LWN.net Weekly Edition for December 18, 2003

Looking forward to Fedora Core 2

Commercial Linux distributions have provided much of the driving force behind the increasing adoption of free software. These distributions tend to be high-quality products, and most Linux users end up running one of them. One disadvantage of commercial distributions, however, has typically been the relatively closed nature of their development process. It is hard to know where a distribution is going until the next release arrives; consider how surprised many Red Hat users were when the expected Red Hat Linux 8.1 release turned into Red Hat Linux 9 with a number of disruptive changes. This situation is not unique to Red Hat; of the commercial distributions, only Mandrake has really gone out of its way to open up its development process to its users.

The evolution of Red Hat Linux into Fedora has changed things. Red Hat may still guide Fedora with a firm hand, but the process is now being carried out in a relatively open manner, with input from the wider community. As a result, it is possible to develop a reasonable idea of what will appear in the Fedora Core 2 (FC2) release, which is now scheduled for April 5, 2004.

From the beginning, FC2 was destined to be based on the 2.6 kernel. It will thus likely be the first big-name distribution to be truly committed to 2.6, rather than just offering it as an option. There may be a backup 2.4 kernel available for systems that simply can't run 2.6, but its use will probably be rare.

FC2 is not stopping at adopting 2.6, however; this distribution will also be set up to use the NSA Security Enhanced Linux (SELinux) subsystem. SELinux is packaged with 2.6 (as a Linux security module), but actually making use of it is not just a matter of turning it on. SELinux is based on a complex, rule-based mandatory access control mechanism which requires that a whole set of rules and policies be created. To this end, Red Hat has hired Russell Coker, who got his start in this area doing SELinux work for Debian. Russell's SELinux work will show up in FC2, and, after the Fedora users have shaken out the bulk of the problems, in the Enterprise Linux Advanced Server products.

FC2 will also include full IPSec support, given that the requisite protocol support exists in 2.6. Not everybody is happy with the choice of IPSec-Tools for configuration and management, however.

A big issue on the fedora-devel list was whether GNOME 2.6 would make it into FC2. Nobody spoke against the idea, but Fedora leader Michael Johnson did point out one issue with GNOME and Fedora: how their respective schedules work together. GNOME tries to make releases every six months, while Fedora is trying to go a little faster than that. The result is that, sooner or later, Fedora will miss a major GNOME release and spend a few cycles catching up. Recent discussions suggest, however, that GNOME 2.6 will be in FC2. The FC2 release schedule should allow the developers plenty of time to incorporate the imminent KDE 3.2 release as well.

Web browsers are a topic of conversation. It may be hard to remember that, only a few years ago, the only real browser alternative for Linux was the proprietary Netscape 4.x release - and we were glad to have it. There are now so many browsers available for Linux there there is no real hope of including them all. For FC2, it looks like the choices may be Konqueror, Epiphany, and Mozilla. In the future, when Mozilla Firebird stabilizes somewhat, it may replace Mozilla "classic" in Fedora.

There have been a fair number of requests to drop sendmail in favor of a more secure mail transfer agent. Postfix would appear to be the preferred replacement. There does not appear to be a whole lot of desire within Red Hat to change the system's MTA, however, so sendmail looks likely to hang around for a while yet.

One user requested a natively-compiled version of the Eclipse development environment. That wish appears likely to come true; the FC2 schedule states that a number of Java components, compiled with GCJ, are on the list to be incorporated into the distribution.

There is a fair amount of interest in a "bare-bones" installation mode. A minimal install could be used for old and small systems, or as a base platform for a subsequent network install (much as Debian installations can be done). This "bootstrap" install option may well show up in FC2.

Some desired packages will be kept out as a result of licensing issues. Thus valgrind, though often requested, is off the list; it apparently suffers from software patent problems. MySQL 4.x is also an interesting problem; with the 4.x release, the license on the MySQL libraries was changed from the LGPL to the GPL. That change makes it harder to write proprietary applications using the libraries, which can be a concern for distributors (UserLinux is coping with similar issues). The MySQL 4.x library license, however, also blocks the use of MySQL with PHP, which has a GPL-incompatible license. A MySQL/PHP adaptor, as a derived product of both systems, cannot be distributed. So MySQL 3.x will likely be in Fedora Core for a while yet.

The actual Fedora Core 2 release will doubtless contain some surprises. But it will be, by far, the most open release ever to come out of Red Hat. This visibility into the development process will give Fedora users the opportunity to be better prepared for future releases (a good thing, since quick upgrades will be required to keep getting security patches) and to have some influence on how the distribution is developed. It is too soon to say whether Fedora will be a success, but the new approach to its development is already showing some benefits for its users.

Comments (11 posted)

A look at Thunderbird 0.4

Now that Thunderbird has reached its 0.4 milestone, we thought we would take it for a test drive and see how far the new email and newsgroup client has come. The conclusion is that Thunderbird is indeed maturing into quite a nice email client.

Setting up Thunderbird is as simple as uncompressing a tarball in the directory you'd like Thunderbird to live in. Configuring Thunderbird is likewise an easy task, and it only takes a minute or two to have the client up and ready to send and retrieve email from the default account. Like most modern email clients, Thunderbird allows users to set up multiple email accounts if they wish to do so.

One of the more exciting features with Thunderbird is adaptive spam filtering. Users can tag email as "junk" and Thunderbird will try to automatically determine which incoming email is spam in the future. This feature is not on by default, so the user will need to enable the junk folder and features.

Thunderbird's adaptive junk mail controls aren't perfect (yet), but after only using Thunderbird for a little more than a week, I found that it was catching on pretty quickly. Thunderbird didn't tag all of the spam I received as junk, but it didn't tag any of my legitimate email as junk after a few days. While some may be annoyed when they see spam slip through Thunderbird's filter, I'm much happier to know that it does very well at avoiding false positives. There is also a junk mail log, so users can follow which messages have been tagged and moved. I would recommend using the Junk folder rather than deleting messages for at least a few weeks.

As the developers point out in the release notes, the default interface for Thunderbird has matured since the last release, and is looking very nice. If the default theme isn't quite right, Thunderbird allows the user to choose custom themes instead. Right now there are about twenty themes available for Thunderbird. Installation of themes is easy, though it's still necessary to restart the application once you've installed a new theme.

Themes aren't the only thing that's changeable. One of the nicest features of Thunderbird is the ability to add extensions to the application. One of the goals for Thunderbird was to stay "small and unbloated," which is a laudable goal. However, most users will differ on the features which are necessary, and the features that should be considered bloat. Extensions allow users to modify Thunderbird's feature set to their liking; available extensions include a calendar, external application launchers, "splitter grippies," a calculator, an offline operation mode, and numerous others. Installing extensions in Thunderbird is as simple as downloading an extension and running the "Install New Extension" wizard.

By default, (unfortunately) Thunderbird's message composer is set to send mail in HTML format rather than plain text, but this behavior is easy to turn off. If a user prefers to send HTML-formatted email, or if certain recipients prefer to receive HTML-formatted email, Thunderbird allows the user to set specific domains that will receive plain-text or HTML email. However, at this point this feature only works if the user has Thunderbird set to compose HTML email by default. It would be nice if this worked both ways, so a user could send grandma HTML emails by default and avoid getting flamed by accidentally sending HTML email to a mailing list.

Another welcome feature in Thunderbird is customizable message views. Users are able to view messages according to a wide range of criteria, which makes it very easy to sort through your inbox. For example, the user can choose only to view messages with attachments, or only messages sent by people who are in their address book. Thunderbird includes only a few preset filters, but users can create others of their own.

One of the few gripes I have with Thunderbird is that it only allows the user to import mail from Communicator 4.x clients. If the user wishes to switch from Pine, Evolution, Outlook, Eudora, Sylpheed or any number of other mail clients, there is no automated tool with Thunderbird to help with the task. A simple utility to import email stored in mbox format would be a nice addition, and might help Thunderbird add to its user base.

It should also be noted that the application isn't entirely stable. It did crash during testing a few times though it didn't lose any messages or important data. Note that I experienced crashes during testing before installing any extensions, so it wasn't the addition of third-party code that caused the problems. The interface is also a bit slow, even on a fast machine. Often, it takes a few additional seconds for dialog boxes to disappear completely and for new windows to appear. Of course, one does not normally expect perfection from such an early release.

Overall, however, Thunderbird is a well-designed mail client, and is quite usable for an application that is only a 0.4 release. I expect that as Thunderbird matures, the stability will improve even further and that the speed of the interface will also be improved. Thunderbird should be acceptable for daily use for users who are looking for a different mail client. Though I only tested the Linux version of Thunderbird, there are also builds for Windows and Mac OS X for users of those platforms.

Comments (16 posted)

The continuing Linux Gazette saga

We first reported on the dispute over the direction and management of the Linux Gazette back in November. Since then, the Linux Gazette has tended to resemble a forked development project; both LinuxGazette.com (at SSC) and LinuxGazette.net (where the departing editors set up shop) remain online. Both have published an Issue #97 for December. Each maintains its own "Answer Gang." And both claim to be the real Linux Gazette. Behind the scenes, however, things have been happening.

There have been repeated charges that LinuxGazette.com has been censoring its forums to keep them free of criticism of SSC's actions. SSC, it would seem, has dealt with that issue by eliminating the forums altogether. Most of the forum posts will, evidently, be simply deleted.

SSC has sent a letter claiming trademark rights over the name "Linux Gazette" and requesting that ownership of the LinuxGazette.net domain name be forcibly transferred. Over at LinuxGazette.net, they respond that no trademark was ever transferred to SSC when it started running the Linux Gazette, and, in any case, the Linux Gazette is a noncommercial operation. In the U.S., trademarks are for commercial use and cannot be obtained for names which are not used in a commercial setting.

Rick Moen, of LinuxGazette.net, took the time to track down John Fisk, who founded the Linux Gazette back in 1995. In his response, Mr. Fisk betrays a clear desire to not get drawn into the current dispute. He also states, however, that he had no intent to transfer any sort of trademark rights to SSC when he let SSC take over operation of the Linux Gazette.

In other words, the waters have been well and truly muddied. If the rights to use the "Linux Gazette" name end up being the subject of a legal battle, it is hard to predict what the eventual result would be. One can predict, however, that such a fight would not be good for either Linux Gazette, the people who contribute their articles, or the community as a whole.

Comments (12 posted)

It's that time of year

For the sixth year in a row, LWN has put together its annual Linux Timeline. We've gone over the events of the last year, sorted out the most significant happenings and quotes, and put them together in a concise, informative, and (we hope) fun form. Have a look and relive the last year in the Linux world - some of which even doesn't involve SCO.

The next Weekly Edition will be published on December 24, one day earlier than usual, in anticipation of the Christmas holiday. There will be no Weekly Edition the week of January 1; the front page will continue to be updated, however, and we may put up a feature article or two. We will return to our regular schedule on Thursday, January 8.

Comments (2 posted)

Page editor: Jonathan Corbet

Security

Brief items

Spam-proofing the mail system

One of the major problems with Simple Mail Transport Protocol (SMTP) is that it allows email senders to forge information about who they are. The lack of sender authentication allows unscrupulous users to send email that appears to come from a domain other than where it truly originates. Spammers use this 'feature' to disguise their email and to cause any bounces or responses to be handled by someone else.

There are several proposals for combating this problem that are currently being worked on; we will describe some of them below. Before we do, however, a bit of a review on how SMTP currently works is in order.

When a host wants to send mail, it looks at the DNS Mail Exchanger (MX) record for the destination domain and makes a connection to the host that is indicated. The sending host identifies itself, the email address of the sender of the message, and the address of the recipient of the message to the destination host via SMTP messages. This is known as the envelope of the message and, if it is accepted by the destination host, the sender proceeds to send the body of the message. The message body contains RFC822 headers (From:, To:, Subject:, etc.) that are used by Mail User Agents (MUAs) to identify the message to users. SMTP servers traditionally do not do any kind of checking on the envelope data they receive, believing that other hosts will not deceive them. Any part of the envelope and RFC822 headers can be forged (except, of course, the recipient in the envelope). Obviously, SMTP has its roots in a much friendlier Internet where trusting other hosts was the norm.

Recently, Yahoo announced an initiative that is meant to combat spam called Domain Keys. Technical details are somewhat sketchy, but the basic idea is that the DNS records for a domain would include a public key. Email that originates from that domain would use the corresponding private key to encrypt some data (it is not clear exactly what, but a cryptographic hash of the message contents would seem an obvious choice) that would be placed in an email header. Mail Transfer Agents (MTAs) that received the message could decrypt it using the public key in the DNS record and if the decrypted value was correct, the MTA would know that the message originated from the domain that was claimed.

Sender Permitted From (SPF) is a proposal to add information to the DNS records for a domain specifying what machines legitimately send email for that domain. This information is the reverse of the MX record, rather than specifying hosts that receive email for the domain, they specify hosts that send it. This would allow MTAs to check the IP address of the sender and the host name provided in the SMTP envelope along with the SPF information in DNS to determine whether that IP address is a legitimate sender for that domain. (LWN covered SPF in more detail last October).

The Trusted Email Open Standard (TEOS) is a wide-ranging proposal that has three implementation steps and would eventually allow for third-party certification of email messages as coming from a trusted source. This scheme would operate in some ways like the SSL Certificate Signing Authorities; an MTA could verify that a message came from a source trusted by the third party. The first step that TEOS proposes is similar to the Domain Keys proposal; it would provide a way to authenticate email senders. The second stage adds the ability for senders to make assertions about the contents of the email, saying, for example, that it contains advertising or an opt-in mailing, or that the sender and recipient have a business or family relationship. Users would be able to filter the mail based on the assertions (or lack thereof). If the sender incorrectly categorizes a message, the authentication will not allow the blame to be shifted elsewhere, providing a large incentive to be truthful when making the assertions.

The Tripoli proposal envisions an entirely new email infrastructure, at first running in parallel with the current SMTP-based system, but eventually supplanting it. The underlying principle is that the receiver of email should have greater control than any of the other parties involved, including the sender, ISPs that transmit the email, or governments. The system proposed would eventually have end-to-end encryption for all email traffic. Associated with each email would be a cryptographic token that is certified by a third-party to a particular level of authentication; email recipients could then choose the level of authentication that they wish to require and can reject any messages that fall below this standard.

