LWN.net Weekly Edition for January 29, 2004

HR 3261 and the ownership of facts

The U.S. House Judiciary Committee approved HR 3261 (the "Database and Collections of Information Misappropriation Act") on January 21. As this bill represents yet another discouraging expansion of American copyright law, it merits a look. For those who want to read the full text, it is available in PDF format.

Unlike many bad intellectual property ideas, database protection is an idea being imported into the U.S. from Europe. Efforts to prevent the "misappropriation" of databases have been ongoing for some time; the first version of the current proposal - based on the 1996 EU database directive -- was considered in 1996. It did not pass, but anybody who has watched the legislative system in operation has learned that these things keep coming back until the interests behind them finally get what they want. That would appear to be happening here.

The core of the proposed law can be found in Section 3:

In plain English, what this law is saying is that copyright protections will be extended to databases, regardless of whether the information contained within those databases is, itself, copyrightable. Collections of information which is, itself, unprotected (pricing information, sports scores, weather data, etc.) will become protected. In a sense, this law allows somebody who compiles a database to own the facts found therein.

The definition of a "database" is reasonably broad; it is:

There are some interesting exceptions: network routing information, for example, is explicitly declared not to be a "database." The domain name registration database is also excluded. Beyond that, however, just about any collection of information counts.

Given the way other copyright laws have been stretched to the maximum, it is worth considering what sorts of information could be considered a database for the purposes of this law. Scientific, economic, and geographic data is the obvious application. Less obvious, but clearly covered, is a Linux distribution CD, or any collection of freely-available software. Certain professional sports organizations have long fought for ownership of game scores. Lists of audio CDs and the names of the tracks on them could be included. Network routing tables may be excluded, but the geographical location of IP addresses is a different story. The EU directive has been held to outlaw "deep linking" into web sites. If you go about reproducing Linus Torvalds quotes, you better be prepared to prove that they did not come from our definitive collection. And so on.

Hopefully many of these scenarios will not come to pass. But, even so, we do not really need another expansion of copyright law at this time. U.S. law has long held that expression is copyrightable, but ideas and facts are not. HR 3261 overrides that tradition by giving database creators a degree of control over the facts they have collected from elsewhere. This bill, while improved over previous versions, is still not something we want to see passed into law.

Comments (35 posted)

What's in KDE 3.2?

With a new release of KDE right around the corner, we thought we'd take the first release candidate for a spin to see what KDE 3.2 has to offer. I used Konstruct to build 3.2rc1, which took several hours on an Athlon XP 2600+ with 1GB of RAM running SUSE 9. Though Konstruct is not new to 3.2, it still deserves a mention. Konstruct allows the user to build and use a given KDE release (as well as many KDE apps) without disturbing their current KDE installation, and doesn't require root access. Users who are hesitant to try new KDE releases for fear of breaking their current install need not worry.

The first things I noticed about 3.2 were some of the small changes. KDE 3.2 seems faster than the 3.1.4 release that comes with SUSE 9. The KDE Kicker panel is finally Xinerama friendly again, allowing the user to span multiple desktops with the Kicker panel if they wish to do so. The KDE 3.1 release forced a user to choose between desktops, and did not allow the Kicker to span both desktops. The KDE start menu has also changed slightly; it now includes built in separators between applications, "most used" applications (as determined by apps launched using the menu), and "actions." The KDE Menu Editor is largely unchanged from the 3.1.x release, however.

In previous releases of KDE, users could switch between virtual desktops by hovering the mouse cursor over the pager on the Kicker panel and scrolling with the mouse wheel. With the 3.2 release, users can enable the feature for the entire desktop -- so all a user needs to do is place the mouse cursor over an empty space on the desktop and use the scroll wheel to move between virtual desktops, which is an enormously useful feature for users with several applications spread over multiple desktops.

There are a few accessibility-related applications in 3.2 that might be of interest to users who have physical limitations. KMouseTool allows the user to set the mouse to left-click after a set period of time. This is useful for users with carpal tunnel syndrome, and may also be of interest to users with touchpads or other non-traditional pointing devices. KMouseTool also has a "smart drag" feature that takes a bit of getting used to. It allows the user to hover over a title bar or other window element for a set period of time and then drag the mouse as if the user were holding down the left button without actually requiring the user to use the button.

KDE 3.2 includes an improved KHotKeys, which now has support for mouse gestures. As a safety measure, the user must replicate a mouse gesture three times before they can assign an action to a mouse gesture. Users can also assign actions to hotkey combinations and other KDE events. I was able to use KHotKeys to assign hotkey combinations to launch applications, but wasn't successful in assigning a mouse gesture to an application. I may have been doing something incorrectly, but it was hard to tell, as the KHotKeys documentation was missing from the KDE Help Center.

Konqueror has a number of enhancements in 3.2 as well. First off, the rendering speed for Konqueror 3.2 is noticeably faster than for Konqueror 3.1.4. Konqueror also has built-in spell checking, which is a nice touch for anyone who uses a Web-based e-mail client, weblog client or any other situation where you might be entering text in a form on the Web. Folks using KDE 3.2 no longer have an excuse for poor spelling -- a quick spell check is just one right-click away. After using Konqueror about five minutes, I also discovered another new feature in KDE 3.2: integration with KWallet. KWallet is an application that stores passwords for websites, messaging applications like Kopete and other apps. One difference between KWallet and the Mozilla password feature, is that KWallet requires the user to enter a separate password to obtain the username/password combination for any given web page.

Web developers may find the Quanta 3.2 release interesting. It has a number of improvements, including "Visual Page Layout," which allows users to edit web pages in a WYSIWYG mode or a joint editing mode combining WYSIWYG and traditional text-editing. For users who prefer to edit HTML source directly, the joint mode offers the ability to immediately see changes rendered without removing the direct control over the HTML that many prefer. Quanta has quite a bit to offer, but it is still somewhat buggy. Quanta locked up a few times during testing, and the application consumed far more than its share of system resources during use.

With 3.2 KDE now has its own unified groupware suite, Kontact. Kontact bundles KMail, KOrganizer, KNotes, KNode and the KAddressBook applications. Right now, Kontact is a little rough around the edges, and definitely not quite as polished as its GNOME counterpart, Evolution. KNotes caused Kontact to lock up on more than one occasion. Kontact also lacks a unified configuration menu -- meaning that users still have to configure each application separately. However, KNotes aside, it seems to be a very usable and full-featured groupware suite. Unlike Evolution, Kontact does allow the user to de-integrate the suite as well. For example, if a user prefers to use a different e-mail client, they can disable KMail's integration and use Kontact without the KMail component.

Though it was released separately, I also looked at some of the KOffice 1.3 components. KOffice 1.3 includes all the usual office suite suspects, a word processor (KWord), spreadsheet (KSpread) and a presentation program (KPresenter). It also includes five other productivity applications, including Kivio for creating flowcharts and a vector drawing application called Karbon14. I didn't have time to test all of the office applications extensively, but I did test out KWord and KSpread using a few Microsoft Office docs. KSpread's import features have definitely improved, as have KWord's. However, KWord still had problems with some Microsoft Word documents that open fine in OpenOffice.org. KOffice 1.3 has been officially released and is available now.

Ever wonder what's taking up so much disk space? 3.2 includes an application called Filelight that generates an interactive graphical representation of your file system, or just part of the filesystem. For users with a large number of files, it may take some time. It took Filelight about three minutes to generate a map of all 305,184 files in my home directory. When a user drills down into the file map generated by Firelight, it's possible to open files that KDE has associations for. I stumbled on this feature by accident by clicking on an HTML file in the Filelight map. Unfortunately, Filelight doesn't offer the ability to delete files.

With a few notable exceptions, the 3.2rc1 release has proved to be very stable overall. It isn't a huge leap in functionality from the 3.1.x releases, but 3.2 includes enough refinements and new features to make the move from 3.1 to 3.2 well worth it. There are far too many improvements in 3.2 to go into here, but suffice it to say that KDE users are in for a treat when the final 3.2 release goes "gold." According to the release schedule, 3.2 final is slated to be released on Monday, February 2nd.

Comments (8 posted)

Just another Microsoft worm

Certainly the "MyDoom" worm has gotten our attention. By some accounts it is the fastest-spreading email-based worm ever; there is no doubt that it has filled our mailboxes with garbage - both the worm itself and the inevitable piles of "virus notification" spam that this sort of worm generates. Interestingly, claims have appeared in the media that this worm does not actually exploit any Windows security holes. We know better, of course; the fact that a worm like MyDoom can exist at all is a clear vulnerability.

So far, this episode just looks like yet another in the interminable series of worms hosted by the Microsoft computing environment. The story gets more interesting, however, with the fact that this worm seemingly contains code to execute a denial-of-service attack against the SCO Group's web site on February 1, thus ruining Darl McBride's Super Bowl experience. This attack has, of course, been widely reported in the mainstream media as an act carried out by the Linux community in retaliation for SCO's attempts to steal or destroy our work. (SCO itself, in its press release offering a bounty for the worm writer's head, took a relatively neutral tone: "We do not know the origins or reasons for this attack, although we have our suspicions.")

