles in the introductory series on the Mozilla Firebird browser. Part 8 covers Bookmarks and Part 9 looks at Flash player plug-ins.

Comments (none posted)

Page editor: Forrest Cook

Announcements

Non-Commercial announcements

FSF on Microsoft Vouchers

The Free Software Foundation has sent out a notice concerning purchasers of Microsoft software. "Under the terms of a settlement, reached in California's antitrust and unfair competition class action lawsuit against Microsoft, the company is required to provide vouchers totaling up to $1.1 billion to eligible California users of its Windows, MS-DOS, Office, Excel, Word, Works Suite or Home Essentials 97 or 98 products. These vouchers can be redeemed for cash as reimbursement for the purchase of other qualifying computer hardware or software. They can also be donated to non-profit organizations (even those outside of California) for their use in purchasing software or hardware."

Full Story (comments: none)

Commercial announcements

Lindows.com announces a 30,000 system deployment

Lindows.com has announced a large desktop Linux deployment in Canada. "Lindows.com, in conjunction with the South West Shore Development Authority (SWSDA), is moving throughout Nova Scotia and other provinces to bring LindowsOS to the greater Canada area. It is expected that more than 30,000 LindowsOS machines will be deployed within one year of the initial deployments."

Comments (17 posted)

PostgreSQL Replication Released

Command Prompt, Inc. has announced the availability of their Mammoth PostgreSQL Replicator. "Mammoth PostgreSQL Replicator is an asynchronous replication system designed to be WAN and faulty connection tolerant. It uses a distributed TransactionLog system to keep track of updates produced by the Master database. The system allows for multiple Slaves to receive updates in either a continuous or batch mode."

Full Story (comments: none)

New Books

"Digital Photography Pocket Guide, Second Edition" Released by O'Reilly

O'Reilly has published the second edition of their Digital Photography Pocket Guide.

Full Story (comments: none)

"Apache Cookbook" Released by O'Reilly

O'Reilly has published the Apache Cookbook.

Full Story (comments: none)

"SQL Tuning" Released by O'Reilly

O'Reilly has published the book "SQL Tuning", by Dan Tow. "There are two basic issues that most people focus on when tuning SQL: how to find and interpret the execution plan of an SQL statement and how to change SQL to get a specific alternate execution plan. Tow provides the answers to these questions in "SQL Tuning" and addresses a third, even more critical question: How do you decide which execution plan a query should use?"

Full Story (comments: none)

Resources

Intro slides from Brooklyn GNOME Summit (GnomeDesktop)

GnomeDesktop.org has announced the availability of the slides from the 2003 Brooklyn GNOME Summit.

Comments (none posted)

CE Linux Forum Publishes Baseline Source Tree

The Consumer Electronics Linux Forum (CELF) has announced the release of its baseline Linux source code, now available for download and review.

Comments (8 posted)

Introduction to Mozilla Manual Available in Draft Form (MozillaZine)

MozillaZine has an announcement for a new Mozilla introductory document. "This document provides an introduction to the most useful features and capabilities of Mozilla (1.5) for people who have never used it before. The author is currently seeking review and comment with a goal of completing the document by year-end."

Comments (none posted)

Contests and Awards

Desktop Integration Bounty Hunt (GnomeDesktop)

The GNOME Foundation has announced the first open source desktop integration bounty hunt. "The aim of the contest is to recruit new developers and to more tightly integrate the various projects that make up the desktop into a more coherent, and complete user experience. The contest consists of a number of small, concrete projects, each of which has a cash bounty associated with it. Complete the hack, enter the contest, and collect a prize."

Comments (none posted)

KDevelop voted 'Best IDE' (KDE.News)

KDE.News mentions that KDevelop won an award. "We're pleased to announce that KDevelop took first place in the fourth annual Linux New Media Awards with 29.4% of the votes in the category of best IDE development system; second and third places went to Eclipse and Anjuta respectively."

Comments (none posted)

Upcoming Events

Italian Linux Day 2003

The 2003 Italian Linux Day will happen on November 29. Events aimed at the promotion of Linux and free software will be happening in 81 different cities; click below for the full announcement (in Italian).

Full Story (comments: none)

Linux Financial Summit to Explore Real World Linux Solutions for Financial Institutions

Here's a press release from IDG World Expo saying that the Linux Financial Summit, which debuted at LinuxWorld Expo last January, will return to the 2004 LinuxWorld Conference & Expo in New York City.

Comments (none posted)

Open Source Working Group – UK think-tank meeting (LinuxMedNews)

LinuxMedNews has an announcement for the Open Steps meeting. "The Open Steps meeting, to be held near Winchester, UK, on 10-11 February 2004 is the first of a series of three meetings planned for 2004 as part of the activities of the IMIA Open Source and Open Source Nursing Informatics Working Groups. The purpose of the meeting is to identify key issues, opportunities, obstacles, areas of work and research that may be needed, and other relevant aspects, around the potential for using open source software, solutions and approaches within health care, and in particular within health informatics, in the UK and Europe."

Comments (none posted)

Events: November 26, 2003 - January 22, 2004

Date	Event	Location
November 26, 2003	Open Standards and Libre Software in Government Conference (CANCELLED)(EGOVOS 3)	Paris, France
November 26 - 27, 2003	Forum PHP Paris 2003	(Club Confair)Paris, France
December 1 - 4, 2003	IEEE International Conference on Cluster Computing(Cluster2003)	(Sheraton Hong Kong Hotel & Towers)Kowloon, Hong Kong
December 2 - 4, 2003	Linux Bangalore/2003	Bangalore, India
December 9 - 13, 2003	International Conference on Logic Programming(ICLP'03)	Mumbai (Bombay), India
January 12 - 13, 2004	Linux.Conf.au Miniconfs	Adelaide, Australia
January 12 - 13, 2004	EducationaLinux 2004	Adelaide, Australia
January 14 - 17, 2004	Linux.conf.au	Adelaide, Australia
January 20 - 23, 2004	LinuxWorld Conference & Expo 2004	(Jacob K. Javits Convention Center)New York, New York

Comments (none posted)

Web sites

Open XUL Alliance Launches Wiki Wiki (MozillaZine)

The Open XUL Alliance has announced a new Wiki site. "The Open XUL Alliance is a site about XUL and related XML-based declarative user interface languages."

Comments (none posted)

Software announcements

This week's software announcements

Here are the software announcements, courtesy of Freshmeat.net. They are available in two formats:

• Sorted alphabetically,
• Sorted by license.

Comments (none posted)

Page editor: Forrest Cook