These proposals are a testament to just how problematic and widespread the spam problem has become. The scope of some of these proposals, particularly TEOS and Tripoli, show how far some people are willing to go to try and combat it. Adding third-parties to email sending could have a number of security and privacy concerns and would almost certainly add a cost to sending email. If that cost breaks the current economic model of spamming, however, it may be effective, but it would also impact lots of other bulk email uses today (legitimate mailing list traffic, opt-in newsletters and the like). On the other hand, Domain Keys and SPF could be circumvented by spammers willing to create throwaway domains that conform to the requirements. Once the domains are identified as spam domains, they can be added to blacklists, of course, but there have been any number of problems with that particular solution as well. Authenticating senders might help track down spammers, but until the risk of detection and the cost of conviction are greatly increased, it is likely to only slow things down and perhaps not by much.

It should be interesting to watch the battle over our email inboxes play out over the next few years. It may well be that one or more of these proposals is adopted (or some combination of them) by a significant portion of email users and providers. Unfortunately, in the meantime, less technical email users are suffering at the hands of the spammers to the point where email is no longer a useful communications medium for many.

Comments (22 posted)

New vulnerabilities

lftp buffer overflows

Package(s):	lftp	CVE #(s):	CAN-2003-0963
Created:	December 15, 2003	Updated:	February 13, 2004
Description:	According to this advisory versions of lftp prior to 2.6.10 are vulnerable to two exploitable buffer overflow problems. Both occur when you connect to a web server with lftp using HTTP or HTTPS, and then use lftp's "ls" or "rels" commands on specially prepared directories on the web server.
Alerts:	Whitebox WBSA-2003:404-01 2003-12-17 Conectiva CLA-2004:800 2004-01-06 Debian DSA-406-1 2004-01-05 Gentoo 200312-07 2003-12-16 OpenPKG OpenPKG-SA-2003.053 2003-12-17 Red Hat RHSA-2003:404-01 2003-12-16 Red Hat RHSA-2003:403-01 2003-12-16 Mandrake MDKSA-2003:116 2003-12-15 Fedora FEDORA-2003-034 2003-12-15 SuSE SuSE-SA:2003:051 2003-12-15 Immunix IMNX-2003-73-002-01 2003-12-09 Slackware SSA:2003-346-01 2003-12-12

Comments (none posted)

xchat: remotely exploitable denial of service vulnerability

Package(s):	xchat	CVE #(s):
Created:	December 15, 2003	Updated:	December 17, 2003
Description:	There is a remotely exploitable bug in xchat 2.0.6 that could lead to a denial of service attack. This is caused by sending a malformed DCC packet to xchat 2.0.6, causing it to crash. Versions prior to 2.0.6 do not appear to be affected by this bug. For more information, please see this advisory.
Alerts:	Gentoo 200312-06 2003-12-14

Comments (none posted)

Updated vulnerabilities

2.4 kernel - several vulnerabilities

Package(s):	2.4 kernel	CVE #(s):	CAN-2003-0461 CAN-2003-0462 CAN-2003-0464 CAN-2003-0476 CAN-2003-0501 CAN-2003-0550 CAN-2003-0551 CAN-2003-0552
Created:	July 21, 2003	Updated:	December 24, 2003
Description:	Several security issues have been discovered affecting the Linux kernel: CAN-2003-0461: /proc/tty/driver/serial reveals the exact character counts for serial links. This could be used by a local attacker to infer password lengths and inter-keystroke timings during password entry. CAN-2003-0462: Paul Starzetz discovered a file read race condition existing in the execve() system call, which could cause a local crash. CAN-2003-0464: A recent change in the RPC code set the reuse flag on newly-created sockets. Olaf Kirch noticed that his could allow normal users to bind to UDP ports used for services such as nfsd. CAN-2003-0476: The execve system call in Linux 2.4.x records the file descriptor of the executable process in the file table of the calling process, allowing local users to gain read access to restricted file descriptors. CAN-2003-0501: The /proc filesystem in Linux allows local users to obtain sensitive information by opening various entries in /proc/self before executing a setuid program. This causes the program to fail to change the ownership and permissions of already opened entries. CAN-2003-0550: The STP protocol is known to have no security, which could allow attackers to alter the bridge topology. STP is now turned off by default. CAN-2003-0551: STP input processing was lax in its length checking, which could lead to a denial of service. CAN-2003-0552: Jerry Kreuscher discovered that the Forwarding table could be spoofed by sending forged packets with bogus source addresses the same as the local host.
Alerts:	Red Hat RHSA-2003:408-00 2003-12-19 Gentoo 200308-01 2003-08-14 Debian DSA-358-4 2003-08-13 SuSE SuSE-SA:2003:034 2003-08-12 Debian DSA-358-2 2003-08-05 Debian DSA-358-3 2003-08-04 Debian DSA-358-1 2003-07-31 EnGarde ESA-20032407-018 2003-07-24 Red Hat RHSA-2003:238-01 2003-07-21

Comments (none posted)

apache: buffer overflows in mod_alias, mod_rewrite

Package(s):	apache	CVE #(s):	CAN-2003-0542 CAN-2003-0789
Created:	October 28, 2003	Updated:	February 13, 2004
Description:	André Malo discovered buffer overflows in the mod_alias and mod_rewrite modules of the Apache webserver. These occurred if a regular expression with more than 9 capturing parenthesis was configured. To exploit this, an attacker would need to be able to locally create a carefully crafted configuration file (.htaccess or httpd.conf). CAN-2003-0542 Another buffer overflow in Apache 2.0.47 and earlier in mod_cgid's mishandling of CGI redirect paths could result in CGI output going to the wrong client when a threaded MPM is used. CAN-2003-0789.
Alerts:	Whitebox WBSA-2004:015-01 2004-02-12 Fedora FEDORA-2003-004 2004-01-08 Red Hat RHSA-2003:405-00 2003-12-18 Red Hat RHSA-2003:320-01 2003-12-16 Red Hat RHSA-2003:360-01 2003-12-10 Gentoo 200310-03 2003-10-28 Trustix 2003-0041 2003-11-15 Conectiva CLA-2003:775 2003-11-05 Slackware SSA:2003-308-01 2003-11-03 EnGarde ESA-20031105-030 2003-11-05 Mandrake MDKSA-2003:103 2003-11-03 Gentoo 200310-04 2003-10-31 Immunix IMNX-2003-7+-025-01 2003-10-28 OpenPKG OpenPKG-SA-2003.046 2003-10-28

Comments (none posted)

apache2: Denial of Service vulnerability

Package(s):	apache2	CVE #(s):
Created:	September 29, 2003	Updated:	March 25, 2004
Description:	A problem was discovered in Apache2 where CGI scripts that write more than 4k to the standard error stream will hang the script's execution. This problem can lead to a denial of service situation. See this bug report for additional details.
Alerts:	Gentoo 200403-04 2004-03-22 Netwosix NW-2004-0006 2004-03-25 Mandrake MDKSA-2003:096-1 2003-10-24 Mandrake MDKSA-2003:096 2003-09-26

Comments (none posted)

bind: cache poisoning

Package(s):	bind	CVE #(s):	CAN-2003-0914
Created:	November 26, 2003	Updated:	February 19, 2004
Description:	A cache poisoning vulnerability in BIND may be exploited causing a temporary denial of service until the bad record expires from the cache.
Alerts:	SCO Group CSSA-2004-003.0 2004-02-19 Debian DSA-409-1 2004-01-05 SuSE SuSE-SA:2003:047 2003-11-28 Trustix 2003-0044 2003-11-27 Immunix IMNX-2003-7+-024-01 2003-10-27 EnGarde ESA-20031126-031 2003-11-26

Comments (none posted)

CUPS: denial of service

Package(s):	CUPS	CVE #(s):	CAN-2003-0788
Created:	November 3, 2003	Updated:	March 4, 2004
Description:	Paul Mitcheson reported a situation where the CUPS Internet Printing Protocol (IPP) implementation in CUPS versions prior to 1.1.19 would get into a busy loop. This could result in a denial of service. In order to exploit this bug an attacker would need to have the ability to make a TCP connection to the IPP port (by default 631).
Alerts:	SCO Group CSSA-2004-012.0 2004-03-03 Conectiva CLA-2003:779 2003-11-07 Mandrake MDKSA-2003:104 2003-11-05 Red Hat RHSA-2003:275-01 2003-11-03

Comments (none posted)

cvs: unauthorized file creation

Package(s):	cvs	CVE #(s):
Created:	December 9, 2003	Updated:	December 17, 2003
Description:	Stable CVS 1.11.10 has been released, fixing a security issue with no known exploits (as of this writing) that could cause previous versions of CVS to attempt to create files and directories in the filesystem root. This release also fixes several issues relevant to case insensitive filesystems and some other bugs.
Alerts:	OpenPKG OpenPKG-SA-2003.052 2003-12-17 Slackware SSA:2003-345-01 2003-12-11 Gentoo 200312-04 2003-12-08 Mandrake MDKSA-2003:112-1 2003-12-10 Mandrake MDKSA-2003:112 2003-12-08

Comments (none posted)

ethereal: multiple remote and local vulnerabilities

Package(s):	ethereal	CVE #(s):	CAN-2003-0925 CAN-2003-0926 CAN-2003-0927
Created:	November 10, 2003	Updated:	December 17, 2003
Description:	Multiple vulnerabilities have been found in ethereal versions below 0.9.16. Remote attackers can craft packets, and local users can build corrupt trace files, resulting denial of service and remote code execution.
Alerts:	Mandrake MDKSA-2003:114 2003-12-10 Fedora FEDORA-2003-022 2003-11-25 Gentoo 200311-04 2003-11-22 Red Hat RHSA-2003:323-01 2003-11-10 Conectiva CLA-2003:780 2003-11-07

Comments (none posted)

Filename disclosure vulnerability in fam

Package(s):	fam	CVE #(s):	CAN-2002-0875
Created:	August 19, 2002	Updated:	January 5, 2005
Description:	"fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible.
Alerts:	Red Hat RHSA-2005:005-01 2005-01-05 Debian DSA-154-1 2002-08-15

Comments (none posted)

fetchmail may crash on specially crafted message

Package(s):	fetchmail	CVE #(s):	CAN-2003-0792
Created:	October 17, 2003	Updated:	April 8, 2004
Description:	A bug was discovered in fetchmail 6.2.4 where a specially crafted email message can cause fetchmail to crash.
Alerts:	OpenPKG OpenPKG-SA-2004.012 2004-04-08 Gentoo 200403-10 2004-03-30 Netwosix NW-2004-0002 2004-02-20 SCO Group CSSA-2004-004.0 2004-02-19 Slackware SSA:2003-300-02 2003-10-22 Mandrake MDKSA-2003:101 2003-10-16

Comments (none posted)

fileutils/wu-ftpd: denial of service

Package(s):	fileutils	CVE #(s):	CAN-2003-0854
Created:	October 22, 2003	Updated:	March 2, 2004
Description:	There is, it seems, an integer overflow vulnerability in "ls" which can be exploited via wu-ftpd to create a denial of service situation. See this advisory from Georgi Guninski for details.
Alerts:	SCO Group CSSA-2004-006.0 2004-03-01 Trustix 2003-0042 2003-11-15 Mandrake MDKSA-2003:106 2003-11-12 Red Hat RHSA-2003:309-01 2003-11-03 Immunix IMNX-2003-7+-026-01 2003-10-31 Conectiva CLA-2003:771 2003-10-24 Conectiva CLA-2003:768 2003-10-22

Comments (none posted)

FreeRADIUS: Denial of service vulnerability

Package(s):	FreeRADIUS	CVE #(s):	CAN-2003-0967
Created:	December 10, 2003	Updated:	December 10, 2003
Description:	Versions of FreeRADIUS through 0.9.2 have a vulnerability wherein a remote attacker can cause the daemon to crash.
Alerts:	Red Hat RHSA-2003:386-01 2003-12-10

Comments (none posted)

glibc: DNS stub resolvers contain buffer overflow vulnerability

Package(s):	glibc	CVE #(s):	CAN-2002-1146
Created:	November 7, 2002	Updated:	February 5, 2004
Description:	DNS stub resolvers from multiple vendors contain a buffer overflow vulnerability. The impact of this vulnerability appears to be limited to denial of service. (See CERT Vulnerability Note VU#738331) The BIND 4 and BIND 8.2.x stub resolver libraries, and other libraries such as glibc 2.2.5 and earlier, libc, and libresolv, uses the maximum buffer size instead of the actual size when processing a DNS response, which causes the stub resolvers to read past the actual boundary ("read buffer overflow"), allowing remote attackers to cause a denial of service (crash).
Alerts:	Mandrake MDKSA-2004:009 2004-02-04 Red Hat RHSA-2002:197-09 2002-11-06 Red Hat RHSA-2002:197-06 2002-10-03

Comments (none posted)

GnuPG: ElGamal signing keys compromised

Package(s):	gnupg	CVE #(s):	CAN-2003-0971
Created:	November 28, 2003	Updated:	March 3, 2004
Description:	A severe vulnerability was discovered in GnuPG by Phong Nguyen relating to ElGamal sign+encrypt keys. This email message from Werner Koch contains more information. "Phong Nguyen identified a severe bug in the way GnuPG creates and uses ElGamal keys for signing. This is a significant security failure which can lead to a compromise of almost all ElGamal keys used for signing. Note that this is a real world vulnerability which will reveal your private key within a few seconds."
Alerts:	SCO Group CSSA-2004-009.0 2004-03-02 Debian DSA-429-2 2004-02-13 Debian DSA-429-1 2004-01-26 Gentoo 200312-05 2003-12-12 Fedora FEDORA-2003-025 2003-12-10 Red Hat RHSA-2003:395-01 2003-12-10 Red Hat RHSA-2003:390-01 2003-12-10 Conectiva CLA-2003:798 2003-12-09 SuSE SuSE-SA:2003:048 2003-12-03 Mandrake MDKSA-2003:109 2003-11-28