You knew this paragraph was coming: the free software community does not and cannot go for attacks of this sort. This worm is an act of vandalism which does not help our cause in any way. It will not affect SCO's legal campaign, and can only help the company's PR campaign. Rather than try to silence the company's web site, we need to let SCO's words be distributed as widely as possible. The more they talk, the deeper they dig themselves in. It is not for nothing that this picture was recently circulated with the caption "SCO's legal team in action." Trying to shut down SCO's web site via DOS attacks is morally wrong and simply counterproductive.

The fact is that this worm almost certainly has nothing to do with SCO or Linux. The SCO attack has does a good job of covering over a few other little details about this worm: it does, after all, install a keystroke logger, a spam relay, and an open port which can be used to feed arbitrary code into the compromised system. MyDoom turns the system into a general attack platform; the DOS attack looks thrown in as an afterthought. This worm is not primarily a machine for attacking SCO; it is constructing a large-scale distributed network of compromised systems.

The media likes the "SCO attack" story, however, and thus the damage is done. The community has been portrayed as a set of outlaw crackers trying to settle a grudge. In fact, we, too, are victims of this worm. Our networks are flooded and our mailboxes are clogged, even though our Linux systems are, as usual, immune to the worm itself. And our reputation has taken a hit because it suits some people to portray this worm as furthering our agenda. There is nothing about MyDoom which has been good for the community.

There is little we can do to respond to this worm that we have not been doing for some time. We can and will deplore this sort of attack, regardless of who the victim is. We can try to raise awareness of the fact that these worms are very much the product of one set of proprietary operating systems with designed-in security problems, and we can let the world know that we have an alternative which is not a worm-breeding platform. This message may just be heard: companies dealing with the consequences of MyDoom and its countless predecessors have suffered far more than SCO will; they cannot help but be increasingly receptive to alternative systems. And, most of all, we can continue to work to improve our own security so that we have a chance of actually living up to our promise of being a worm-free alternative.

Comments (30 posted)

LWN gets a new server

The folks at Rackspace Managed Hosting have been hosting the LWN.net front-line server for almost two years now - ever since our un-acquisition from Tucows. We have never had anything but great support and service from Rackspace during this time, despite the fact that they have been donating this service to LWN in exchange for a few banner ads. As LWN's traffic has grown, however, we have overrun the capabilities of both our two-year-old server and the bandwidth that was allotted to it. So we've had to put some real thought into how to continue to provide a responsive site with all the new features that readers have been requesting.

We are now happy to acknowledge that Rackspace has not only given us a newer, faster server, but it has also upped our monthly bandwidth limit donation to a level that should be sufficient for a while. Rackspace has done a lot over the last two years to help keep LWN on the net. We would like to say "Thanks, Rackspace!" for continuing to come forward and help keep the site alive.

Comments (7 posted)

Page editor: Jonathan Corbet

Security

Brief items

The OWASP top ten web application vulnerabilities

The Open Web Application Security Project has issued a new version of its top-ten list of web application security vulnerabilities; the full version is available from the SourceForge download network in PDF format. The list is little changed from last year - web sites are still being attacked using the same sorts of vulnerabilities. This year's list is:

1. Unvalidated input, usually in the form of playing with HTTP requests. Many of the other problems on this list come down to input validation problems in the end.

2. Broken access control mechanisms. Access control is often an oversight, and often implemented poorly.

3. Broken authentication and session management. Among other things, the study points out that identifiers like session cookies must be protected by SSL or session hijacking is possible.

4. Cross-site scripting. ("The likelihood that a site contains XSS vulnerabilities is extremely high").

5. Buffer overflows. Web applications are certainly not unique in suffering from this class of vulnerabilities, of course. The paper singles out Java-based web applications as being immune to buffer overflow attacks.

6. Injection flaws with SQL injection topping the list.

7. Improper error handling which discloses internal information.

8. Insecure storage; being the failure to use (good) encryption when storing important information.

9. Denial of service, in all the usual ways.

10. Bad configuration management, such as the failure to apply security updates and poor system administration in general.

This is a daunting list for anybody trying to deploy any sort of web application in a secure manner. There are so many things which can go wrong. The risks of running a web application can be managed, however. The first step toward that end is developing an awareness of where the pitfalls lie; OWASP, in compiling its list, has helped us to take a step in that direction.

Comments (1 posted)

New vulnerabilities

gaim: remote overflows

Package(s):	gaim	CVE #(s):	CAN-2004-0006 CAN-2004-0007 CAN-2004-0008
Created:	January 26, 2004	Updated:	February 17, 2004
Description:	Stefan Esser has discovered several vulnerabilities in Gaim 0.75. This advisory has details of 12 separate vulnerabilities.
Alerts:	Fedora FEDORA-2004-070 2004-02-16 Whitebox WBSA-2004:033-01 2004-02-12 Conectiva CLA-2004:813 2004-02-10 Red Hat RHSA-2004:045-01 2004-02-09 Debian DSA-434-1 2004-02-05 Mandrake MDKSA-2004:006-1 2004-01-30 SuSE SuSE-SA:2004:004 2004-01-29 Gentoo 200401-04 2004-01-27 Mandrake MDKSA-2004:006 2004-01-26 Slackware SSA:2004-026-01 2004-01-26 Red Hat RHSA-2004:033-01 2004-01-23 Red Hat RHSA-2004:032-01 2004-01-23

Comments (none posted)

mod_python: denial of service vulnerability

Package(s):	mod_python	CVE #(s):	CAN-2003-0973
Created:	January 27, 2004	Updated:	October 4, 2004
Description:	Apache's mod_python module could crash the httpd process if a specific, malformed query string was sent. The Apache Foundation has reported that mod_python may be prone to Denial of Service attacks when handling a malformed query. Mod_python 2.7.9 was released to fix the vulnerability, however, because the vulnerability has not been fully fixed, version 2.7.10 has been released. Users of mod_python 3.0.4 are not affected by this vulnerability.
Alerts:	Fedora-Legacy FLSA:1325 2004-10-03 Conectiva CLA-2004:837 2004-04-12 Whitebox WBSA-2004:058-01 2004-03-01 Debian DSA-452-1 2004-02-29 Red Hat RHSA-2004:058-01 2004-02-26 Red Hat RHSA-2004:063-01 2004-02-26 Gentoo 200401-03 2004-01-27

Comments (none posted)

trr19 - privilege leakage

Package(s):	trr19	CVE #(s):	CAN-2004-0047
Created:	January 28, 2004	Updated:	January 28, 2004
Description:	The trr19 utility fails to drop group privileges, thus giving group access to a local attacker.
Alerts:	Debian DSA-430-1 2004-01-28

Comments (none posted)

Updated vulnerabilities

apache: buffer overflows in mod_alias, mod_rewrite

Package(s):	apache	CVE #(s):	CAN-2003-0542 CAN-2003-0789
Created:	October 28, 2003	Updated:	February 13, 2004
Description:	André Malo discovered buffer overflows in the mod_alias and mod_rewrite modules of the Apache webserver. These occurred if a regular expression with more than 9 capturing parenthesis was configured. To exploit this, an attacker would need to be able to locally create a carefully crafted configuration file (.htaccess or httpd.conf). CAN-2003-0542 Another buffer overflow in Apache 2.0.47 and earlier in mod_cgid's mishandling of CGI redirect paths could result in CGI output going to the wrong client when a threaded MPM is used. CAN-2003-0789.
Alerts:	Whitebox WBSA-2004:015-01 2004-02-12 Fedora FEDORA-2003-004 2004-01-08 Red Hat RHSA-2003:405-00 2003-12-18 Red Hat RHSA-2003:320-01 2003-12-16 Red Hat RHSA-2003:360-01 2003-12-10 Gentoo 200310-03 2003-10-28 Trustix 2003-0041 2003-11-15 Conectiva CLA-2003:775 2003-11-05 Slackware SSA:2003-308-01 2003-11-03 EnGarde ESA-20031105-030 2003-11-05 Mandrake MDKSA-2003:103 2003-11-03 Gentoo 200310-04 2003-10-31 Immunix IMNX-2003-7+-025-01 2003-10-28 OpenPKG OpenPKG-SA-2003.046 2003-10-28

Comments (none posted)

apache2: Denial of Service vulnerability

Package(s):	apache2	CVE #(s):
Created:	September 29, 2003	Updated:	March 25, 2004
Description:	A problem was discovered in Apache2 where CGI scripts that write more than 4k to the standard error stream will hang the script's execution. This problem can lead to a denial of service situation. See this bug report for additional details.
Alerts:	Gentoo 200403-04 2004-03-22 Netwosix NW-2004-0006 2004-03-25 Mandrake MDKSA-2003:096-1 2003-10-24 Mandrake MDKSA-2003:096 2003-09-26

Comments (none posted)

bind: cache poisoning

Package(s):	bind	CVE #(s):	CAN-2003-0914
Created:	November 26, 2003	Updated:	February 19, 2004
Description:	A cache poisoning vulnerability in BIND may be exploited causing a temporary denial of service until the bad record expires from the cache.
Alerts:	SCO Group CSSA-2004-003.0 2004-02-19 Debian DSA-409-1 2004-01-05 SuSE SuSE-SA:2003:047 2003-11-28 Trustix 2003-0044 2003-11-27 Immunix IMNX-2003-7+-024-01 2003-10-27 EnGarde ESA-20031126-031 2003-11-26

Comments (none posted)

CUPS: denial of service

Package(s):	CUPS	CVE #(s):	CAN-2003-0788
Created:	November 3, 2003	Updated:	March 4, 2004
Description:	Paul Mitcheson reported a situation where the CUPS Internet Printing Protocol (IPP) implementation in CUPS versions prior to 1.1.19 would get into a busy loop. This could result in a denial of service. In order to exploit this bug an attacker would need to have the ability to make a TCP connection to the IPP port (by default 631).
Alerts:	SCO Group CSSA-2004-012.0 2004-03-03 Conectiva CLA-2003:779 2003-11-07 Mandrake MDKSA-2003:104 2003-11-05 Red Hat RHSA-2003:275-01 2003-11-03

Comments (none posted)

cvs: possible root compromise

Package(s):	cvs	CVE #(s):	CAN-2003-0977
Created:	December 29, 2003	Updated:	February 13, 2004
Description:	Stable CVS 1.11.11 has been released, adding code to the CVS server to prevent it from continuing as root after a user login, as an extra failsafe against a compromise of the CVSROOT/passwd file.
Alerts:	Whitebox WBSA-2004:004-01 2004-02-12 Fedora-Legacy FLSA:1207 2004-01-28 Conectiva CLA-2004:808 2004-01-20 Debian DSA-422-1 2004-01-13 Red Hat RHSA-2004:003-01 2004-01-09 Gentoo 200312-08 2003-12-28

Comments (none posted)

ethereal: protocol dissector and other vulnerabilities

Package(s):	ethereal	CVE #(s):	CAN-2003-0925 CAN-2003-0926 CAN-2003-0927 CAN-2003-1012 CAN-2003-1013
Created:	December 19, 2003	Updated:	February 13, 2004
Description:	Serious issues have been discovered in two ethereal protocol dissectors. Both vulnerabilities will make the Ethereal application crash. The Q.931 vulnerability also affects Tethereal. It is not known if either vulnerability can be used to make Ethereal or Tethereal run arbitrary code. (CAN-2003-1012 and CAN-2003-1013)
Alerts:	Whitebox WBSA-2004:002-01 2004-02-12 Fedora-Legacy FLSA:1193 2004-01-31 Red Hat RHSA-2004:002-01 2004-01-05 Mandrake MDKSA-2004:002 2004-01-13 Conectiva CLA-2004:801 2004-01-07 Red Hat RHSA-2004:001-01 2004-01-07 Debian DSA-407-1 2004-01-05 Fedora FEDORA-2003-040 2003-12-18

Comments (none posted)

Filename disclosure vulnerability in fam

Package(s):	fam	CVE #(s):	CAN-2002-0875
Created:	August 19, 2002	Updated:	January 5, 2005
Description:	"fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible.
Alerts:	Red Hat RHSA-2005:005-01 2005-01-05 Debian DSA-154-1 2002-08-15

Comments (none posted)

fetchmail may crash on specially crafted message

Package(s):	fetchmail	CVE #(s):	CAN-2003-0792
Created:	October 17, 2003	Updated:	April 8, 2004
Description:	A bug was discovered in fetchmail 6.2.4 where a specially crafted email message can cause fetchmail to crash.
Alerts:	OpenPKG OpenPKG-SA-2004.012 2004-04-08 Gentoo 200403-10 2004-03-30 Netwosix NW-2004-0002 2004-02-20 SCO Group CSSA-2004-004.0 2004-02-19 Slackware SSA:2003-300-02 2003-10-22 Mandrake MDKSA-2003:101 2003-10-16

Comments (none posted)

fileutils/wu-ftpd: denial of service

Package(s):	fileutils	CVE #(s):	CAN-2003-0854
Created:	October 22, 2003	Updated:	March 2, 2004
Description:	There is, it seems, an integer overflow vulnerability in "ls" which can be exploited via wu-ftpd to create a denial of service situation. See this advisory from Georgi Guninski for details.
Alerts:	SCO Group CSSA-2004-006.0 2004-03-01 Trustix 2003-0042 2003-11-15 Mandrake MDKSA-2003:106 2003-11-12 Red Hat RHSA-2003:309-01 2003-11-03 Immunix IMNX-2003-7+-026-01 2003-10-31 Conectiva CLA-2003:771 2003-10-24 Conectiva CLA-2003:768 2003-10-22

Comments (none posted)

glibc: DNS stub resolvers contain buffer overflow vulnerability

Package(s):	glibc	CVE #(s):	CAN-2002-1146
Created:	November 7, 2002	Updated:	February 5, 2004
Description:	DNS stub resolvers from multiple vendors contain a buffer overflow vulnerability. The impact of this vulnerability appears to be limited to denial of service. (See CERT Vulnerability Note VU#738331) The BIND 4 and BIND 8.2.x stub resolver libraries, and other libraries such as glibc 2.2.5 and earlier, libc, and libresolv, uses the maximum buffer size instead of the actual size when processing a DNS response, which causes the stub resolvers to read past the actual boundary ("read buffer overflow"), allowing remote attackers to cause a denial of service (crash).
Alerts:	Mandrake MDKSA-2004:009 2004-02-04 Red Hat RHSA-2002:197-09 2002-11-06 Red Hat RHSA-2002:197-06 2002-10-03

Comments (none posted)

GnuPG: ElGamal signing keys compromised

Package(s):	gnupg	CVE #(s):	CAN-2003-0971
Created:	November 28, 2003	Updated:	March 3, 2004
Description:	A severe vulnerability was discovered in GnuPG by Phong Nguyen relating to ElGamal sign+encrypt keys. This email message from Werner Koch contains more information. "Phong Nguyen identified a severe bug in the way GnuPG creates and uses ElGamal keys for signing. This is a significant security failure which can lead to a compromise of almost all ElGamal keys used for signing. Note that this is a real world vulnerability which will reveal your private key within a few seconds."
Alerts:	SCO Group CSSA-2004-009.0 2004-03-02 Debian DSA-429-2 2004-02-13 Debian DSA-429-1 2004-01-26 Gentoo 200312-05 2003-12-12 Fedora FEDORA-2003-025 2003-12-10 Red Hat RHSA-2003:395-01 2003-12-10 Red Hat RHSA-2003:390-01 2003-12-10 Conectiva CLA-2003:798 2003-12-09 SuSE SuSE-SA:2003:048 2003-12-03 Mandrake MDKSA-2003:109 2003-11-28

Comments (3 posted)

gtkhtml: malformed messages cause crash

Package(s):	gtkhtml	CVE #(s):	CAN-2003-0133 CAN-2003-0541
Created:	April 14, 2003	Updated:	April 18, 2005
Description:	GtkHTML is the HTML rendering widget used by the Evolution mail reader. GtkHTML supplied with versions of Evolution prior to 1.2.4 contain a bug when handling HTML messages. Alan Cox discovered that certain malformed messages could cause the Evolution mail component to crash.
Alerts:	Debian DSA-710-1 2005-04-18 Mandrake MDKSA-2003:093 2003-09-18 Conectiva CLA-2003:737 2003-09-12 Red Hat RHSA-2003:264-01 2003-09-09 Mandrake MDKSA-2003:046 2003-04-15 Red Hat RHSA-2003:126-01 2003-04-14

Comments (none posted)

iproute: local denial of service

Package(s):	iproute net-tools	CVE #(s):	CAN-2003-0856
Created:	November 25, 2003	Updated:	December 14, 2004
Description:	The iproute utility is susceptible to spoofed netlink messages sent by local users, with the result that denial of service attacks are possible.
Alerts:	Mandrake MDKSA-2004:148 2004-12-13 Fedora FEDORA-2004-154 2004-06-03 Fedora FEDORA-2004-115 2004-05-11 Debian DSA-492-1 2004-04-18 Gentoo 200404-10 2004-04-09 Red Hat RHSA-2003:316-01 2003-11-24

Comments (none posted)

jabber: denial of service

Package(s):	jabber	CVE #(s):	CAN-2004-0013
Created:	January 7, 2004	Updated:	January 26, 2004
Description:	A vulnerability was discovered in jabber, an instant messaging server, whereby a bug in the handling of SSL connections could cause the server process to crash, resulting in a denial of service.
Alerts:	Mandrake MDKSA-2004:005 2004-01-23 Debian DSA-414-1 2004-01-06

Comments (1 posted)

kdepim: VCF file information reader vulnerability

Package(s):	kdepim	CVE #(s):	CAN-2003-0988
Created:	January 15, 2004	Updated:	May 26, 2004
Description:	KDE has issued a security advisory for all versions of kdepim as distributed with KDE versions 3.1.0 through 3.1.4 inclusive. A carefully crafted .VCF file potentially enables local attackers to compromise the privacy of a victim's data or execute arbitrary commands with the victim's privileges. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0988 to this issue.
Alerts:	Fedora FEDORA-2004-133 2004-05-19 Gentoo 200404-02 2004-04-06 Whitebox WBSA-2004:005-01 2004-02-12 Conectiva CLA-2004:810 2004-01-20 Slackware SSA:2004-014-01 2004-01-14 Mandrake MDKSA-2004:003 2004-01-14 Red Hat RHSA-2004:006-01 2004-01-07