Comments (3 posted)

gtkhtml: malformed messages cause crash

Package(s):	gtkhtml	CVE #(s):	CAN-2003-0133 CAN-2003-0541
Created:	April 14, 2003	Updated:	April 18, 2005
Description:	GtkHTML is the HTML rendering widget used by the Evolution mail reader. GtkHTML supplied with versions of Evolution prior to 1.2.4 contain a bug when handling HTML messages. Alan Cox discovered that certain malformed messages could cause the Evolution mail component to crash.
Alerts:	Debian DSA-710-1 2005-04-18 Mandrake MDKSA-2003:093 2003-09-18 Conectiva CLA-2003:737 2003-09-12 Red Hat RHSA-2003:264-01 2003-09-09 Mandrake MDKSA-2003:046 2003-04-15 Red Hat RHSA-2003:126-01 2003-04-14

Comments (none posted)

iproute: local denial of service

Package(s):	iproute net-tools	CVE #(s):	CAN-2003-0856
Created:	November 25, 2003	Updated:	December 14, 2004
Description:	The iproute utility is susceptible to spoofed netlink messages sent by local users, with the result that denial of service attacks are possible.
Alerts:	Mandrake MDKSA-2004:148 2004-12-13 Fedora FEDORA-2004-154 2004-06-03 Fedora FEDORA-2004-115 2004-05-11 Debian DSA-492-1 2004-04-18 Gentoo 200404-10 2004-04-09 Red Hat RHSA-2003:316-01 2003-11-24

Comments (none posted)

KDE: Two issues in KDM

Package(s):	kde, xfree86	CVE #(s):	CAN-2003-0690 CAN-2003-0692
Created:	September 16, 2003	Updated:	December 19, 2003
Description:	According to this advisory two issues have been discovered in KDM: CAN-2003-0690: Privilege escalation with specific PAM modules. The XDM display manager that ships with XFree86 prior to 4.3 is also vulnerable. CAN-2003-0692: Session cookies generated by KDM are potentially insecure All versions of KDM as distributed with KDE up to and including KDE 3.1.3 are affected.
Alerts:	Mandrake MDKSA-2003:118 2003-12-19 Gentoo 200311-01 2003-11-15 Debian DSA-388-1 2003-09-19 Conectiva CLA-2003:747 2003-09-19 Mandrake MDKSA-2003:091 2003-09-16 Red Hat RHSA-2003:269-01 2003-09-16

Comments (none posted)

kernel: local root exploit in 2.4.22

Package(s):	kernel	CVE #(s):	CAN-2003-0961
Created:	December 1, 2003	Updated:	April 5, 2004
Description:	A vulnerability was discovered in the Linux kernel versions 2.4.22 and previous. A flaw in bounds checking in the do_brk() function can allow a local attacker to gain root privileges. This vulnerability is known to be exploitable. The 2.4.23 kernel contains the fix. For more details on how this vulnerability works, see this LWN article.
Alerts:	Debian DSA-475-1 2004-04-05 Debian DSA-470-1 2004-04-01 Debian DSA-442-1 2004-02-19 Debian DSA-433-1 2004-02-04 Debian DSA-423-1 2004-01-15 Red Hat RHSA-2003:368-01 2003-12-19 Conectiva CLA-2003:796 2003-12-05 Gentoo 200312-02 2003-12-04 SuSE SuSE-SA:2003:049 2003-12-04 Yellow Dog YDU-20031203-1 2003-12-03 Red Hat RHSA-2003:389-01 2003-12-01 Fedora FEDORA-2003-026 2003-12-02 Slackware SSA:2003-336-01 2003-12-01 Red Hat RHSA-2003:392-00 2003-12-01 Trustix 2003-0046 2003-12-01 Mandrake MDKSA-2003:110 2003-12-01 Debian DSA-403-1 2003-12-01

Comments (1 posted)

kernel-utils: setuid vulnerability

Package(s):	kernel-utils	CVE #(s):	CAN-2003-0019
Created:	February 7, 2003	Updated:	January 21, 2005
Description:	The kernel-utils package contains several utilities that can be used to control the kernel or machine hardware. In Red Hat Linux 8.0 this package contains user mode linux (UML) utilities. The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was incorrectly shipped setuid root. This could allow local users to control certain network interfaces, add and remove arp entries and routes, and put interfaces in and out of promiscuous mode. All users of the kernel-utils package should update to these packages that contain a version of uml_net that is not setuid root. Alternatively, as a work-around to this vulnerability issue the following command as root: chmod -s /usr/bin/uml_net
Alerts:	Red Hat RHSA-2003:056-08 2003-02-07

Comments (none posted)

libnids: remotely exploitable buffer overflow

Package(s):	libnids	CVE #(s):	CAN-2003-0850
Created:	October 29, 2003	Updated:	January 6, 2004
Description:	libnids (a NIDS plugin which emulates the Linux 2.0 IP stack) contains a buffer overflow vulnerability which can be exploited remotely. Version 1.18 fixes the problem.
Alerts:	Debian DSA-410-1 2004-01-05 Gentoo 200311-07 2003-11-22 Conectiva CLA-2003:773 2003-10-29

Comments (none posted)

libpng, libpng3: buffer overflow

Package(s):	libpng, libpng3	CVE #(s):	CAN-2002-1363
Created:	December 19, 2002	Updated:	July 14, 2004
Description:	Glenn Randers-Pehrson discovered a problem in connection with 16-bit samples from libpng, an interface for reading and writing PNG (Portable Network Graphics) format files. The starting offsets for the loops are calculated incorrectly which causes a buffer overrun beyond the beginning of the row buffer.
Alerts:	Gentoo 200407-06 2004-07-08 OpenPKG OpenPKG-SA-2004.030 2004-07-06 Mandrake MDKSA-2004:063 2004-06-29 Whitebox WBSA-2004:249-01 2004-06-21 Fedora FEDORA-2004-176 2004-06-18 Fedora FEDORA-2004-174 2004-06-18 Fedora FEDORA-2004-175 2004-06-18 Fedora FEDORA-2004-173 2004-06-18 Red Hat RHSA-2004:249-01 2004-06-18 Conectiva CLA-2003:564 2003-01-23 Mandrake MDKSA-2003:008 2003-01-20 OpenPKG OpenPKG-SA-2003.001 2003-01-15 Yellow Dog YDU-20030114-2 2002-01-14 SuSE SuSE-SA:2003:0004 2003-01-14 Red Hat RHSA-2003:006-06 2003-01-09 Debian DSA-213-1 2002-12-19

Comments (none posted)

mikmod: buffer overflow

Package(s):	mikmod	CVE #(s):	CAN-2003-0427
Created:	June 16, 2003	Updated:	June 16, 2005
Description:	Ingo Saitz discovered a bug in mikmod whereby a long filename inside an archive file can overflow a buffer when the archive is being read by mikmod.
Alerts:	Fedora FEDORA-2005-405 2005-06-16 Red Hat RHSA-2005:506-01 2005-06-13 Fedora FEDORA-2005-404 2005-06-09 Gentoo 200307-01 2003-07-02 Debian DSA-320-1 2003-06-13

Comments (none posted)

mpg123: heap overflow

Package(s):	mpg123	CVE #(s):	CAN-2003-0865
Created:	November 12, 2003	Updated:	February 19, 2004
Description:	Versions of mpg123 through 0.59s contain a heap overflow which may be exploited remotely (by a hostile server). See this advisory for details.
Alerts:	SCO Group CSSA-2004-002.0 2004-02-19 Debian DSA-435-1 2004-02-06 Conectiva CLA-2003:781 2003-11-12

Comments (none posted)

mplayer: remotely exploitable buffer overflow vulnerability

Package(s):	mplayer	CVE #(s):	CAN-2003-0835
Created:	September 29, 2003	Updated:	April 6, 2004
Description:	A remotely exploitable buffer overflow vulnerability was found in MPlayer. A malicious host can craft a harmful ASX header, and trick MPlayer into executing arbitrary code upon parsing that header. Read the full advisory for details.
Alerts:	Mandrake MDKSA-2004:026 2004-04-05 Gentoo 200403-13 2004-03-31 Conectiva CLA-2003:760 2003-10-06 Mandrake MDKSA-2003:097 2003-09-30 Gentoo 200309-15 2003-09-27

Comments (none posted)

Nessus NASL scripting engine security issues

Package(s):	nessus	CVE #(s):
Created:	May 27, 2003	Updated:	August 12, 2004
Description:	Some some vulnerabilities exsist in the Nessus NASL scripting engine. To exploit these flaws, an attacker would need to have a valid Nessus account as well as the ability to upload arbitrary Nessus plugins in the Nessus server (this option is disabled by default) or he/she would need to trick a user somehow into running a specially crafted nasl script. Read the full advisory for additional information.
Alerts:	Gentoo 200305-10 2003-05-27

Comments (none posted)

Net-SNMP: security bugs in versions before 5.0.9

Package(s):	Net-SNMP	CVE #(s):	CAN-2003-0935
Created:	December 2, 2003	Updated:	February 13, 2004
Description:	The Net-SNMP project includes various Simple Network Management Protocol (SNMP) tools. A security issue in Net-SNMP versions before 5.0.9 could allow an existing user/community to gain access to data in MIB objects that were explicitly excluded from their view. Version 5.0.9 of Net-SNMP is not vulnerable to this issue. In addition, Net-SNMP 5.0.9 fixes a number of other minor bugs.
Alerts:	Whitebox WBSA-2004:023-01 2004-02-12 Red Hat RHSA-2004:023-01 2004-01-15 Mandrake MDKSA-2003:115 2003-12-11 Red Hat RHSA-2003:335-01 2003-12-02

Comments (none posted)

nfs-utils xlog() off-by-one bug

Package(s):	nfs-utils	CVE #(s):	CAN-2003-0252
Created:	July 14, 2003	Updated:	March 8, 2004
Description:	Linux NFS utils package contains remotely exploitable off-by-one bug. A local or remote attacker could exploit this vulnerability by sending specially crafted request to rpc.mountd daemon. See this BugTraq post for more details.
Alerts:	Trustix TSLSA-2004-0009 2004-03-05 SCO Group CSSA-2003-037.0 2003-11-17 Conectiva CLA-2003:700 2003-07-22 Mandrake MDKSA-2003:076 2003-07-21 Gentoo 200307-07 2003-07-19 Yellow Dog YDU-20030718-1 2003-07-18 Slackware SSA:2003-195-01b 2003-07-15 Immunix IMNX-2003-7+-018-01 2003-07-14 SuSE SuSE-SA:2003:031 2003-07-15 Slackware SSA:2003-195-01 2003-07-14 Debian DSA-349-1 2003-07-14 Red Hat RHSA-2003:206-01 2003-07-14

Comments (none posted)

openssh: timing attack leads to information disclosure

Package(s):	openssh	CVE #(s):	CAN-2003-0190
Created:	May 2, 2003	Updated:	November 30, 2004
Description:	From the advisory: "During a pen-test we stumbled across a nasty bug in OpenSSH-portable with PAM support enabled (via the --with-pam configure script switch). This bug allows a remote attacker to identify valid users on vulnerable systems, through a simple timing attack. The vulnerability is easy to exploit and may have high severity, if combined with poor password policies and other security problems that allow local privilege escalation."
Alerts:	Ubuntu USN-34-1 2004-11-30 OpenPKG OpenPKG-SA-2003.035 2003-08-06 Red Hat RHSA-2003:222-01 2003-07-29 Gentoo 200305-02 2003-05-13 Gentoo 200305-01 2002-03-05

Comments (1 posted)

Pan: denial of service

Package(s):	Pan	CVE #(s):	CAN-2003-0855
Created:	November 25, 2003	Updated:	December 10, 2003
Description:	Pan is a Gnome/GTK+ newsreader. A bug in Pan versions prior to 0.13.4 can cause Pan to crash when parsing an article header containing a very long author email address. This bug causes a crash (denial of service) but is not further exploitable.
Alerts:	Red Hat RHSA-2003:312-01 2003-12-10 Red Hat RHSA-2003:311-01 2003-11-24

Comments (none posted)

postfix: denial of service vulnerabilities

Package(s):	postfix	CVE #(s):	CAN-2003-0468 CAN-2003-0540
Created:	August 5, 2003	Updated:	May 27, 2004
Description:	The postfix MTA, versions through 1.1.12 (but not 2.0) is subject to two remotely exploitable denial of service vulnerabilities; see this advisory from Michal Zalewski for details.
Alerts:	Mandrake MDKA-2004:028 2004-05-26 Trustix 2003-0029 2003-08-04 Mandrake MDKSA-2003:081 2003-08-04 EnGarde ESA-20030804-019 2003-08-04 Conectiva CLA-2003:717 2003-08-04 SuSE SuSE-SA:2003:033 2003-08-04 Red Hat RHSA-2003:251-01 2003-08-04 Debian DSA-363-1 2003-08-03

Comments (none posted)

proftpd: remote root shell

Package(s):	proftpd	CVE #(s):	CAN-2003-0831
Created:	September 24, 2003	Updated:	January 2, 2004
Description:	The ASCII translation mechanism in ProFTPD 1.2.8 contains a vulnerability which will provide a remote attacker with a root shell - if the attacker is able to download a specially-crafted file. See this ISS advisory for more information.
Alerts:	Mandrake MDKSA-2003:095-1 2003-12-31 Conectiva CLA-2003:750 2003-09-29 Gentoo 200309-16 2003-09-28 Trustix 2003-0037 2003-09-27 Mandrake MDKSA-2003:095 2003-09-26 OpenPKG OpenPKG-SA-2003.043 2003-09-25 Slackware SSA:2003-259-02 2003-09-23

Comments (2 posted)

rsync - remotely exploitable heap overflow

Package(s):	rsync	CVE #(s):	CAN-2003-0962
Created:	December 4, 2003	Updated:	March 3, 2004
Description:	An advisory has gone out warning of a remotely exploitable heap overflow vulnerability in rsync versions 2.5.6 and prior. If you are running an rsync server, you will want to apply a distributor patch or upgrade to 2.5.7 in the near future.
Alerts:	SCO Group CSSA-2004-010.0 2004-03-02 Immunix IMNX-2003-73-001-01 2003-12-05 Mandrake MDKSA-2003:111 2003-12-04 Red Hat RHSA-2003:399-01 2003-12-04 Red Hat RHSA-2003:398-01 2003-12-04 Fedora FEDORA-2003-030 2003-12-04 Conectiva CLA-2003:794 2003-12-04 Gentoo 200312-03 2003-12-04 EnGarde ESA-20031204-032 2003-12-04 Debian DSA-404-1 2003-12-04 OpenPKG OpenPKG-SA-2003.051 2003-12-04 SuSE SuSE-SA:2003:050 2003-12-04 Trustix 2003-0048 2003-12-04 Slackware SSA:2003-337-01 2003-12-03

Comments (none posted)

Multiple-use vulnerability in Safe.pm

Package(s):	Safe.pm	CVE #(s):	CAN-2002-1323
Created:	October 9, 2002	Updated:	February 20, 2004
Description:	usePerl has a description of a vulnerability in the Safe.pm Perl module. It seems that if a Safe compartment is used more than once, it ceases to be safe. The problem is fixed in Safe 2.08.
Alerts:	SCO Group CSSA-2004-007.0 2004-02-20 Gentoo 200212-6 2002-12-20 Trustix 2002-0087 2002-12-19 OpenPKG OpenPKG-SA-2002.014 2002-12-16 Debian DSA-208-1 2002-12-12

Comments (none posted)

sane-backends: several vulnerabilities

Package(s):	sane-backends	CVE #(s):	CAN-2003-0773 CAN-2003-0774 CAN-2003-0775 CAN-2003-0776 CAN-2003-0777 CAN-2003-0778
Created:	September 11, 2003	Updated:	February 20, 2004
Description:	Alexander Hvostov, Julien Blache and Aurelien Jarno discovered several security-related problems in the sane-backends package, which contains an API library for scanners including a scanning daemon (in the package libsane) that can be remotely exploited. These problems allow a remote attacker to cause a segfault fault and/or consume arbitrary amounts of memory. The attack is successful, even if the attacker's computer isn't listed in saned.conf. You are only vulnerable if you actually run saned e.g. in xinetd or inetd. If the entries in the configuration file of xinetd or inetd respectively are commented out or do not exist, you are safe. Try "telnet localhost 6566" on the server that may run saned. If you get "connection refused" saned is not running and you are safe. The Common Vulnerabilities and Exposures project identifies the following problems: CAN-2003-0773: saned checks the identity (IP address) of the remote host only after the first communication took place (SANE_NET_INIT). So everyone can send that RPC, even if the remote host is not allowed to scan (not listed in saned.conf). CAN-2003-0774: saned lacks error checking nearly everywhere in the code. So connection drops are detected very late. If the drop of the connection isn't detected, the access to the internal wire buffer leaves the limits of the allocated memory. So random memory "after" the wire buffer is read which will be followed by a segmentation fault. CAN-2003-0775: If saned expects strings, it mallocs the memory necessary to store the complete string after it receives the size of the string. If the connection was dropped before transmitting the size, malloc will reserve an arbitrary size of memory. Depending on that size and the amount of memory available either malloc fails (->saned quits nicely) or a huge amount of memory is allocated. Swapping and OOM measures may occur depending on the kernel. CAN-2003-0776: saned doesn't check the validity of the RPC numbers it gets before getting the parameters. CAN-2003-0777: If debug messages are enabled and a connection is dropped, non-null-terminated strings may be printed and segmentation faults may occur. CAN-2003-0778: It's possible to allocate an arbitrary amount of memory on the server running saned even if the connection isn't dropped. At the moment this can not easily be fixed according to the author. Better limit the total amount of memory saned may use (ulimit).
Alerts:	SCO Group CSSA-2004-005.0 2004-02-19 SuSE SuSE-SA:2003:046 2003-11-18 Conectiva CLA-2003:769 2003-10-22 Mandrake MDKSA-2003:099 2003-10-09 Red Hat RHSA-2003:278-01 2003-10-07 Debian DSA-379-1 2003-09-11

Comments (none posted)

screen: privilege escalation

Package(s):	screen	CVE #(s):	CAN-2003-0972
Created:	November 28, 2003	Updated:	March 3, 2004
Description:	According to this advisory a buffer overflow in GNU screen allows privilege escalation for local users. Usually screen is installed either setgid-utmp or setuid-root. It also has some potential for remote attacks or getting control of another user's screen. The problem is that you have to transfer around 2-3 gigabytes of data to user's screen to exploit this vulnerability. 4.0.1, 3.9.15 and older versions are vulnerable.
Alerts:	SCO Group CSSA-2004-011.0 2004-03-02 Fedora-Legacy FLSA:1187 2004-01-26 Conectiva CLA-2004:809 2004-01-20 Debian DSA-408-1 2004-01-05 Mandrake MDKSA-2003:113 2003-12-08 OpenPKG OpenPKG-SA-2003.050 2003-11-28

Comments (none posted)

File overwrite vulnerability in tar and unzip

Package(s):	tar unzip	CVE #(s):	CAN-2001-1267 CAN-2001-1268 CAN-2001-1269 CAN-2002-0399
Created:	October 1, 2002	Updated:	April 10, 2006
Description:	The tar utility does not properly filter file names containing "../", meaning that a hostile archive can, if unpacked by an unsuspecting user, overwrite any file that is writable by that user. GNU tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42 has the same vulnerability.
Alerts:	Fedora-Legacy FLSA:183571-1 2006-04-04 Red Hat RHSA-2006:0195-01 2006-02-21 Conectiva CLA-2002:538 2002-10-29 Mandrake MDKSA-2002:066 2002-10-10 Mandrake MDKSA-2002:065 2002-10-10 EnGarde ESA-20021003-022 2002-10-03 Gentoo unzip-20021001 2002-10-01 Gentoo tar-20021001 2002-10-01 Red Hat RHSA-2002:096-24 2002-09-18

Comments (1 posted)

Multiple vendor telnetd vulnerability

Package(s):	telnet Telnet netkit-telnet-ssl kerberos telnetd netkit-telnet nkitb/nkitserv/telnetd krb5	CVE #(s):
Created:	May 21, 2002	Updated:	October 5, 2004
Description:	This vulnerability, originally thought to be confined to BSD-derived systems, was first covered in the July 26th Security Summary. It is now known that Linux telnet daemons are vulnerable as well.
Alerts:	Gentoo 200410-03 2004-10-05 Yellow Dog YDU-20010810-2 2001-08-10 Yellow Dog YDU-20010810-1 2001-08-10 SuSE SuSE-SA:2001:029 2001-09-03 Slackware sl-997726350 2001-08-09 Red Hat RHSA-2001:100-02 2001-08-09 Red Hat RHSA-2001:099-09 2002-02-07 Red Hat RHSA-2001:099-06 2001-08-09 Progeny PROGENY-SA-2001-27 2001-08-14 Mandrake MDKSA-2001:093 2001-12-17 Mandrake MDKSA-2001:068 2001-08-13 HP HPSBTL0202-023 2002-02-12 Debian DSA-075-2 2001-08-14 Debian DSA-075-1 2001-08-14 Conectiva CLA-2001:413 2001-08-24 SCO Group CSSA-2001-030.0 2001-08-10

Comments (none posted)

vim - modeline vulnerability

Package(s):	vim	CVE #(s):	CAN-2002-1377
Created:	January 16, 2003	Updated:	February 10, 2004
Description:	VIM allows a user to set the modeline differently for each edited text file by placing special comments in the files. Georgi Guninski found that these comments can be carefully crafted in order to call external programs. This could allow an attacker to create a text file such that when it is opened arbitrary commands are executed.
Alerts:	Conectiva CLA-2004:812 2004-02-10 Mandrake MDKSA-2003:012 2003-02-03 Yellow Dog YDU-20030127-3 2003-01-27 Gentoo 200301-13 2003-01-22 OpenPKG OpenPKG-SA-2003.003 2003-01-21 Red Hat RHSA-2002:297-17 2003-01-15

Comments (4 posted)

wget: buffer overflow

Package(s):	wget	CVE #(s):	CAN-2003-1565
Created:	August 5, 2003	Updated:	December 10, 2003
Description:	The wget utility contains a buffer overflow which, when exploited with an over-long URL, can enable arbitrary code execution.
Alerts:	Red Hat RHSA-2003:372-01 2003-12-10 SCO Group CSSA-2003-025.0 2003-10-03 Conectiva CLA-2003:716 2003-08-04

Comments (1 posted)

zebra: denial of service vulnerability

Package(s):	zebra	CVE #(s):	CAN-2003-0795 CAN-2003-0858
Created:	November 13, 2003	Updated:	January 7, 2004
Description:	Zebra an open source implementation of TCP/IP routing software. Jonny Robertson reported that Zebra can be remotely crashed if a Zebra password has been enabled and a remote attacker can connect to the Zebra telnet management port. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0795 to this issue. Herbert Xu reported that Zebra can accept spoofed messages sent on the kernel netlink interface by other users on the local machine. This could lead to a local denial of service attack. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0858 to this issue.
Alerts:	Debian DSA-415-1 2004-01-06 OpenPKG OpenPKG-SA-2003.049 2003-11-25 Conectiva CLA-2003:786 2003-11-20 Red Hat RHSA-2003:307-01 2003-11-13

Comments (none posted)

Resources

December CRYPTO-GRAM newsletter

Bruce Schneier's CRYPTO-GRAM newsletter for December is out. It looks at whether the Blaster worm caused the August 14 blackout (he thinks it may have), electronic voting, and products using quantum cryptography. "I don't have any hope for this sort of product. I don't have any hope for the commercialization of quantum cryptography in general; I don't believe it solves any security problem that needs solving. I don't believe that it's worth paying for, and I can't imagine anyone but a few technophiles buying and deploying it."

Full Story (comments: 5)

Page editor: Jonathan Corbet

Kernel development

Brief items

Kernel Release Status

The current development kernel is 2.6.0-test11; there has been no development kernel release since November 26. Linus continues to accumulate small, critical patches in his BitKeeper repository, but appears to be waiting for Andrew Morton to return to the scene for the preparation of the next release, be it another -test kernel or the real 2.6.0.

Andrew did release 2.6.0-test11-mm1 on December 17. The -mm tree now contains a full 300 patches, ranging from small fixes to new drivers and major subsystem work. Andrew has indicated that at least some of the patches in -mm will find their way into the mainline after 2.6.0 comes out.

The current stable kernel is 2.4.23; Marcelo has not released any 2.4.24 prepatches since 2.4.24-pre1 on December 10.

Comments (4 posted)

Kernel development news

Lustre 1.0 released

Linux-based clusters would appear to be the future of high-performance computing. No other approach can combine the power and flexibility of the Linux system with the economic advantages of using commercial, mass-market hardware. For many kinds of problems, a room full of racks of Linux systems is by far the most cost-effective way of obtaining high-end computing power. For other sorts of tasks, ad-hoc "grid" computing networks promise the ability to offer computing power on demand from otherwise idle systems.

Making these clusters work and scale well is more than a simple matter of plugging them all into a network switch, however. Distributing data around a cluster can be a hard task; often, data transfer, rather than computing power, is the limiting factor in system performance. Faster networking technology can help, but what is really needed is a reliable way of making tremendous amounts of data available to any node in the cluster on demand.

With the announcement of Lustre 1.0, the Linux community just got a new tool for use in the creation of high-performance clusters. Lustre is a cluster filesystem which is intended to scale to tens of thousands of nodes and more stored data than anybody would ever want to have to back up. It offers high-bandwidth file I/O throughout the cluster while suffering from no single points of failure that could bring your expensive cluster to a halt. Luster 1.0 is licensed under the GPL, and is currently available for 2.4 kernels; a 2.6 version should be coming out before too long.

The Lustre filesystem is implemented with three high-level modules:

• Metadata servers keep track of what files exist in the cluster, along with various attributes (such as where the files are to be found). These servers also handle file locking tasks. A cluster can have many metadata servers, and can perform load balancing between them. Large directories can be split across multiple servers, so no single server should ever become a bottleneck for the system as a whole.

  Lustre supports failover for the metadata servers, but only if the backup servers are working from shared storage.

• Object storage targets store the actual files within a cluster. They are essentially large boxes full of bits which can be accessed via unique file ID tags. Linux systems can serve as object storage targets, using the ext3 filesystem as the underlying storage, but someday specialized OST appliance boxes may become available from the usual vendors. Object storage targets are stackable, allowing the creation of virtual targets which provide high-level volume management and RAID services.

  The object storage targets are also responsible for implementing access control and security. Once again, failover targets can be set up, as long as the underlying storage is shared.

• The client filesystem is charged with talking to the metadata servers and object storage targets and presenting something that looks like a Unix filesystem to the host system. Typical requests will be handled by asking one or more metadata servers to look up a file of interest, followed by I/O requests to the object storage target(s) which hold the data contained by that file.

A key part of the Lustre design is failure recovery. Each component keeps a log of actions that it has committed - or attempted to commit. If a server (metadata or object storage) falls off the net, the other nodes which were working with that server remember the operations which were not known to be complete. When the server comes back up, it implements a "recovery period" where other nodes can reestablish locks, replay operations, and so on, so that it can return to a state which is consistent with the rest of the cluster. New requests will be accepted only after the recovery period is complete.

Lustre uses the Sandia Portals system to handle communications between the nodes. A full Lustre deployment will also likely involve LDAP and/or Kerberos servers to handle authentication tasks.

The 1.0 release may have just happened, but Lustre has been handling real loads for some time. According to this press release from Cluster File Systems, four of the top five Linux supercomputers are running Lustre. The press release also claims that a Lustre deployment achieved a sustained throughput of 11.1 GB/second, which is rather better than most of us can get with NFS.