Comments (none posted)

kernel: privilege vulnerability on AMD64

Package(s):	kernel	CVE #(s):	CAN-2004-0001
Created:	January 16, 2004	Updated:	February 17, 2004
Description:	On AMD64 systems, a fix was made to the eflags checking in 32-bit ptrace emulation that could have allowed local users to elevate their privileges. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0001 to this issue.
Alerts:	Gentoo 200402-06 2004-02-17 Red Hat RHSA-2004:017-01 2004-01-13

Comments (none posted)

kernel: local root exploit in 2.4.22

Package(s):	kernel	CVE #(s):	CAN-2003-0961
Created:	December 1, 2003	Updated:	April 5, 2004
Description:	A vulnerability was discovered in the Linux kernel versions 2.4.22 and previous. A flaw in bounds checking in the do_brk() function can allow a local attacker to gain root privileges. This vulnerability is known to be exploitable. The 2.4.23 kernel contains the fix. For more details on how this vulnerability works, see this LWN article.
Alerts:	Debian DSA-475-1 2004-04-05 Debian DSA-470-1 2004-04-01 Debian DSA-442-1 2004-02-19 Debian DSA-433-1 2004-02-04 Debian DSA-423-1 2004-01-15 Red Hat RHSA-2003:368-01 2003-12-19 Conectiva CLA-2003:796 2003-12-05 Gentoo 200312-02 2003-12-04 SuSE SuSE-SA:2003:049 2003-12-04 Yellow Dog YDU-20031203-1 2003-12-03 Red Hat RHSA-2003:389-01 2003-12-01 Fedora FEDORA-2003-026 2003-12-02 Slackware SSA:2003-336-01 2003-12-01 Red Hat RHSA-2003:392-00 2003-12-01 Trustix 2003-0046 2003-12-01 Mandrake MDKSA-2003:110 2003-12-01 Debian DSA-403-1 2003-12-01

Comments (1 posted)

kernel-utils: setuid vulnerability

Package(s):	kernel-utils	CVE #(s):	CAN-2003-0019
Created:	February 7, 2003	Updated:	January 21, 2005
Description:	The kernel-utils package contains several utilities that can be used to control the kernel or machine hardware. In Red Hat Linux 8.0 this package contains user mode linux (UML) utilities. The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was incorrectly shipped setuid root. This could allow local users to control certain network interfaces, add and remove arp entries and routes, and put interfaces in and out of promiscuous mode. All users of the kernel-utils package should update to these packages that contain a version of uml_net that is not setuid root. Alternatively, as a work-around to this vulnerability issue the following command as root: chmod -s /usr/bin/uml_net
Alerts:	Red Hat RHSA-2003:056-08 2003-02-07

Comments (none posted)

lftp buffer overflows

Package(s):	lftp	CVE #(s):	CAN-2003-0963
Created:	December 15, 2003	Updated:	February 13, 2004
Description:	According to this advisory versions of lftp prior to 2.6.10 are vulnerable to two exploitable buffer overflow problems. Both occur when you connect to a web server with lftp using HTTP or HTTPS, and then use lftp's "ls" or "rels" commands on specially prepared directories on the web server.
Alerts:	Whitebox WBSA-2003:404-01 2003-12-17 Conectiva CLA-2004:800 2004-01-06 Debian DSA-406-1 2004-01-05 Gentoo 200312-07 2003-12-16 OpenPKG OpenPKG-SA-2003.053 2003-12-17 Red Hat RHSA-2003:404-01 2003-12-16 Red Hat RHSA-2003:403-01 2003-12-16 Mandrake MDKSA-2003:116 2003-12-15 Fedora FEDORA-2003-034 2003-12-15 SuSE SuSE-SA:2003:051 2003-12-15 Immunix IMNX-2003-73-002-01 2003-12-09 Slackware SSA:2003-346-01 2003-12-12

Comments (none posted)

libpng, libpng3: buffer overflow

Package(s):	libpng, libpng3	CVE #(s):	CAN-2002-1363
Created:	December 19, 2002	Updated:	July 14, 2004
Description:	Glenn Randers-Pehrson discovered a problem in connection with 16-bit samples from libpng, an interface for reading and writing PNG (Portable Network Graphics) format files. The starting offsets for the loops are calculated incorrectly which causes a buffer overrun beyond the beginning of the row buffer.
Alerts:	Gentoo 200407-06 2004-07-08 OpenPKG OpenPKG-SA-2004.030 2004-07-06 Mandrake MDKSA-2004:063 2004-06-29 Whitebox WBSA-2004:249-01 2004-06-21 Fedora FEDORA-2004-176 2004-06-18 Fedora FEDORA-2004-174 2004-06-18 Fedora FEDORA-2004-175 2004-06-18 Fedora FEDORA-2004-173 2004-06-18 Red Hat RHSA-2004:249-01 2004-06-18 Conectiva CLA-2003:564 2003-01-23 Mandrake MDKSA-2003:008 2003-01-20 OpenPKG OpenPKG-SA-2003.001 2003-01-15 Yellow Dog YDU-20030114-2 2002-01-14 SuSE SuSE-SA:2003:0004 2003-01-14 Red Hat RHSA-2003:006-06 2003-01-09 Debian DSA-213-1 2002-12-19

Comments (none posted)

mc: arbitrary code execution

Package(s):	mc	CVE #(s):	CAN-2003-1023
Created:	January 16, 2004	Updated:	April 5, 2004
Description:	A vulnerability was discovered in Midnight Commander, a file manager, whereby a malicious archive (such as a .tar file) could cause arbitrary code to be executed if opened by Midnight Commander.
Alerts:	OpenPKG OpenPKG-SA-2004.009 2004-04-05 Gentoo 200403-09 2004-03-29 Conectiva CLA-2004:833 2004-03-31 SCO Group CSSA-2004-014.0 2004-03-25 Whitebox WBSA-2004:035-01 2004-02-12 Fedora FEDORA-2004-058 2004-02-09 Red Hat RHSA-2004:035-01 2004-01-19 Mandrake MDKSA-2004:007 2004-01-26 Red Hat RHSA-2004:034-01 2004-01-19 Debian DSA-424-1 2004-01-16

Comments (none posted)

mikmod: buffer overflow

Package(s):	mikmod	CVE #(s):	CAN-2003-0427
Created:	June 16, 2003	Updated:	June 16, 2005
Description:	Ingo Saitz discovered a bug in mikmod whereby a long filename inside an archive file can overflow a buffer when the archive is being read by mikmod.
Alerts:	Fedora FEDORA-2005-405 2005-06-16 Red Hat RHSA-2005:506-01 2005-06-13 Fedora FEDORA-2005-404 2005-06-09 Gentoo 200307-01 2003-07-02 Debian DSA-320-1 2003-06-13

Comments (none posted)

mpg123: heap overflow

Package(s):	mpg123	CVE #(s):	CAN-2003-0865
Created:	November 12, 2003	Updated:	February 19, 2004
Description:	Versions of mpg123 through 0.59s contain a heap overflow which may be exploited remotely (by a hostile server). See this advisory for details.
Alerts:	SCO Group CSSA-2004-002.0 2004-02-19 Debian DSA-435-1 2004-02-06 Conectiva CLA-2003:781 2003-11-12

Comments (none posted)

mpg321: format string vulnerability

Package(s):	mpg321	CVE #(s):	CAN-2003-0969
Created:	January 6, 2004	Updated:	March 28, 2005
Description:	A vulnerability was discovered in mpg321, a command-line mp3 player, whereby user-supplied strings were passed to printf(3) unsafely. This vulnerability could be exploited by a remote attacker to overwrite memory, and possibly execute arbitrary code. In order for this vulnerability to be exploited, mpg321 would need to play a malicious mp3 file (including via HTTP streaming).
Alerts:	Gentoo 200503-34 2005-03-28 Debian DSA-411-1 2004-01-05

Comments (none posted)

mplayer: remotely exploitable buffer overflow vulnerability

Package(s):	mplayer	CVE #(s):	CAN-2003-0835
Created:	September 29, 2003	Updated:	April 6, 2004
Description:	A remotely exploitable buffer overflow vulnerability was found in MPlayer. A malicious host can craft a harmful ASX header, and trick MPlayer into executing arbitrary code upon parsing that header. Read the full advisory for details.
Alerts:	Mandrake MDKSA-2004:026 2004-04-05 Gentoo 200403-13 2004-03-31 Conectiva CLA-2003:760 2003-10-06 Mandrake MDKSA-2003:097 2003-09-30 Gentoo 200309-15 2003-09-27

Comments (none posted)