The 2.6 version of Lustre has not yet been released, but should be available soon. Apparently there have already been talks with Linus about getting Lustre merged into the 2.6 kernel. Before too long, that shrink-wrapped Linux box in the local computer store may come with a high-end cluster filesystem included.

Comments (5 posted)

Linux for little systems

Matt Mackall has picked up a new project: making the 2.6 kernel work on very small systems. This is, he says, "an area Linux mainstream has been moving away from since Linus got a real job." To this end, he has released a tree called 2.6.0-test11-tiny which incorporates a large set of patches aimed at slimming down the kernel. It's worth a look as an expression of just what needs to be done if you want to run Linux on small systems.

So what's required? The -tiny patch includes, among others, the following:

• Building the kernel with the -Os compiler option, which instructs gcc to optimize for size. This option results in a smaller kernel; interestingly, there have also been reports that -Os yields better performance on large systems as well, since the resulting executable has better cache behavior.

• The 4k kernel stack patch cuts the runtime per-process memory use significantly.

• Various patches shrink the size of internal data structures to their minimum values. Target structures include the block and char device names hash tables, the maximum number of swapfiles, the maximum number of processes, the futex hash table, CRC lookup tables, and many others.

• For truly daring users, the -tiny kernel has an option to remove printk() from the kernel entirely, along with its associated buffers and most of the strings passed to printk(). The space savings will be considerable; you just have to hope that the kernel has nothing important to tell you. Strings for BUG() and panic() calls can also be removed.

• Various subsystems which are not normally optional become so. With the -tiny kernel, it is possible to configure out sysfs (which can take a lot of run-time memory), asynchronous I/O, /proc/kcore, ethtool support, core dump support, etc.

• Inline functions are heavily used in the kernel; they can improve performance, and, in some situations, the use of inline code is mandatory. Excessive use of inline functions can bloat the size of the kernel considerably, however. The -tiny kernel includes a patch which makes the compiler complain about the use of inline functions, allowing a size-conscious developer to find which ones are invoked most often.

There are almost 80 separate patches in all. Matt claims that his kernel, when configured with a full networking stack, fits "comfortably" on a 4MB box, which is, indeed, considered small these days. Matt has some ambitious future plans, including cutting functionality out of the console subsystem and (an idea that is sure to raise some eyebrows) making parts of the kernel be pageable. It remains to be seen whether things will get that far, but there is no doubt that making Linux work on small systems is a worthy goal.

Comments (4 posted)

Patches and updates

Kernel trees

• Andrew Morton: 2.6.0-test11-mm1. (December 17, 2003)

• William Lee Irwin III: 2.6.0-test11-wli-2. (December 11, 2003)

• Martin J. Bligh: 2.6.0-test11-mjb2. (December 12, 2003)

• Martin J. Bligh: 2.6.0-test11-mjb3. (December 16, 2003)

• Matt Mackall: -tiny tree for small systems (2.6.0-test11). (December 12, 2003)

Core kernel code

• Nick Piggin: HT scheduler. (December 11, 2003)

Development tools

• Larry McVoy: RFC - tarball/patch server in BitKeeper. (December 15, 2003)

Device drivers

• Greg KH: big USB patch for 2.6.0-test11. (December 15, 2003)

• Jeff Garzik: 2.6.x experimental net driver updates. (December 16, 2003)

• Vladimir Kondratiev: PCI Express support for 2.4 kernel. (December 17, 2003)

• Naveen Burmi: Request for review of Linux iSCSI driver version 4.0.0.3. (December 17, 2003)

Documentation

• Rusty Russell: Revised Unreliable Kernel Locking Guide. (December 12, 2003)

• Fruhwirth Clemens: Cryptoloop (<2.4.22) to Cryptoloop (>2.5.x) Migration Guide. (December 15, 2003)

Filesystems and block I/O

• Keith Owens: Announce: XFS split patches for 2.4.24-pre1. (December 17, 2003)

Memory management

• Dave Hansen: [RFC][PATCH] NUMA user page replication. (December 17, 2003)

Benchmarks and bugs

• Con Kolivas: HT schedulers' performance on single HT processor. (December 17, 2003)

• Bill Davidsen: Response testing on 2.6.0-test11 variants. (December 17, 2003)

Miscellaneous

• Greg KH: udev 009 release. (December 17, 2003)

• Steve Youngs: Module auto-unloading solution. (December 17, 2003)

Page editor: Jonathan Corbet

Distributions

News and Editorials

LindowsOS or Xandros Desktop?

Earlier this week, two almost simultaneous release announcements from Lindows.com and Xandros Corporation provided some entertainment during the otherwise quiet, pre-holiday season. Lindows.com's LindowsOS 4.5 and Xandros Corporation's Xandros Desktop 2.0 are in many ways similar products with a more or less identical target market. If you still need a Christmas present for a less technically inclined member of your family or if you find it hard to make a decision whether to get one or the other, then this brief feature comparison might be of help.

Installation.. Both LindowsOS and Xandros Desktop provide easy system installation in no more than a few clicks. Both have excellent auto-detection of most hardware, including hundreds of digital cameras and many wireless network cards. However, the Xandros installer is a lot more sophisticated in its advanced mode - it allows partition resizing, custom software selection, user setup and even some advanced security configuration. It detects an existing Xandros installation and offers an upgrade path while preserving user data and settings. In contrast, the LindowsOS installer is primitive even in its "advanced" mode, with the only available choice being an option to specify a partition to which to install the operating system. LindowsOS 0, Xandros 1.

First impressions. While developers of both products have clearly done many usability studies to make migration from Windows as easy as possible, LindowsOS has been more imaginative in this effort. A series of well-presented audiovisual tutorials on various subjects is a good example of that. On top of it, Lindows.com arguably employs more talented graphics designers, a fact that is further enhanced by the availability of stunning scenic desktop backgrounds, beautiful icons and a matching default desktop theme. Although Xandros does have an advantage in providing a more comprehensive printed manual, this round will have to go to LindowsOS for its combination of an eye-catching desktop, innovative tutorials, and jargon-free product guides easily palatable by even a less technically skilled audience. LindowsOS 1, Xandros 0.

Applications. Earlier versions of LindowsOS were criticized for having a very limited set of available applications out of the box. This has improved in version 4.5, with previously absent OpenOffice.org, CD burner and certain multimedia applications, such as RealPlayer, now provided without having to subscribe to the $50-a-year Click-N-Run service. Still, Xandros Desktop 2.0 comes on two CDs with a larger range of applications. It is also more up-to-date with KDE 3.1.4 (as opposed to KDE 3.0.1 in LindowsOS 4.5) and OpenOffice.org 1.1.0. It can't be a coincidence that LindowsOS 4.5 ships with an older OpenOffice.org 1.0.3, while it uses every opportunity to promote the non-free StarOffice 7. LindowsOS 0, Xandros 1.

Online updates. One of the strong points of LindowsOS is its excellent Click-N-Run (CNR) service for one-click software installation and updates. Perhaps inspired by CNR, Xandros has a similar service, called Xandros Networks. Although not as sophisticated as its LindowsOS counterpart, it does the job of installing applications, and it does it so for free (installing certain applications requires free online registration). Nevertheless, the CNR service is better designed with comprehensive package information, options to group applications into software "aisles" for batch installation and availability of many interesting commercial applications and games at greatly reduced prices. We'll give this round to LindowsOS: LindowsOS 1, Xandros 0.

Special features. Both LindowsOS and Xandros are quick to point out many unique characteristics of their products. The latest LindowsOS comes with a SIPphone, an Internet telephony application (see this screenshot) which allows users to place free telephone calls anywhere in the world. SIPphone requires a broadband connection to be effective, but our brief tests with the application showed excellent voice quality. The catch? The phone calls can only be made to a physical SIPphone, a product by Lindows.com's sister company SIPphone, Inc, or another user running LindowsOS. Other new features in LindowsOS 4.5 are remote desktop sharing and a Google-powered web page search and translation service nicely integrated into Mozilla's right click menu.

Xandros, on the other hand, has focused its development on the excellent Xandros File Manager, providing many pleasant features. These include drag-and-drop archive creation and audio ripping, seamless file sharing across mixed networks and integrated drag-and-drop CD burning. The "switch user" feature is a convenient tool for quick desktop switching between several virtual desktops. The Deluxe Edition also comes with CrossOver Office and Plugin for running certain Windows applications under Linux. This round ends in a draw: LindowsOS 1, Xandros 1.

Price. LindowsOS costs $49.95 (download) or $59.95 (retail package), while Xandros sells for $39.95 (Basic Edition) or $89.95 (Deluxe Edition). The cost of LindowsOS is slightly misleading, because it costs additional $49.95 per year to join the CNR service, without which the product isn't nearly as much fun. However, after joining CNR, all future product updates, including newly released ISO images are free as long as the CNR membership is maintained. Still, the $39.95 Xandros Desktop Standard Edition is probably a better value, especially since it includes a lot more software than LindowsOS and it does not require regular payments. LindowsOS 0, Xandros 1.

Conclusion. Even after comparing many aspects of the two products, it is still hard to pick a winner. Xandros has a superior installer, more software and is better value for the money, while LindowsOS has more eye-candy, imaginative tutorials and the excellent Click-N-Run service. Some users might also value certain non-technical aspects of these products - those interested in online interaction with other users will find LindowsOS forums more active, while others might prefer to support a company that contributes back to the Linux community; unlike Xandros, Lindows.com sponsors several open source projects, such as Gaim. The innovative SIPphone application might be another good reason to prefer LindowsOS. But some might be put off by a constant barrage of anti-Microsoft propaganda found in Lindows.com newsletters and press releases, with more court battles with the Redmond software giant over the name "Lindows" coming up in the near future.

Both LindowsOS 4.5 and Xandros Desktop 2.0 are excellent distributions that won't disappoint.

Comments (10 posted)

Distribution News

White Box Enterprise Linux 3.0 released

White Box Enterprise Linux 3.0 is available. "Take the freely available SRPMS for Red Hat's RHEL3, strip out the trademarks required by the license and some other obvious references, go through a few compile/test cycles and you get White Box."

Full Story (comments: 6)

Immunix Releases Latest Secure Linux Operating System

Immunix has announced the release of the Immunix Secure OS 7.3 Linux server operating system with integrated host intrusion prevention technologies. "In early November, Red Hat Linux announced that they would discontinue maintenance support of Red Hat Linux 7.x and 8.x at the end of December 2003. Immunix will offer security updates for the Red Hat-compatible Immunix 7.3 through March of 2005."

Comments (none posted)

LindowsOS 4.5 Launches

Lindows.com Inc. has announced the immediate availability of LindowsOS 4.5 with support for English, Spanish, French, Italian, German, and Portuguese.

Comments (none posted)

Xandros Desktop Operating System

Xandros, Inc. announced the general availability of version 2 of the Xandros Desktop OS.

Full Story (comments: none)

Gentoo Weekly Newsletter - Volume 2, Issue 50

The Gentoo Weekly Newsletter for the week of December 15, 2003 is out, with a summary of the December 1st Gentoo Managers' Meeting, and much more.

Full Story (comments: none)

Debian GNU/Linux

The Debian Weekly News for December 16 looks at the remaining issues for getting CVS back online, installer status, a problem with the new Debian stable update CDs, Debian Spain, and more.

Branden Robinson has announced the availability of anonymous, read-only, public access to the X Strike Force Subversion repositories.

Joey Hess reports on the status of the new Debian installer.

Registration is still open for Debian Miniconf taking place January 12 - 13, 2004 in Adelaide, South Australia.

Comments (none posted)

Fedora Core 2 schedule posted

A release schedule for Fedora Core 2 has been posted. The Fedora hackers are going to be busy; this schedule anticipates putting together a distribution with the 2.6 kernel, SELinux, GNOME 2.6, KDE 3.2, and much more, and making the final release available on April 5.

Comments (3 posted)

End of Life for Red Hat Linux 7.1, 7.2, 7.3, 8.0

Red Hat has sent out a friendly reminder that the end of life for most Red Hat Linux products is almost here. After December 31, 2003 there will be no security fixes or other errata for Red Hat Linux 7.1, 7.2, 7.3 and 8.0.

Full Story (comments: 10)

Slackware Linux

The slackware-current changelog shows upgrades to GIMP, CUPS, syslinux and Perl among the other upgrades and fixes. There are also lftp and cvs security fixes available for both current and stable.

Comments (none posted)

Mandrake Linux

Mandrake has updated gaim packages that restore MSN support, available for Mandrake Linux 9.1 and 9.2.

Full Story (comments: none)

Fedora updates

Fedora Core 1 has bug fixes and updates available for net-snmp and redhat-config-printer.

Comments (none posted)

New Distributions

PCLinuxOS

PCLinuxOS is a live CD based on Mandrake 9.2. Data on the CD is uncompressed on the fly, allowing up to 2 GB worth of system and programs on one CD including a complete X server, KDE 3.1.4 and Gnome 2.4, and large packages like OpenOffice 1.1final and Mozilla 1.5 plus plugins. Since it runs solely off the CD, PCLinuxOS can be used as a portable Linux demo or system rescue disk, but its completeness makes it a good general purpose desktop as well. PCLinuxOS should work on most modern computer hardware. PCLinuxOS 2K4 Preview 4 is currently available for download.

Comments (none posted)

SACIX

SACIX is a Debian-based distribution for São Paulo's public computer labs, the telecentros. (Thanks to Konrad Holzbauer)

Comments (1 posted)

SCMLinux

The SCMLinux distribution provides a minimal, secure, and redundant architecture for those who seek a software configuration management system. It includes a rewrite of CVS version 1.11.6 with problem reporting functionality. Version Alpha was released December 11, 2003.

Comments (none posted)

Minor distribution updates

Buffalo Linux

Buffalo Linux has released v1.0.4 with major feature enhancements. "Changes: Major improvements include an improvement in login security/actions, a major cleanup of printer devices, numerous help pages, a Christmas theme, and installation cleanup. This release uses CUPS 1.1.20 and GIMP 1.3."

Comments (none posted)

CDLinux

CDLinux has released v0.4.7 with major feature enhancements. "Changes: This version incorporates SysV-like init scripts, NIC autoprobing, netfilter, better CJK support, and many other features."

Comments (none posted)

Coyote Linux

Coyote Linux has released v2.03 with major feature enhancements. "Changes: This release includes the 2.4.23 kernel, iptables 1.2.29, and thttpd 2.24. It includes the chat program and several updates to the Web-based administrative interface to simplify firewall rule generation."

Comments (none posted)

CRUX

CRUX has released v1.3 with minor feature enhancements. "Changes: The default kernel is now 2.4.23. About 70 packages were updated, such as GCC 3.3.2, Perl 5.8.2, Sendmail 8.12.10, and Firebird 0.7."

Comments (none posted)

Damn Small Linux

Damn Small Linux has released v0.5.1.1 with minor bugfixes. "Changes: The AA font option has been removed from Fluxbox. The dsl-hdinstall script cleans up some left over files. The fluxbox menu selected X-setup error has been fixed. A bbpager/enhance bug has been fixed."

Comments (none posted)

DeLi Linux

DeLi Linux has released v0.5 with minor feature enhancements. "Changes: delisetup was enhanced, and it is now a complete administration tool. mc was replaced with the smaller mc-MP. Some cleanup was done. Bugfixes were made."

Comments (none posted)

Feather Linux

Feather Linux has released v0.2.2 with minor feature enhancements. "Changes: Sambahas been added. An sshd setup script, hard disk install script, and Opera download script have been added to the menu. A "run command" option has been added to the menu; it uses fbrun. naim icon fixed. Monkey Web server startup has been fixed. A keymap selection has been added to the X11 configuration script."

Comments (none posted)

floppyfw

floppyfw has released stable v2.0.8 with minor security fixes. "Changes: Upgraded to kernel 2.4.23 and iptables 1.2.9."

Comments (none posted)

PLD RescueCD

PLD RescueCD has released v1.90 with major feature enhancements. "Changes: Based on the modern distribution PLD AC/NEST. Boot process and hardware detection were improved. Now it requires an i386 PC with only 16 MB of RAM. Booting from IDE, SCSI, USB CD-ROM, or disk was implemented. The kernel was updated to 2.4.23 with many new modules (e.g. SATA, a driver for the Eagle 8051 Analog, and improved NTFS). 243 packages were updated in this release. 53 new packages were added (e.g. chntpw, dar, dhcp, disktype, e2salvage, hotplug, mtools, ntfsprogs, oidentd, and tinyproxy)."

Comments (none posted)

Distribution reviews

Reviews of some Debian-based distributions (OSNews)

OSNews has a series of reviews on commercial Debian based distributions, covering, including Lindows, Libranet and MEPIS. From the introduction: "The criteria for these reviews will be a bit unusual. I am looking intently at some things that other reviewers don't seem to care about, while many aspects that ordinarily get covered in a review will be brushed over, if I mention them at all. For instance, ease of installing the OS is a non-issue for me. It took me a while to get here, but I believe I can install any modern OS, given enough time and motivation. I don't care if it has a GUI, or command line, or is carved in mud with a sharp spoon. All I ask is that it work. I will only describe the installation if it causes problems." (Found on Debian Planet)

Comments (none posted)

Introducing PCLinuxOS 2K4 (MadPenguin)

MadPenguin reviews PCLinuxOS 2K4, a new Mandrake based live-CD distribution. "Applications on PCLinuxOS are not lacking at all. As a matter of fact, this is the most complete live Linux distro I have ever seen in terms of applications. As a matter of fact, I would go as far as saying that it is the perfect blend of packages in any distro today. This CD was obviously built by someone who understands the desktop and the way it should be built. Well, at least understands the way I think it should be built. After all, I cannot speak for everyone and their individual tastes. For me, this distro has the applications to satisfy my daily needs with little modification."

Comments (none posted)

Migrating to Astaro Security Linux (LinuxJournal)

Linux Journal covers this migration tale. "Facing a time-consuming and expensive upgrade process, Lloyd found an ideal solution: he turned to an all-in-one security product. Lloyd set up his own network at home where he downloaded a free 30-day trial of Astaro Security Linux. "To meet my own firewall requirements for my Linux- and Windows-based network, I investigated several open-source solutions. I looked at SmoothWall, IPCop and Astaro, among others, and as I investigated the features offered by each, I found that with Astaro I could turn an inexpensive server into an all-purpose security appliance", he said."

Comments (none posted)

Slackware Linux - Back to Basics (DistroWatch)

Here's a review of Slackware on DistroWatch.com. "Despite the lack of cute and cuddly graphical tools, many system administrators swear by Slackware and would use nothing else. Why? Because they understand Unix and it makes sense to them. Because they can learn the nuts and bolts of the operating system (if nothing else, running Slackware is educational). It should also be mentioned that Slackware is fast, stable and secure. And besides all that, graphic utilities are for wimps."

Comments (none posted)

Page editor: Rebecca Sobol

Development

The Double Choco Latte Project Management System

Double Choco Latte is an open-source project management system, it is one component of the GNU Enterprise (GNUe) collection of business-related software tools.

Double Choco Latte is a web-based system. The software requires PHP 4, a web server, an SQL database, and a web browser for its use. See the Requirements document for details.

DCL assists in project management by providing work orders and call center tickets. It can be used for tracking project history and other statistics. See the features page for some examples, and the screenshots page to see the software in action.

Double Choco Latte is being used for general project management, task and time management, customer call tracking, bug tracking, order fulfillment, and call logging. The list of users shows many examples of companies who are using the software.

The online documentation for DCL is somewhat out of date, Up and Running with Double Choco Latte gives a project overview, and the Developer Documentation delves into the internals.

Version 0.9.4 of Double Choco Latte was announced this week. "After many months, DCL 0.9.4 has been released. This is a major release for many reasons." The release notes contain a detailed list of changes as well as this summary: "Many bug fixes, security fixes, and enhancements, including web-based setup, SCCS integration support, moved all menus to phpLayersMenu, significant changes to UI, and much more."

Comments (none posted)

System Applications

Audio Projects

Planet CCRMA Changes

The latest changes from the Planet CCRMA audio utility packaging project include updates to CM/CLM/CMN, Cmucl, JACK, Hydrogen, JAMin, QJackctl, Gmorgan, Alsaplayer, Xosd, Sndlib, Mammut, and more.

Comments (none posted)

Database Software

MySQL 4.0.17 has been released

Version 4.0.17 of the MySQL database has been released. "This is a bugfix release for the current production version."

Full Story (comments: none)

phpMyAdmin-2.5.5-rc2 is released! (SourceForge)

Version 2.5.5-rc2 of phpMyAdmin is out. "This is the second release candidate for 2.5.5. A few problems were discovered and fixed from 2.5.5-rc1. phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the Web."

Comments (none posted)

PostgreSQL Weekly News

The PostgreSQL Weekly News for December 15, 2003 is available. "Well, holidays are coming and going which will probably be a least a little disruptive to development the next few weeks. Case in point; the holding off of the 7.4.1 release in order to get schedules better worked out."

Full Story (comments: none)

Embedded Systems

BusyBox 1.0.0-pre4 released

Version 1.0.0-pre4 of BusyBox, a collection of Unix-like command line utilities for embedded systems, has been announced. "This release includes major rework to sed, lots of rework on tar, a new tiny implementation of bunzip2, a new devfsd applet, support for 2.6.x kernel modules, updates to the ash shell, sha1sum and md5sum have been merged into a common applet, the dpkg applets has been cleaned up, and tons of random bugs have been fixed."

Comments (none posted)

Mail Software

milter-sender 0.48 available

Milter-sender 0.48 and LibSnert 1.29 are available. "This release has several important fixes and its recommend that all sites update. Well I won't bore you with highlights as its time for me to prepare supper."

Comments (none posted)

Printing

AFPL Ghostscript 8.12 release

Version 8.12 of AFPL Ghostscript has been announced. "This is mainly a bugfix release. However there are a number of feature improvements as well. Highlights include improved font rendering and color[space] handling, and unicode text support for high-level devices."

Comments (none posted)

LPRng 3.8.24 available

Version 3.8.24 of the LPRng print system is available. Change information is in the source code.

Comments (none posted)

Web Site Development

phpWebSite 0.9.3-2 Stable released (SourceForge)

Version 0.9.3-2 of the phpWebSite content management system has been announced. "This release is mainly a performance enhancement upgrade from previous versions. The memory requirements have been dropped below the 8MB php default and the execution time has been cut in half. Many of the interfaces have been cleaned up and made more consistent. Also a new category view has been implemented for announcements, links, and documents."

Comments (none posted)

TownPortal 0.5 "Little Christmas" released

Version 0.5 of Town Portal, an open-source web-based portal system for villages and local communities, is out with lots of new features.

Full Story (comments: none)

Miscellaneous

Divmod Quotient Release 0.8.8

Version 0.8.8 of Quotient, an open source product that combines a multi-protocol messaging server with tools for information management and retrieval, has been announced. "In this release there has been a lot of polish and bugfixing applied to existing code. In particular, the database has been simplified and streamlined, and the extraction framework has been made more robust."

Full Story (comments: none)

Desktop Applications

Audio Applications

Cultured Perl: Fun with MP3 and Perl (IBM developerWorks)

Teodor Zlatanov writes about MP3 manipulation with Perl in part one of a series on IBM's developerWorks. "Every self-respecting computer and music fan needs to be able to manipulate MP3s -- the defacto standard for recreational digital music use. In this article, Ted looks at ways to manage and manipulate MP3s (searching, tagging, renaming, commenting, etc.) using the autotag.pl application. Ted takes you through the application, illustrating how CPAN modules enable the application."

Comments (none posted)

Desktop Environments

Ettore Perazzoli is now gone (GnomeDesktop)

Footnotes eulogizes GNOME/Ximian hacker Ettore Perazzoli who died unexpectedly on December 10.

Comments (2 posted)

GNOME Development Release 2.5.1 (GnomeDesktop)

Development Release 2.5.1 of GNOME has been announced. "This release is a snapshot of development code. Although it is buildable and usable, it is primarily intended for testing and hacking purposes."

Comments (none posted)

This week's GNOME Summary

The GNOME Summary for December 13 is out; it looks at the passing of Ettore Perazzoli, the new Foundation board, the 2.5.1 development release, and many other topics.

Full Story (comments: none)

KDE-CVS-Digest

The December 12, 2003 KDE-CVS-Digest has been published, here's the summary: "Mostly bug fixes. Code folding and highlighting fixes in Kate. Message selection and deleting bugs fixed in KMail. Screenshots of Kexi, the graphical database front-end."

Comments (none posted)

KDE Traffic

Issue #71 of KDE Traffic has been posted. The KDE.News summary says: "Lots of news await you in the just-released KDE Traffic. If you're interested in hearing about KDE Performance, Quanta, KOffice, KDevelop, Image Viewers and more, check it out."

Comments (none posted)

Electronics

XCircuit 3.1.32 released

Version 3.1.32 of XCircuit, an electronic schematic drawing package with lots of other uses, is available. Change information is in the source code.

Comments (none posted)

Financial Applications

BIE 5.7.0 (alpha) released (SourceForge)

Version 5.7.0 alpha of BIE, the Business Integration Engine, has been announced. "BIE (Business Integration Engine) is an open source integration system that makes it easy for organizations to exchange data with external trading partners regardless of their native applications. It competes in the same space as applications like Microsoft BizTalk except that it is truly cross-platform since it written in Java. BIE 5.7.0 includes multiple feature enhancements and bug fixes. An LDAP action and LDIF message formatter have been added to assist in working with LDAP data sources."

Comments (none posted)

SQL-Ledger 2.2.1 released

Version 2.2.1 of SQL-Ledger, a web-based accounting package, has been released. The changes include a new cash transfer entry screen, improved translations, better multibyte encoding support, and bug fixes.

Comments (none posted)

Graphics

Inkscape 0.36 released (GnomeDesktop)

FootNotes is carrying the announcement for the second release of the Inkscape vector drawing editor. There is a long list of new features; it seems the Inkscape developers have been busy.

Comments (none posted)

GUI Packages

New FLTK software available

A number of new software releases are available for FLTK, the Fast, Light ToolKit. Updates include version 2.7 of the FLU library of FLTK Widgets, version 1.2rc1 of flPhoto, an image management system, version 0.1rc2 of the flCash personal finance application, and more.

Comments (none posted)

Interoperability

Samba 3.0.1 released

Version 3.0.1 of Samba is out. See the release notes for the full story. "This is the latest stable release of Samba and the version that all production Samba servers should be running for all current bug-fixes."

Comments (none posted)

Wine Traffic

Issue #200 of Wine Traffic is available with the latest Wine news.

Comments (none posted)

Wine 20031212 available

Wine version 20031212 has been announced. "This is still a developers only release. There are many bugs and unimplemented features. Most applications still do not work correctly."

Comments (none posted)

Music Applications

gmorgan 0.18 released

Version 0.18 of gmorgan, an electronic organ simulator with rhythm station and auto-accompaniment, is out. This release features new documentation, new edit functions, code improvements, bug fixes, and more.

Full Story (comments: none)

Office Suites

OpenOffice.org: KDE Integration project launched today (KDE.News)

A new OpenOffice KDE Integration Project has been announced. "Maybe you remember Cuckooo, a KPart allowing OOo to be embedded in the Konqueror window (as a viewer). In the meantime this has evolved into an OpenOffice.org Qt port and the development does not stop there. KDE Integration is now an official "Incubator" project at OpenOffice.org, which means that it has been accepted by the OpenOffice.org community and if it continues well, it will become an official "accepted" project."

Comments (none posted)

OpenOffice.org Newsletter

The December, 2003 OpenOffice.org Newsletter has been published. Take a look to read about the latest deployments, software developments, and more.

Full Story (comments: none)

Web Browsers

Mozilla.org Staff Meeting Minutes (MozillaZine)

The Minutes are available for two Mozilla.org staff meetings. For the December 1, 2003 meeting: "Issues discussed include Mozilla 1.6 Beta, the website, localisations on CD and the Mozilla Foundation."