Nessus NASL scripting engine security issues

Package(s):	nessus	CVE #(s):
Created:	May 27, 2003	Updated:	August 12, 2004
Description:	Some some vulnerabilities exsist in the Nessus NASL scripting engine. To exploit these flaws, an attacker would need to have a valid Nessus account as well as the ability to upload arbitrary Nessus plugins in the Nessus server (this option is disabled by default) or he/she would need to trick a user somehow into running a specially crafted nasl script. Read the full advisory for additional information.
Alerts:	Gentoo 200305-10 2003-05-27

Comments (none posted)

netpbm: insecure temporary files

Package(s):	netpbm	CVE #(s):	CAN-2003-0924
Created:	January 19, 2004	Updated:	December 29, 2004
Description:	netpbm is graphics conversion toolkit made up of a large number of single-purpose programs. Many of these programs were found to create temporary files in an insecure manner, which could allow a local attacker to overwrite files with the privileges of the user invoking a vulnerable netpbm tool.
Alerts:	Conectiva CLA-2004:909 2004-12-29 Gentoo 200410-02 2004-10-04 Mandrake MDKSA-2004:011-1 2004-09-27 Whitebox WBSA-2004:031-01 2004-02-12 Mandrake MDKSA-2004:011 2004-02-11 Red Hat RHSA-2004:030-01 2004-02-05 Fedora FEDORA-2004-068 2004-02-06 Red Hat RHSA-2004:031-01 2004-01-22 Debian DSA-426-1 2004-01-18

Comments (1 posted)

Net-SNMP: security bugs in versions before 5.0.9

Package(s):	Net-SNMP	CVE #(s):	CAN-2003-0935
Created:	December 2, 2003	Updated:	February 13, 2004
Description:	The Net-SNMP project includes various Simple Network Management Protocol (SNMP) tools. A security issue in Net-SNMP versions before 5.0.9 could allow an existing user/community to gain access to data in MIB objects that were explicitly excluded from their view. Version 5.0.9 of Net-SNMP is not vulnerable to this issue. In addition, Net-SNMP 5.0.9 fixes a number of other minor bugs.
Alerts:	Whitebox WBSA-2004:023-01 2004-02-12 Red Hat RHSA-2004:023-01 2004-01-15 Mandrake MDKSA-2003:115 2003-12-11 Red Hat RHSA-2003:335-01 2003-12-02

Comments (none posted)

nfs-utils xlog() off-by-one bug

Package(s):	nfs-utils	CVE #(s):	CAN-2003-0252
Created:	July 14, 2003	Updated:	March 8, 2004
Description:	Linux NFS utils package contains remotely exploitable off-by-one bug. A local or remote attacker could exploit this vulnerability by sending specially crafted request to rpc.mountd daemon. See this BugTraq post for more details.
Alerts:	Trustix TSLSA-2004-0009 2004-03-05 SCO Group CSSA-2003-037.0 2003-11-17 Conectiva CLA-2003:700 2003-07-22 Mandrake MDKSA-2003:076 2003-07-21 Gentoo 200307-07 2003-07-19 Yellow Dog YDU-20030718-1 2003-07-18 Slackware SSA:2003-195-01b 2003-07-15 Immunix IMNX-2003-7+-018-01 2003-07-14 SuSE SuSE-SA:2003:031 2003-07-15 Slackware SSA:2003-195-01 2003-07-14 Debian DSA-349-1 2003-07-14 Red Hat RHSA-2003:206-01 2003-07-14

Comments (none posted)

openssh: timing attack leads to information disclosure

Package(s):	openssh	CVE #(s):	CAN-2003-0190
Created:	May 2, 2003	Updated:	November 30, 2004
Description:	From the advisory: "During a pen-test we stumbled across a nasty bug in OpenSSH-portable with PAM support enabled (via the --with-pam configure script switch). This bug allows a remote attacker to identify valid users on vulnerable systems, through a simple timing attack. The vulnerability is easy to exploit and may have high severity, if combined with poor password policies and other security problems that allow local privilege escalation."
Alerts:	Ubuntu USN-34-1 2004-11-30 OpenPKG OpenPKG-SA-2003.035 2003-08-06 Red Hat RHSA-2003:222-01 2003-07-29 Gentoo 200305-02 2003-05-13 Gentoo 200305-01 2002-03-05

Comments (1 posted)

postfix: denial of service vulnerabilities

Package(s):	postfix	CVE #(s):	CAN-2003-0468 CAN-2003-0540
Created:	August 5, 2003	Updated:	May 27, 2004
Description:	The postfix MTA, versions through 1.1.12 (but not 2.0) is subject to two remotely exploitable denial of service vulnerabilities; see this advisory from Michal Zalewski for details.
Alerts:	Mandrake MDKA-2004:028 2004-05-26 Trustix 2003-0029 2003-08-04 Mandrake MDKSA-2003:081 2003-08-04 EnGarde ESA-20030804-019 2003-08-04 Conectiva CLA-2003:717 2003-08-04 SuSE SuSE-SA:2003:033 2003-08-04 Red Hat RHSA-2003:251-01 2003-08-04 Debian DSA-363-1 2003-08-03

Comments (none posted)

qmail: integer overflow

Package(s):	qmail	CVE #(s):
Created:	January 21, 2004	Updated:	January 21, 2004
Description:	The qmail-smtpd server suffers from an integer overflow which may be exploited to crash (one instance of) the server process. It is not clear, at this point, whether the overflow may be exploited for more useful ends; the claims made in this advisory regarding overwriting of memory have been disputed. A patch has been posted which fixes the problem.
Alerts:	(No alerts in the database for this vulnerability)

Comments (none posted)

rsync - remotely exploitable heap overflow

Package(s):	rsync	CVE #(s):	CAN-2003-0962
Created:	December 4, 2003	Updated:	March 3, 2004
Description:	An advisory has gone out warning of a remotely exploitable heap overflow vulnerability in rsync versions 2.5.6 and prior. If you are running an rsync server, you will want to apply a distributor patch or upgrade to 2.5.7 in the near future.
Alerts:	SCO Group CSSA-2004-010.0 2004-03-02 Immunix IMNX-2003-73-001-01 2003-12-05 Mandrake MDKSA-2003:111 2003-12-04 Red Hat RHSA-2003:399-01 2003-12-04 Red Hat RHSA-2003:398-01 2003-12-04 Fedora FEDORA-2003-030 2003-12-04 Conectiva CLA-2003:794 2003-12-04 Gentoo 200312-03 2003-12-04 EnGarde ESA-20031204-032 2003-12-04 Debian DSA-404-1 2003-12-04 OpenPKG OpenPKG-SA-2003.051 2003-12-04 SuSE SuSE-SA:2003:050 2003-12-04 Trustix 2003-0048 2003-12-04 Slackware SSA:2003-337-01 2003-12-03

Comments (none posted)

Multiple-use vulnerability in Safe.pm

Package(s):	Safe.pm	CVE #(s):	CAN-2002-1323
Created:	October 9, 2002	Updated:	February 20, 2004
Description:	usePerl has a description of a vulnerability in the Safe.pm Perl module. It seems that if a Safe compartment is used more than once, it ceases to be safe. The problem is fixed in Safe 2.08.
Alerts:	SCO Group CSSA-2004-007.0 2004-02-20 Gentoo 200212-6 2002-12-20 Trustix 2002-0087 2002-12-19 OpenPKG OpenPKG-SA-2002.014 2002-12-16 Debian DSA-208-1 2002-12-12

Comments (none posted)

sane-backends: several vulnerabilities

Package(s):	sane-backends	CVE #(s):	CAN-2003-0773 CAN-2003-0774 CAN-2003-0775 CAN-2003-0776 CAN-2003-0777 CAN-2003-0778
Created:	September 11, 2003	Updated:	February 20, 2004
Description:	Alexander Hvostov, Julien Blache and Aurelien Jarno discovered several security-related problems in the sane-backends package, which contains an API library for scanners including a scanning daemon (in the package libsane) that can be remotely exploited. These problems allow a remote attacker to cause a segfault fault and/or consume arbitrary amounts of memory. The attack is successful, even if the attacker's computer isn't listed in saned.conf. You are only vulnerable if you actually run saned e.g. in xinetd or inetd. If the entries in the configuration file of xinetd or inetd respectively are commented out or do not exist, you are safe. Try "telnet localhost 6566" on the server that may run saned. If you get "connection refused" saned is not running and you are safe. The Common Vulnerabilities and Exposures project identifies the following problems: CAN-2003-0773: saned checks the identity (IP address) of the remote host only after the first communication took place (SANE_NET_INIT). So everyone can send that RPC, even if the remote host is not allowed to scan (not listed in saned.conf). CAN-2003-0774: saned lacks error checking nearly everywhere in the code. So connection drops are detected very late. If the drop of the connection isn't detected, the access to the internal wire buffer leaves the limits of the allocated memory. So random memory "after" the wire buffer is read which will be followed by a segmentation fault. CAN-2003-0775: If saned expects strings, it mallocs the memory necessary to store the complete string after it receives the size of the string. If the connection was dropped before transmitting the size, malloc will reserve an arbitrary size of memory. Depending on that size and the amount of memory available either malloc fails (->saned quits nicely) or a huge amount of memory is allocated. Swapping and OOM measures may occur depending on the kernel. CAN-2003-0776: saned doesn't check the validity of the RPC numbers it gets before getting the parameters. CAN-2003-0777: If debug messages are enabled and a connection is dropped, non-null-terminated strings may be printed and segmentation faults may occur. CAN-2003-0778: It's possible to allocate an arbitrary amount of memory on the server running saned even if the connection isn't dropped. At the moment this can not easily be fixed according to the author. Better limit the total amount of memory saned may use (ulimit).
Alerts:	SCO Group CSSA-2004-005.0 2004-02-19 SuSE SuSE-SA:2003:046 2003-11-18 Conectiva CLA-2003:769 2003-10-22 Mandrake MDKSA-2003:099 2003-10-09 Red Hat RHSA-2003:278-01 2003-10-07 Debian DSA-379-1 2003-09-11

Comments (none posted)

screen: privilege escalation

Package(s):	screen	CVE #(s):	CAN-2003-0972
Created:	November 28, 2003	Updated:	March 3, 2004
Description:	According to this advisory a buffer overflow in GNU screen allows privilege escalation for local users. Usually screen is installed either setgid-utmp or setuid-root. It also has some potential for remote attacks or getting control of another user's screen. The problem is that you have to transfer around 2-3 gigabytes of data to user's screen to exploit this vulnerability. 4.0.1, 3.9.15 and older versions are vulnerable.
Alerts:	SCO Group CSSA-2004-011.0 2004-03-02 Fedora-Legacy FLSA:1187 2004-01-26 Conectiva CLA-2004:809 2004-01-20 Debian DSA-408-1 2004-01-05 Mandrake MDKSA-2003:113 2003-12-08 OpenPKG OpenPKG-SA-2003.050 2003-11-28

Comments (none posted)

slocate: buffer overflow

Package(s):	slocate	CVE #(s):	CAN-2003-0848
Created:	January 20, 2004	Updated:	February 16, 2004
Description:	A vulnerability was discovered in slocate, a program to index and search for files, whereby a specially crafted database could overflow a heap-based buffer. This vulnerability could be exploited by a local attacker to gain the privileges of the "slocate" group, which can access the global database containing a list of pathnames of all files on the system, including those which should only be visible to privileged users. This problem, and a category of potential similar problems, can be fixed by modifying slocate to drop privileges before reading a user-supplied database.
Alerts:	Fedora-Legacy FLSA:1232 2004-02-11 Whitebox WBSA-2004:041-01 2004-02-12 SCO Group CSSA-2004-001.0 2004-02-10 Fedora FEDORA-2004-059 2004-01-26 Red Hat RHSA-2004:041-01 2004-01-22 Mandrake MDKSA-2004:004 2004-01-23 Trustix 2004-0005 2004-01-21 Debian DSA-428-1 2004-01-20

Comments (none posted)

File overwrite vulnerability in tar and unzip

Package(s):	tar unzip	CVE #(s):	CAN-2001-1267 CAN-2001-1268 CAN-2001-1269 CAN-2002-0399
Created:	October 1, 2002	Updated:	April 10, 2006
Description:	The tar utility does not properly filter file names containing "../", meaning that a hostile archive can, if unpacked by an unsuspecting user, overwrite any file that is writable by that user. GNU tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42 has the same vulnerability.
Alerts:	Fedora-Legacy FLSA:183571-1 2006-04-04 Red Hat RHSA-2006:0195-01 2006-02-21 Conectiva CLA-2002:538 2002-10-29 Mandrake MDKSA-2002:066 2002-10-10 Mandrake MDKSA-2002:065 2002-10-10 EnGarde ESA-20021003-022 2002-10-03 Gentoo unzip-20021001 2002-10-01 Gentoo tar-20021001 2002-10-01 Red Hat RHSA-2002:096-24 2002-09-18

Comments (1 posted)

tcpdump: flaws in the ISAKMP decoding routines

Package(s):	tcpdump	CVE #(s):	CAN-2003-0989 CAN-2004-0057 CAN-2004-0055
Created:	January 15, 2004	Updated:	April 6, 2004
Description:	George Bakos discovered flaws in the ISAKMP decoding routines of tcpdump versions prior to 3.8.1. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0989 to this issue. Jonathan Heusser discovered two additional flaws in the ISAKMP decoding routines of tcpdump versions up to and including 3.8.1. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0057 to this issue. Jonathan Heusser discovered a flaw in the print_attr_string function in the RADIUS decoding routines for tcpdump 3.8.1 and earlier. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0055 to this issue. Remote attackers could potentially exploit these issues by sending carefully-crafted packets to a victim. If the victim uses tcpdump, these packets could result in a denial of service, or possibly execute arbitrary code as the 'pcap' user.
Alerts:	Gentoo 200404-03 2004-03-31 Fedora FEDORA-2004-091 2004-03-04 SCO Group CSSA-2004-008.0 2004-03-02 Fedora FEDORA-2004-092 2004-03-02 Whitebox WBSA-2004:008-01 2004-02-12 Fedora-Legacy FLSA:1222 2004-01-31 Mandrake MDKSA-2004:008 2004-01-26 EnGarde ESA-20040119-002 2004-01-19 Debian DSA-425-1 2004-01-16 OpenPKG OpenPKG-SA-2004.002 2004-01-16 Trustix 2004-0004 2004-01-05 SuSE SuSE-SA:2004:002 2004-01-14 Red Hat RHSA-2004:008-01 2004-01-15 Red Hat RHSA-2004:007-01 2004-01-14

Comments (none posted)

Multiple vendor telnetd vulnerability

Package(s):	telnet Telnet netkit-telnet-ssl kerberos telnetd netkit-telnet nkitb/nkitserv/telnetd krb5	CVE #(s):
Created:	May 21, 2002	Updated:	October 5, 2004
Description:	This vulnerability, originally thought to be confined to BSD-derived systems, was first covered in the July 26th Security Summary. It is now known that Linux telnet daemons are vulnerable as well.
Alerts:	Gentoo 200410-03 2004-10-05 Yellow Dog YDU-20010810-2 2001-08-10 Yellow Dog YDU-20010810-1 2001-08-10 SuSE SuSE-SA:2001:029 2001-09-03 Slackware sl-997726350 2001-08-09 Red Hat RHSA-2001:100-02 2001-08-09 Red Hat RHSA-2001:099-09 2002-02-07 Red Hat RHSA-2001:099-06 2001-08-09 Progeny PROGENY-SA-2001-27 2001-08-14 Mandrake MDKSA-2001:093 2001-12-17 Mandrake MDKSA-2001:068 2001-08-13 HP HPSBTL0202-023 2002-02-12 Debian DSA-075-2 2001-08-14 Debian DSA-075-1 2001-08-14 Conectiva CLA-2001:413 2001-08-24 SCO Group CSSA-2001-030.0 2001-08-10

Comments (none posted)

vim - modeline vulnerability

Package(s):	vim	CVE #(s):	CAN-2002-1377
Created:	January 16, 2003	Updated:	February 10, 2004
Description:	VIM allows a user to set the modeline differently for each edited text file by placing special comments in the files. Georgi Guninski found that these comments can be carefully crafted in order to call external programs. This could allow an attacker to create a text file such that when it is opened arbitrary commands are executed.
Alerts:	Conectiva CLA-2004:812 2004-02-10 Mandrake MDKSA-2003:012 2003-02-03 Yellow Dog YDU-20030127-3 2003-01-27 Gentoo 200301-13 2003-01-22 OpenPKG OpenPKG-SA-2003.003 2003-01-21 Red Hat RHSA-2002:297-17 2003-01-15

Comments (4 posted)

Resources

CERT and Homeland Security get together

CERT has sent out a new announcement of its partnership with the U.S. Department of Homeland Security, which has been going on for a few months. "While this new partnership, known as US-CERT, has been low key, we have been working aggressively to upgrade our capabilities." This aggressive upgrade, for the moment, seems to consist of a new set of security bulletins for non-technical users.

Full Story (comments: none)

Events

CodeCon program announced

The third annual CodeCon is happening February 20 to 22 in San Francisco. The program for the conference has been announced; click below for the details.

Full Story (comments: none)

Page editor: Jonathan Corbet

Kernel development

Brief items

Kernel release status

The current 2.6 release is 2.6.2-rc2, which Linus announced on January 25. Changes since -rc1 include a number of architecture updates, an IrDA update, and various fixes. See the long-format changelog for the details.

The latest patch set from Andrew Morton is 2.6.2-rc2-mm1. Changes in recent -mm kernels include compilation fixes for gcc 3.5, more scheduler tweaks, a new "_relaxed" API for unordered I/O memory accesses, some code for finding dangerous sleep_on() calls (see below), x86_64 kgdb support, and many other fixes.

The current 2.4 kernel is 2.4.24; Marcelo released 2.4.25-pre7, which includes a set of architecture and filesystem updates, on January 23. Marcelo also notes that 2.4 development will not freeze before 2.4.27; there is already a set of important patches that will need to go into 2.4.26.

Comments (2 posted)

Kernel development news

Cooperative Linux 0.51

Cooperative Linux is a project to make a kernel which can run cooperatively in kernel mode with other operating systems. The goal, in particular, is to run Linux as an application under Windows XP. That goal has now been achieved for "some common hardware configurations." Click below for the release announcement.