For the December 8, 2003 meeting: "Issues discussed include CVS over SSH, Mozilla 1.6 Beta, Talkback, Mozilla Firebird 0.8, streamlining the release process, localisation packs, the website, upgrading bugzilla.mozilla.org and future meetings."

Comments (none posted)

Word Processors

AbiWord 2.0.2 released (GnomeDesktop)

Version 2.0.2 of AbiWord has been announced. "This release is a bugfix release over 2.0.1 and includes fixes to footnote handling, Windows font rendering (now matching Word's text layout exactly) and table handling, amongst others."

Comments (none posted)

AbiWord Weekly News

Issue #174 of the AbiWord Weekly News is available, here's the summary: "Finally, Abi-Centric releases! AbiWord 2.0.2 and Enchant 1.1.2 have been released! AbiWord 2.1.0 has been almost released. And, a new major feature hits CVS HEAD; all those details, and more news on AbiRelatives inside."

Comments (none posted)

Languages and Tools

Caml

Caml Weekly News

The December 9-16, 2003 edition of the Caml Weekly News is out with another roundup of Caml articles.

Full Story (comments: none)

Java

Explorations: Generics, Erasure, and Bridging (O'Reilly)

William Grosso writes about Java Generics, Erasure, and Bridging on O'Reilly. "In my first two articles, I'm going to talk about some of the more advanced aspects of the current generics implementation. More specifically, this first installment is about erasure and bridging. Both of these are code transformations the compiler performs in order to implement the generics specification."

Comments (none posted)

Perl

Gtk2-perl 1.020 released (SourceForge)

The second stable release of gtk2-perl, the Perl bindings to Gtk+ has been announced, along with some new related libraries. "The major focus of this release is documentation: now we have full API reference documentation, generated automagically from the source code. It also includes a fix for major memory leak, as well as the ability to create your own CellRenderers in Perl, and fixes a bunch of bugs. We strongly recommend all users upgrade to this version."

Comments (none posted)

This Week on perl5-porters (use Perl)

The December 8-14, 2003 edition of This Week on perl5-porters is online. "In two words, this was a busy week. Various topics were discussed, from the low-level C portability stuff to the Perl anguage considerations."

Comments (none posted)

This week on Perl 6 (O'Reilly)

O'Reilly's This week on Perl 6 for the week ending on December 7, 2003 is out with more Perl 6 information.

Comments (none posted)

PHP

PHP Weekly Summary for December 16, 2003

The PHP Weekly Summary for December 16, 2003 is out. Topics include: New fgetcsv() behaviour, rmdir() and mkdir() are now using streams, Magic __toString() method, ext/tidy enabled by default in PHP 5, New “with” construct request, PECL vs. Sibiria.

Comments (none posted)

Using data structures in PHP (DevChannel)

Josh Bressers explains the use of data structures in PHP. "Some languages, such as PHP, do not provided a straightforward way of easily working with data structures. The most challenging, yet most important, part of working with data structures in PHP lies in handling variable references."

Comments (none posted)

Python

Python-dev Summary

The Python-dev Summary for November 16-30, 2003 is out with a look at the traffic on the python-dev mailing list.

Full Story (comments: none)

Dr. Dobb's Python-URL!

Dr. Dobb's Python-URL! for December 15, 2003 is available. Take a look for links to lots of Python articles.

Full Story (comments: none)

numarray-0.8 released

Version 0.8 of numarray, a re-implementation of Numeric array manipulation extension module for Python, is available. See the release notes for change details.

Comments (none posted)

Tcl/Tk

Dr. Dobb's Tcl-URL!

The December 16, 2003 edition of Dr. Dobb's Tcl-URL! is out with another weekly collection of Tcl/Tk article links.

Full Story (comments: none)

XML

DocBook XSL Stylesheets 1.64.0 released (SourceForge)

Version 1.64.0 of DocBook XSL Stylesheets is available. "This release includes many bugfixes (including an experimental fix for correctly generating links when the dbhtml 'dir' PI is used), some performance improvements, and some new features, including a new option for controlling which sections are included in running headers or footers, better control over superscript/subscript properties, and support for the newly add "code" and "stepalternatives" markup."

Comments (none posted)

The XOM Java XML API (IBM developerWorks)

David Mertz examines XOM on IBM's developerWorks. "In this installment, David looks at Elliotte Rusty Harold's XOM. Broadly speaking, this is yet another object-oriented XML API, somewhat in the style of DOM, however a number of features set XOM apart, and Harold argues that they are important design elements. Chief among these is a rigorous insistence on maintaining invariants in in-memory objects so that an XOM instance can always be serialized to correct XML. In addition, XOM aims at greater simplicity and regularity than other Java XML APIs."

Comments (none posted)

Cross Compilers

The GPAL compiler

The GPAL compiler has been added to the GPUTILS collection of tools for Microchip PIC microcontrollers. "GPAL is the GNU PIC Algorithmic Language. It is a very simple Ada like language for Microchip PIC microcontrollers. The language is still being defined, so I will have to provide the details later."

Comments (none posted)

Editors

Leo 4.1 rc1 released (SourceForge)

Version 4.1 rc1 of Leo, a programmer's outlining editor and browser, has been announced. Changes include a new batch mode, support for Unicode characters, new script capabilities, bug fixes, and more.

Comments (none posted)

IDEs

Charming Python: Review of Python IDEs (IBM developerWorks)

David Mertz reviews Python IDEs on IBM's developerWorks. "David looks at four open source development environments for working with Python code on Unix-like operating systems. He evaluates two general-purpose editors/environments and two Python-specific ones, and compares the merits of each."

Comments (none posted)

Miscellaneous

OOP over the top (Inspirational Technology)

This article on the Inspirational Technology site looks at the effects of too much Object Oriented design. "OO techniques are a tool, they are not an end goal. Starting to design a system to achieve OO purity is the fastest way to build a system that will be ten times more complex then it likely needs to be."

Comments (none posted)

Page editor: Forrest Cook

Linux in the news

Recommended Reading

Myths Open Source Developers Tell Ourselves (O'ReillyNet)

chromatic has some suggestions for free software developers in this ONLamp.com article. "Many of the users you most want to test your code before an official release won't. The phrase 'stable release' has special magic that 'alpha,' 'beta,' and 'prelease' lack. The best way to get user feedback is to release your code in a stable form."

Comments (6 posted)

Getting open source into public libraries (NewsForge)

Here's a NewsForge article that looks at spreading open source software through local libraries. "The first reaction from the open source community is usually "Great, I'll burn a whole set of CDs and donate them to my local library." This is completely and utterly the wrong thing to do. It is wrong because you will not be taking into account the responsibilities libraries have for their patrons. The CDs you burn will have to be thrown away. You will also be trying to force libraries to do what you want them to do, and nobody likes that."

Comments (16 posted)

On the GUI Selection in UserLinux (NewsForge)

Bruce Perens defends his decision to include GNOME and not KDE in UserLinux, in this NewsForge article. "We held about a week of discussion on the GUI issue, on the UserLinux mailing list - about 200 postings. It drowned out all other work. It was clear from the discussion that while GNOME and KDE each exceed the other in some areas, when you weigh them all together they are of equal technical merit. However there is a critical business difference between the two GUIs: GNOME does not require a royalty in connection with proprietary software development based upon their SDK. Qt, the widget set upon which KDE is based, does have a proprietary developer licensing fee connected with it."

Comments (61 posted)

The SCO Problem

Transcript of SCO v. IBM motion to compel hearing

For those of you who haven't seen enough of this yet: Groklaw now has the official transcript from the December 5 hearing on IBM's motions to compel discovery from SCO. It's an interesting read. From SCO lawyer Kevin McBride's presentation: "... I want to walk the Court through enough of our complaint to help the Court understand that IBM clearly did contribute a lot of the Unix-related information into Linux. We just don't know what it is."

Comments (11 posted)

Security Expert Doubts SCO's Attack Story (Groklaw)

Groklaw takes a skeptical look at SCO's claims of having been subjected to another DDOS attack. "The consensus of what I am hearing is: That it is probably not an attack. That their description of the "attack" makes no sense. And that if what they are saying were true, SCO would be admitting to gross negligence."

Comments (12 posted)

The Protective Order (Groklaw)

Groklaw has gotten hold of the protective order in the SCO case. This order could result in the community never seeing SCO's evidence, even if the company turns out to have some.

Comments (10 posted)

Linux Adoption

Linux Gaining Support In Embedded Systems (TechWeb)

TechWeb reports on Wind River's moves toward Linux. "Linux today lacks the maturity, for example, to operate in real-time systems, which are computer systems that respond to input signals fast enough to keep an operation moving at its required speed. Such systems are used to control airplanes and space shuttles. But while Linux is behind proprietary and homegrown systems in this space, the gap is closing."

Comments (3 posted)

Israel accelerates free software migration (Register)

The Register reports that several departments in the Israeli government are evaluating Linux. "Writing for Israel's Ynet, Gal Mor reports that the Israeli Treasury has decided to walk away from the Government's contract with Microsoft. Signed two years ago, the contract expires this month, and the ministry is testing localized builds of Mandrake Linux."

Comments (2 posted)

Followup with the LUG Of Iraq (Linux Journal)

Here's a Linux Journal article looking at the software situation in Iraq. "As Ashraf told me, Iraq is now a blank, unformatted hard disk and can be loaded with anything. Everything is open in Iraq right now. There are no regimented standards or massive expenditure in a particular monopoly's software. Now is the time to convince Iraqis--government, business, and users--that linux will meet their needs better than proprietary software."

Comments (3 posted)

Legal

ACT passes open source law (ComputerWorld)

The Australian ComputerWorld has an article on the new open source law passed in the Australian Capital Territory. "Section 6A of the Government Procurement Guideline amendment bill regarding the procurement of computer software stated: 'In the procurement of computer software, a Territory entity should, as far as practicable, prefer open source software.'... The bill was later amended by independent member Helen Cross to substitute 'consider' for 'prefer', and then passed by the Labor government." (Thanks to Frederic Schutz).

Comments (none posted)

Australian Capital Territory passes open source bill (ARNnet)

The Australian Capital Territory (ACT) has passed legislation that requires its agencies to consider non-proprietary software, ARNnet reports. "Section 6A of the Government Procurement Guideline amendment bill regarding the procurement of computer software stated: "In the procurement of computer software, a Territory entity should, as far as practicable, prefer open source software."" (Found on Open Sector)

Comments (5 posted)

Interviews

An interview with Chris Hofmann (Digital Web)

Digital Web interviews Chris Hofmann of the Mozilla Foundation. "The development and testing community is still strong. We have nine people on the Foundation’s staff. IBM and others have stepped in to hire key developers. In a small engineering meeting to talk about some Gecko work at the Foundation headquarters a few days ago, we had eight or so developers representing five different companies. We really are fulfilling the dream of Mozilla being a collaborative project with involvement from many companies and individuals with a passion for internet client software."

Comments (none posted)

FOSDEM interviews: Hans Reiser, Stefan Seefeld, and Tom Tromey

FOSDEM 2004 is happening in February; in keeping with its tradition, the conference is posting interviews with developers who will be speaking at the event. The first set includes Hans Reiser (of ReiserFS fame), Stefan Seefeld (the Fresco project), and Tom Tromey (GCJ - GNU Compiler for Java). The conference has also announced that the beginning keynote talk will be given by Tim O'Reilly.

Comments (1 posted)

Interview with Mandrake Linux Founder Gael Duval

LinuxQuestions talks with Gael Duval about the past, present and future of Mandrake Linux. "LQ) Before releasing the first Mandrake version (which was based on Red Hat) you were working on a Slackware-based OS. Any regrets on that distro switch? Do you think things would be different had you not made that change? GD) No regret at all, for a simple reason: it was not serious anymore to release a Linux distribution without a good package management like RPM. I seriously considered to switch to Debian as a base because at the time, Red Hat's reaction was very unclear (as far as I know, forking from a commercial Linux distribution never happened before Mandrake). But back in 1998, Debian's installation procedure was really not friendly at all. As a result, a key success of Mandrake was also that all packages made for Red Hat were compatible with Mandrake, including commercial packages. So the choice of RPM was the good one."

Comments (none posted)

Interview: Author of Ambitous Flash4Linux Project (KDE.News)

KDE.News interviews Özkan Pakdil, author of the Flash4Linux project. "I think that, within any given Linux environment, there is an extreme lack of WYSIWYG type applications -- particularly of the Flash variety. In the Windows world, Flash is a well-known tool for creating animated vector graphics. I want to bring this type of functionality to Linux, but I do realize that this will not be an easy task."

Comments (none posted)

Zander to light a fire under Motorola (ZDNet)

ZDNet talks with Ed Zander, formerly of Sun, about his move to Motorola. "When we bought Cobalt, we basically told the executive team and the board that we had to get behind Linux big, but I left soon after, and people just didn't agree with me. Sun should have owned Linux and should have owned the community. It is Unix and all Unix developers should have been Sun developers with Linux."

Comments (12 posted)

Beyond Hacking the Xbox (O'Reilly)

Bruce Stewart interviews Andrew "bunnie" Huang, author of Hacking the Xbox, on O'Reilly. "To some extent, the DMCA has already stifled reverse engineering. The fear and doubt that surrounds the activity has been enough to deter most technical people. The contrast between engineers in the U.S. and those overseas in countries without the DMCA, or DMCA-like laws, is quite stark. The technology marketplace is extremely competitive, and anything that slows down our ability to compete, such as depriving engineers of the unfettered freedom to reverse engineer competing products, may prove to have very undesirable long-term consequences."

Comments (none posted)

Reviews

KDE 3.2-beta2, Towards a Better KDE (OSNews)

OSNews previews KDE3.2-beta2. "KDE 3.2 offers a slew of new features, including an updated khtml engine, an SVG viewer/player kpart, better tab integration on Konqueror (which are now available for file management as well for web pages), CD burning via Konqueror, and even an addon-like technology, named Service Menus. Any user can hack together their own custom service menus and create their ideal addon menu without any C/C++ code. There is also a better Kiosk support, support for graphically connecting to Windows machines, and support for inline automatic spellchecking for some apps like kmail." (Found on KDE.News)

Comments (2 posted)

Device Profile: Samsung SCH-i519 smartphone (LinuxDevices)

LinuxDevices.com is running a profile of the Samsung SCH-i519 Linux-powered phone, including pictures and screenshots. "The i519 is the first embedded Linux device to run Voice Signal's Voice Activated Phonebook (VAP) application, which lets users launch any installed application by voice, using commands such as 'Open Browser' or 'Open Instant Messenger.'"