Full Story (comments: 16)

FUSE - implementing filesystems in user space

Last week we looked at implementing device drivers in user space. Drivers are not the only kernel functionality which can be moved across the divide, however; it is also possible to implement filesystems with user-space code. Linux has a long tradition of user-space filesystems, actually; NFS was implemented that way for quite some time. Even so, user-space filesystems are not widely used, for a number of obvious reasons (performance, security, ...). But there are situations where a user-space filesystem can be a nice thing to have.

For those situations, there is a project called FUSE. Its associated SourceForge page is not particularly enlightening; one really has to look at the project's code to understand what FUSE has to offer. Since the second FUSE 1.1 release candidate has just been announced, this seems like a good time for such an examination.

FUSE is a three-part system. The first of those parts is a kernel module which hooks into the VFS code and looks like a filesystem module. It also implements a special-purpose device which can be opened by a user-space process. It then spends its time accepting filesystem requests, translating them into its own protocol, and sending them out via the device interface. Responses to requests come back from user space via the FUSE device, and are translated back into the form expected by the kernel.

In user space, FUSE implements a library which manages communications with the kernel module. It accepts filesystem requests from the FUSE device and translates them into a set of function calls which look similar (but not identical) to the kernel's VFS interface. These functions have names like open(), read(), write(), rename(), symlink(), etc.

Finally, there is a user-supplied component which actually implements the filesystem of interest. It fills a fuse_operations structure with pointers to its functions which implement the required operations in whatever way makes sense. This interface is not well documented, but the example filesystem provided with FUSE (which implements a simple sort of loopback filesystem) is reasonably easy to follow.

An old filesystem module (AVFS) uses FUSE to make filesystems out of tar and zip files, but one could imagine any number of other possibilities. It would not be that hard to make filesystems which mirror a web site (in read-only mode, at least), provide access to an object database, or provide a file-per-user view of the password file, for example. FUSE could be an ideal platform for experimenters who want to take the "everything is a file" idea to its limit.

Comments (15 posted)

sleep_on() in 2.6.

One of the many goals for the 2.5 development series was the removal of the sleep_on() function (and its variants). The purpose of sleep_on() is to cause a process to block until some condition comes true; unfortunately, it is almost impossible to use safely. Almost every call to sleep_on() looks something like the following:

    while (we_have_to_wait)
	sleep_on(&some_wait_queue);

The problem is that the situation can change between the test (in the while loop) and when the process actually goes to sleep. If the wakeup event happens between the two, the process will miss it and may sleep forevermore. Given that 2.6 was intended to be a more responsive kernel than its predecessors, this behavior is considered undesirable. The only way to avoid it, however, is to hold the Big Kernel Lock (BKL) in the code which calls sleep_on() - and the code which performs the wakeup. Since elimination of the BKL was also on the to-do list, there is little enthusiasm for fixing sleep_on() race conditions that way.

The 2.4 kernel provided a couple of safer ways to sleep: the wait_event() macro or a full "manual sleep" calling schedule() directly (though the latter can be hard to do correctly). In 2.5, the prepare_to_sleep() function was added as an easier (and better performing) way of doing manual sleeps. Even so, the 2.6.2-rc2 kernel still has over 400 calls to the various forms of sleep_on(). Clearly, the goal of getting rid of that function was not achieved.

At this point, many people will have concluded that the effort to remove sleep_on() has been put on hold until 2.7 opens up. It seems, however, that most users of sleep_on() may yet get fixed in 2.6. In response to some discussion on the topic, Al Viro stated:

He also noted that any use of sleep_on() within device drivers is inherently broken.

Andrew Morton took the next step in 2.6.2-rc1-mm2; that kernel includes a patch which dumps out a bunch of debugging information whenever sleep_on() is called without the BKL held. That code has already turned up a few bad calls which have been duly reported to the kernel list. Fixes for those calls have been somewhat slower in coming. They will likely arrive, however, and as Al speculated, by the time all the bad calls are fixed there may not be a whole lot left. sleep_on() will undoubtedly exist when the 2.7.0 kernel is released, but there may be very few callers of it by then.

Comments (none posted)

Module unloading in a reference counted world

Increasingly, the kernel uses reference counts to know when data structures are no longer needed and can be reclaimed. This reference counting tends to be managed by the kobject type, though other mechanisms are used as well. When properly used, this mechanism works well. Interesting issues can come up, however, when reference-counted objects are maintained by code in loadable modules. In many situations, the module cannot be unloaded until all objects it has created have seen their reference counts go to zero and have been returned to the system. Otherwise, the system can be left with objects containing invalid references to module code which no longer exists. Bad things usually result from that situation.

Alan Stern recently ran into this sort of situation; his module registers various structures with the device model, and must be sure not to allow itself to be unloaded until those structures have been released. To that end, he wrote a patch adding two functions (class_device_unregister_wait() and platform_device_unregister_wait()) which unregister those structures and explicitly wait until they have been released. This patch did not get very far, however; it was quickly pointed out that, with this code, it is relatively easy to deadlock the kernel. If the process trying to remove the module also has an open file descriptor to one of that module's sysfs entries, everything comes to a halt. The suggested solution, instead, is to simply not allow the module to be unloaded if it still has unreclaimed objects outstanding.

That approach is taken in some other contexts. The cdev structure used to represent char devices uses a kobject for its reference count. The cdev_get() function does more than just increment the count in the kobject, however; it also increments the reference count for the module which drives that device. If any cdev structure owned by a module has references, the module, too, will have a non-zero reference count and will not be unloadable.

Another approach has been taken in the network subsystem. The net_device structure represents a network device; its rules say that it must be allocated dynamically, with alloc_netdev(). When the network driver is done with the structure, it calls free_netdev() to get rid of it. The net_device structure has its own reference count, but it is not tied to the underlying module's reference count. Instead, the networking system guarantees that, once free_netdev() has been called, it will not call into the module again for that device. The release function for the net_device structure, which returns its memory to the system, lives in the networking code, rather than in any loadable module. As a result, the module can be removed even while some of its net_device structures continue to exist, and all will be well. Those structures have been detached from the module which created them, and will be freed by core kernel code.

The real lesson from all this, perhaps, is that the kernel developers are still figuring out the implications of the lifetime rules of the objects they create. The addition of sysfs in 2.5 has tended to force this issue; sysfs exposes a great many internal kernel objects to user space, which can keep references to those objects for an indeterminate period of time. Making everything work safely in this environment has proved to be a challenge at times.

And module unloading, of course, will always be a challenge. There will likely always be issues involved with removing code from a live kernel. As Linus put it:

Experience shows that many users are not happy with a kernel which cannot unload modules, however. So the kernel developers are likely to be wrestling with these issues for some time yet.

Comments (10 posted)

Patches and updates

Kernel trees

• Linus Torvalds: Linux v2.6.2-rc2. (January 26, 2004)

• Andrew Morton: 2.6.2-rc2-mm1. (January 28, 2004)

• Randy.Dunlap: 2.6.2-rc2-kj1 patchset. (January 28, 2004)

• Andrew Morton: 2.6.2-rc1-mm1. (January 22, 2004)

• Andrew Morton: 2.6.2-rc1-mm2. (January 23, 2004)

• Andrew Morton: 2.6.2-rc1-mm3. (January 25, 2004)

• Marcelo Tosatti: Linux 2.4.25-pre7. (January 23, 2004)

• Bernhard Rosenkraenzer: 2.4.25-pre7-pac1. (January 27, 2004)

Core kernel code

• Tim Hockin: NGROUPS 2.6.2rc2. (January 28, 2004)

Development tools

• Mikael Pettersson: perfctr-2.6.5 released. (January 26, 2004)

Device drivers

• Carl-Daniel Hailfinger: [2.4] forcedeth network driver. (January 24, 2004)

• Heilmann, Oliver: AGPGART preliminary SiS648 support - fixed and shrunk. (January 26, 2004)

• Len Brown: ACPI for 2.6. (January 27, 2004)

• Jaroslav Kysela: ALSA 1.0.2 release. (January 27, 2004)

• jd: ANNOUNCE: UNH ISCSI drivers for 2.6.1. (January 27, 2004)

• Moore, Eric Dean: 2.6.2-rc2 - MPT Fusion driver 3.00.02 update. (January 27, 2004)

• Greg KH: USB update for 2.6.2-rc2. (January 28, 2004)

Filesystems and block I/O

• Karim Yaghmour: relayfs patches for 2.6.1. (January 23, 2004)

• Miklos Szeredi: FUSE 1.1-pre2. (January 27, 2004)

• raven@themaw.net: autofs4-2.6 - to support autofs 4.1.x. (January 28, 2004)

Memory management

• Rik van Riel: RSS limit enforcement for 2.6. (January 27, 2004)

Networking

• Marcel Sebek: IMQ port to 2.6. (January 25, 2004)

• Patrick McHardy: : altq HFSC port. (January 27, 2004)

Architecture-specific

• Benjamin Herrenschmidt: Big powermac update. (January 23, 2004)

Security-related

• James Morris: Security mount data & sb_copy_data hook.. (January 27, 2004)

Miscellaneous

• Greg KH: udev 014 release. (January 22, 2004)

• Mariusz Mazur: Userland headers available. (January 23, 2004)

• Neil Brown: ANNOUNCE: mdadm 1.5.0 - A tool for managing Soft RAID under Linux. (January 27, 2004)

Page editor: Jonathan Corbet

Distributions

News and Editorials

A Quick Reference Guide to urpmi

"urpmi", sometimes referred to as "urpm" or "User RPM", was first introduced into Mandrake Linux 7.0, released in January 2000. It was meant to be a powerful front-end to the "rpm" command. It came with dependency resolution, search and other functions similar to the Debian's "apt" tool, as well as a honorable intention to the end all RPM-related headaches. But despite urpmi being Free Software, it did not find its way into any other distribution, and even those that were originally derived from Mandrake (such as Alt Linux or PCLinuxOS) have been quick to replace urpmi with one of the apt ports for RPM-based distributions. Nevertheless, Mandrake's effort at making RPMs more digestible and pleasant to use deserves praise. Here is a quick rundown on the purpose of urpmi, its commands and functions.