Comments (1 posted)

Flying the Open Skies with FlightGear (O'Reilly)

Howard Wen reviews FlightGear, an open-source flight simulator, and interviews the developers. "Flying has never been so impressive — or free. FlightGear is a flight simulator that boasts surprising technical realism, supported by an equally sophisticated pedigree — several of its active developers work in the aeronautics industry. "What keeps the project going is a wide range of people who care deeply."

Comments (none posted)

From Browser to Platform: Mozilla Rises (LinuxInsider)

LinuxInsider takes a detailed look at the Mozilla development platform. "What is new with Mozilla is that apparently simple technologies used in Web development, like XML, CSS and JavaScript, are all equally applicable to Mozilla applications. Instead of a Web page, you can build a traditional user-oriented, GUI-based application with these technologies."

Comments (none posted)

Miscellaneous

Linux set for Mars landing (vnunet)

Vnunet covers a UK project to send the Beagle 2 Mars Lander to the red planet. "In true British low-budget fashion, a single Linux-based workstation at the Lander Operations Control Centre (LOCC) is being used to send commands and receive vital data from Beagle 2."

Comments (5 posted)

Page editor: Forrest Cook

Announcements

Non-Commercial announcements

Linux Group Aims for Enterprise Desktop

Developers from both the Debian and KDE projects have announced an initiative to provide a Linux desktop operating system aimed at the needs of large organizations. By working together the group intends to deliver an integrated solution for the desktop needs of government agencies, educational institutions and enterprises.

Full Story (comments: none)

Preliminary results for the GNOME Foundation elections (Footnotes)

Footnotes reports on the preliminary results of the GNOME Foundation Board of Directors. "The next board of directors will consist of:
Owen Taylor - Glynn Foster - Jody Goldberg - Jeff Waugh - Luis Villa - Jonathan Blandford - Nat Friedman - Leslie Proctor - Bill Haneman - Dave Camp - Malcolm Tredinnick"

Comments (10 posted)

Healthcare Desktop Project Announced (LinuxMedNews)

A new open-source health care project has been announced. "I would like to notify everyone interested in Open Source healthcare software about a new Open Source project - Healthcare Desktop. In short our project goal is to create an open source (snip.) software package that covers all aspects of work in modern hospital."

Comments (none posted)

Commercial announcements

MandrakeSoft shareholder newsletter

MandrakeSoft has posted its shareholder newsletter for the 2002/2003 fiscal year. Revenue for the year was €3.9 million, down from €4.7 million the year before; the company attributes the decline to its bankruptcy proceedings, the weak economy, and the decline of the dollar. The company's losses also fell, however, to €2.2 million, less than half of what it lost the year before, and gross margins have increased considerably. MandrakeSoft claims to cash-flow positive since January, and to be heading toward a positive operating result in the current quarter. It looks like an exit from the bankruptcy process will be happening before too long.

Comments (none posted)

Reasoning Study Reveals Code Quality of MySQL

Reasoning Inc. has released the results of a study of MySQL. "Reasoning's inspection study shows that the code quality of MySQL was six times better than that of comparable proprietary code. A key quality indicator is defect density, which is defined as the number of defects found per thousand lines of source code. In its latest study, Reasoning found 21 software defects in 236,000 lines of MySQL source code. The defect density of the MySQL code was 0.09 defects per thousand lines of source code. Using a benchmark that covered over 200 recent projects totaling 35 million lines of commercial code, Reasoning found that the commercial average defect density of these projects came to 0.57 defects per thousand lines of source code."

Comments (10 posted)

Fujitsu Promoting PostgreSQL

Fujitsu is promoting PostgreSQL. "In cooperation with SRA/Japan, Fujitsu has developed a custom version of PostgreSQL which is a merger of the community PostgreSQL release and its powerful, proprietary storage engine called Symfoware. The resulting product, called Powergres Plus, is now being marketed by Fujitsu".

Comments (none posted)

Bob Young writes a letter to Darl

Bob Young, co-founder of Red Hat, has posted an open letter to Darl McBride, CEO of SCO. "Darl, for the sake of your case in front of the courts, for the sake of your company's ability to win customers, for the sake of everyone's blood pressure, and to save yourself further personal embarrassment, you might want to be less vocal. All you are doing is causing your audience to educate themselves. Once everyone understands how wrong you are your stock price will suffer."

Comments (35 posted)

3rd Millennium releases code as open source

3rd Millennium has announced the release of its knowledge management system to the open source community. The software is a foundation technology for knowledge management solutions in biopharmaceutical research and development.

Comments (7 posted)

Use of "Lindows" name blocked in Sweden

Lindows.com has sent out a press release entitled "Microsoft blocks distribution of desktop Linux in Sweden." What has really happened, of course, is that Microsoft has succeeded in a trademark challenge against the "Lindows" name in that country. Lindows is portraying Microsoft's actions as directed against Linux in general ("Microsoft is using lawsuits as a battering ram to smash Linux, to prevent it from reaching retail stores"), but the real scope of the case is a bit narrower than that.

Comments (28 posted)

RWE Innogy Selects Verano's Linux-based Performux

Verano has announced that RWE Innogy, a UK energy company, has installed Verano's Performux, a real-time plant intelligence software platform. According to Verano, Performux is the first Linux-based, plant operations software platform to offer secure, Internet-enabled management of critical industrial operations.

Full Story (comments: none)

Red Hat Application Server *Beta 1* Availability

Red Hat has announced the general availability of Red Hat Application Server v1.0 Beta 1. The package includes Tomcat 4.1.27, Struts 1.0.2, JOnAS 3.3, sample JOnAS and Struts web applications, supporting modules for file uploads, AJP and WARP protocols, and JDBC drivers for MySQL.

Full Story (comments: none)

Novell Nterprise Linux Services released

Novell has sent out a press release proclaiming the availability of its "Novell Nterprise Linux Services 1.0" offering. This product brings Novell's variety of integrated printing, file management, directory management, and messaging services to the Red Hat and SUSE enterprise distributions.

Full Story (comments: none)

Resources

Report: Open Source Software: Perspectives for Development

The Dravis Group has published a report called "Open Source Software: Perspectives for Development," it is available as a 44-page PDF file. The report looks at the use of free software in the developing world, with case studies and "lessons learned" from several countries. (Seen on OpenSector).

Comments (1 posted)

December Troubleshooters Magazine

The December issue of Troubleshooters is out, with a comprehensive GIMP tutorial and lots of other stuff. "If I were stranded on a desert island with only one graphical tool, I pray it would be Gimp. Gimp might not be easiest for specific applications, but it can do just about anything. This article gives an overview of a select few of Gimp's abilities. Gimp has MANY more abilities than discussed in this article."

Comments (1 posted)

PHP Magazine

The first issue of the new PHP Magazine is available online for free. "The PHP Magazine is your monthly dose of PHP, containing an assortment of carefully handpicked articles from the vast resource pool of the international PHP Magazine editorial."

Comments (none posted)

Introduction to Mozilla Manual Available (MozillaZine)

MozillaZine has an announcement for a new Mozilla introductory manual. "Kevin Quiggle writes: "A guide to Mozilla 1.5 — Introduction to Mozilla — A Manual for First Time Users — is now complete and is available for download as an illustrated PDF file (source documents used to create the manual are also available). This publication is intended to introduce new users of Mozilla to key features and functions."

Comments (none posted)

The Independent Qt Tutorial (KDE.News)

Johan Thelin has announced the availability of a new Qt tutorial. "I have started writing a gentle introduction to Qt called The Independent Qt Tutorial. It currently consists of nine chapters and deals with how to setup Qt, how to use QtDesigner, how to write an application by hand, etc. The purpose of the tutorial is to cover all areas of Qt needed to write top quality applications."

Comments (none posted)

Event Reports

Report: KDE at Linux Bangalore 2003

KDE.News has a report on Linux Bangalore, as viewed from the KDE booth. "One thing I've noticed is that in India, Linux is synonymous with Red Hat simply because they seem to be the only distribution to have put serious effort into this market so far. Almost all the demo machines at the conf were running it, and most people's KDE experiences seem to be from Red Hat too. Not such a great thing, especially as downloading software off the net is hard due to the low availability of broadband. I hadn't really anticipated this, so at the conf itself I spent quite a bit of time burning and giving away CDs with whatever KDE sources happened to be on my laptop at the time. It's going to be very important to get good KDE packages onto the next few Fedora releases, as its quite hard to even find other distributions for sale."

Comments (none posted)

UMEET 2003 conference

The fourth edition of the UMEET Conference is underway. UMEET 2003 is a virtual conference (taking place via the web and IRC) and it includes topics like software patents, free software, security and recent Linux developments. You can look at the program and register to receive updates about the conference. The conference began on December 15, and will finish December 23, with a talk by Rik van Riel.

Comments (none posted)

Upcoming Events

CodeCon 3.0 Call for Papers (Linux Journal)

Linux Journal covers a call for papers for CodeCon. The deadline for proposals is December 15, 2003. CodeCon 3.0 will be held February 20-22, 2004, in San Francisco, California.

Comments (none posted)

Linux Audio Conference #2 CFM

A Call For Music has gone out for the 2nd conference of the Linux Audio Developers, to be held in Karlsruhe, Germany on April 29 - May 2, 2004. "As a new feature there will be presentations of music in addition to technical talks. For this, we are looking for music that has been produced completely or mostly under Linux."

Full Story (comments: none)

PostgreSQL Bootcamp

Bruce Momjian will be leading a PostgreSQL Bootcamp on February 23-27, 2004 near Atlanta, GA.

Full Story (comments: none)

Nordic Perl Workshop in Copenhagen (use Perl)

The Nordic Perl Workshop for 2004 has been announced. The event will take place in Copenhagen from March 27-28, 2004. Also, see the event's Call for Papers.

Comments (none posted)

YAPC::Taipei::2004 - Call For Participation (use Perl)

A Call For Participation for the YAPC::Taipei::2004 conference is online. "YAPC::Taipei::2004 will take place on 27th-28th, March 2004; the topic of this conference is "Projects for Developers", where we will unveil "OpenFoundry", a collaboration environment based on widely-used Perl projects such as Mason, RT, Sympa and Kwiki."

Comments (none posted)

PyCon DC 2004 Submissions Open

Submissions are being accepted for the PyCon DC 2004 Python conference. The event will take place in Washington, DC in March, 2004.

Full Story (comments: none)

MySQL Users Conference 2004 Call for Papers

A Call for Papers has gone out for the MySQL Users Conference & Expo 2004. The event will be held in Orlando, Florida on April 14-16, 2004.

Comments (none posted)

Linux Installfest in Davis

The Linux Users' Group of Davis will be holding another Linux Installfest on December 21, 2003 at UC Davis.

Full Story (comments: none)

Linux.Conf.Au 2004 update

An update notice has gone out for the Linux.Conf.Au 2004 event. "Just over 4 weeks to go - and it's all getting a little bit exciting!"

Full Story (comments: none)

OSCon 2004 Call for Participation (use Perl)

Use Perl has a Call for Participation for the OSCon 2004 conference, the event will take place in Portland, OR on July 26-30, 2004.

Comments (none posted)

Mozilla Developers Meeting in Europe 4.0 Announced (MozillaZine)

The Mozilla Developers Meeting in Europe 4.0 has been announced. The event will take place in Brussels on February 21-22, 2004.

Comments (none posted)

Events: December 18, 2003 - February 12, 2004

Date	Event	Location
January 12 - 13, 2004	Linux.Conf.au Miniconfs	Adelaide, Australia
January 12 - 13, 2004	EducationaLinux 2004	Adelaide, Australia
January 14 - 17, 2004	Linux.conf.au	Adelaide, Australia
January 20 - 23, 2004	LinuxWorld Conference & Expo 2004	(Jacob K. Javits Convention Center)New York, New York
January 31 - February 1, 2004	WineConf 2004	(Court International Building)St. Paul, Minnesota
February 2 - 6, 2004	EclipseCon 2004	(Disneyland Hotel)Anaheim, CA
February 2 - 4, 2004	Open Standards and Certification Conference	(San Diego Marriott Mission Valley)San Diego, CA
February 3 - 5, 2004	Linux Solutions 2004	Paris, France
February 9 - 12, 2004	O'Reilly Emerging Technology Conference(ETech)	(The Westin Horton Plaza)San Diego, CA

Comments (none posted)

Mailing Lists

New Mailing List 'kdepim-users'

A new kdepim-users mailing list has been announced. "pim.kde.org reports that a new mailing list kdepim-users for discussion about the usage of the KDE PIM applications (Kontact, KAddressBook, KMail, KOrganizer and everything else in the kdepim CVS module) has been created. Users who want to help with user support for the KDE PIM applications are very welcome to the new mailinglist."

Comments (none posted)

Web sites

The Abusable Technologies Awareness Center

The Abusable Technologies Awareness Center site has been set up "to provide current and accurate information about technology that oversteps its bounds." The site is run by an extensive set of panelists which includes Steve Bellovin, Matt Bishop, Matt Blaze, Bill Cheswick, Ed Felten, Dan Geer, Avi Rubin, Bruce Schneier, and several others.

Comments (2 posted)

EC Open Source Observatory launches

The Open Source Observatory, operated by the European Commission's "Interchange of Data Between Administrations" agency, is now online. It includes a news section, an events calender (incomplete - it's missing FOSDEM,for example), case studies, etc.

Comments (4 posted)

Software announcements

This week's software announcements

Here are the software announcements, courtesy of Freshmeat.net. They are available in two formats:

• Sorted alphabetically,
• Sorted by license.

Comments (none posted)

Page editor: Forrest Cook