Issuing a urpmi command performs several tasks. Firstly, it checks whether the relevant package has been installed. Secondly, it determines whether the package exists in the database of installable packages. Thirdly, it retrieves all packages, which the package in question depends on, marks them for installation and presents them to the user for approval. Lastly, it installs the package from a specified source, such as a CD, another machine on the local network, or a remote FTP/HTTP server. Besides these basic functions, urpmi is also capable of upgrading or removing packages, displaying information about packages and searching the package database. All of the above can be accomplished either on the command line or in graphical environment.

This is the list of commands available for manipulating RPM packages under Mandrake Linux:

• urpmi - installs or upgrades a package
• urpme - removes (erases) a package
• urpmq - searches for a package (both installed and available)
• urpmf - searches for a filename in all known packages (both installed and available)
• urpmi.addmedia - adds a new source of RPMs to the urpmi database
• urpmi.removemedia - removes an existing package source from the urpmi database
• urpmi.update - visits all the previously defined sources of RPMs and updates the package lists if necessary

There are several urpmi configuration files; some of the more important among them are:

• /etc/urpmi/urpmi.cfg - contains information about all urpmi sources, including name and path to each source
• /etc/urpmi/skip.list - contains names of packages that will not be automatically updated
• /etc/urpmi/inst.list - specifies which packages must be installed rather than updated
• /var/lib/urpmi/list.* - lists all packages available to urpmi
• /var/lib/urpmi/hdlist.* - lists headers of all packages available to urpmi
• /var/lib/urpmi/synthesis.hdlist.* - contains dependency information for all available RPM packages

Setting up package sources for retrieval via the Internet is very simple with Mandrake's graphical configuration tools, but the command line can do the job equally well. First, let's retrieve the list of sources from urpmi.cfg:

urpmq --list-media

Now we can add new sources from the official Mandrake repositories, as well as the ever useful PLF repository. This can be accomplished with the following commands:

urpmi.addmedia main ftp://[...]/mandrake/9.2/i586/Mandrake/RPMS \
    with ../base/hdlist.cz
urpmi.addmedia contrib ftp://[...]/mandrake/9.2/i586/Mandrake/RPMS2
urpmi.addmedia jpackage ftp://[...]/mandrake/9.2/i586/Mandrake/RPMS3
urpmi.addmedia --update updates ftp://[...]/mandrake/updates/9.2/RPMS \
    with ../base/hdlist.cz
urpmi.addmedia plf ftp://knight.zarb.org/pub/plf/mandrake/9.2 with hdlist.cz

Those who prefer to be on the very bleeding edge of Mandrake development might want to track the "Cooker", or Mandrake's development branch:

urpmi.addmedia cooker-main \
    ftp://[...]/mandrake-devel/cooker/i586/Mandrake/RPMS with ../base/hdlist.cz
urpmi.addmedia cooker-contrib ftp://[...]/mandrake-devel/contrib/i586

Installing a new package or upgrading an existing package is a simple matter of issuing a urpmi <package_name> command, while uninstalling is done with a urpme <package_name> command. In cases where the specified <package_name> doesn't exist, urpmi will attempt to find a package with a similar name, so even typing errors are taken care of. An even better option is to install the "bash-completion" package, which is capable of suggesting package names following the urpmi command and the first few letters of a package name.

Upgrading an entire Mandrake Linux system can be accomplished with the following two commands:

urpmi.update -a
urpmi --auto --auto-select

The first of the above commands will get the list of available packages for upgrade, while the second one will download and upgrade all installed packages to their latest versions. The RPM packages are downloaded to the /var/cache/urpmi/rpms directory.

As mentioned earlier, urpmi also provides a set of powerful search commands. Here are some useful examples:

• urpmq --list - contains information about all urpmi sources, including name and path to each source
• urpmq -d <package_name> - lists dependencies of <package_name>
• urpmq -f <package_name> - outputs <package_name>, inclusive of version and architecture
• urpmq -i <package_name> - outputs useful information about <package_name>
• urpmq -y <search_string> - searches the package database for packages that include <search_string>
• urpmf <file_name> - finds the RPM package providing the specified file <file_name>

It goes without saying that standard rpm commands, such as rpm -qa can be executed as well. In conjunction with the various urpm* commands, they provide a powerful set of tools for managing software on Mandrake Linux.

Comments (4 posted)

Distribution News

Debian GNU/Linux

The January 27 issue of the Debian Weekly News is out, with looks at preparing for FOSDEM, proposed release process and social contract changes, a public Debian GNU/Hurd system, and several other topics.

DebianPlanet takes a look at the GNOME 2.4 packages that are available for 'sarge'.

Netcraft reports that, according to its surveys, Debian is the fastest-growing Linux distribution among systems serving web sites. Over 440,000 Debian-based servers were counted in January, a 25% increase over last July. The number of Red Hat-based servers actually fell slightly in January.

Martin Michlmayr presents Bits from the DPL with news from Linux.conf.au, the DebConf.org Picture Gallery, and the upcoming DebConf4.

James Troup reports on the migration of 'ftp-master'.

Comments (none posted)

Michael Johnson leaves Red Hat, Fedora

Michael K. Johnson announced on January 23 that he is leaving Red Hat and thus will no longer be the technical lead for the Fedora project. Michael was one of the last remaining Red Hat originals, having been with the company almost since the beginning. He has had a great deal of influence over the development of Red Hat Linux, and will certainly be missed.

The new Fedora leader is Christian Gafton; he has posted an introductory message with his thoughts for Fedora in the near future.

Comments (13 posted)

Fedora Core

The Fedora News Updates #3 takes a look at LinuxWorld, keeping Fedora Core 2 on schedule, the Fedora Core 1 for AMD64 test1 release, and several other topics.

The Fedora News Updates for January 28 is also out. Topics this week include the change in Fedora project leadership, terminology, Fedora Legacy documentation, a writeup of the LinuxWorld Fedora BOF, and more.

Comments (none posted)

State of Fedora Legacy

The Fedora Legacy project aims to provide updates for older Red Hat releases. Click below to see how it's going.

Full Story (comments: none)

Gentoo Linux

The Gentoo Weekly Newsletter for the week of January 26, 2004 is out. This week covers SELinux in Gentoo, and more.

Python 2.3.3 packages are available for Gentoo stable x86. Happy upgrades.

Comments (none posted)

Progeny gets LSB certification

Progeny has announced that its Debian-based "Platform Services Componentized Linux" has received Linux Standard Base 1.3 certification. It thus becomes, Progeny claims, the first LSB-certified Debian-based distribution.

Full Story (comments: none)

Slackware Linux

A look at the slackware-current changelog shows some upgrades to several GNOME packages, Koffice 1.3, rsync 2.6.0, and Samba 3.0.1.

Footnotes reports the release of Dropline GNOME 2.4.2, for Slackware users.

Comments (none posted)

Mandrake Linux

Here are some bug fixes for Mandrake Linux 9.2:

• This dhcp update fixes a problem where Dynamic DNS updates did not work properly.

• Here's another qt3 update which fixes problems with using the accelerator keys in KDE applications.

• This mrproject update fixes a crashing problem.

Comments (none posted)

New Distributions

Deep-Water/Linux

Deep-Water/Linux is a fully graphical minimalist boot CD distribution, featuring the Deep-View file browser. It joins the list at version 0.2.0, released January 26, 2004.

Comments (none posted)

ThinTUX

ThinTUX is a small Linux distribution for thin clients. It has support for all major remote access protocols like ICA, RDP, XDM, telnet, ssh, and more. The distribution can be booted from the network using a network card with PXE-support or from standard media storage devices like floppy, CD, hard disk, or disk-on-chip. The configuration is stored on a DHCP server to simplify terminal management. The initial version of ThinTUX, 0.1, was released January 22, 2004.

Comments (none posted)

Minor distribution updates

2-Disk Xwindow embedded Linux

2-Disk Xwindow embedded Linux has released source code v1.2.6 with major bugfixes. "Changes: Many script cleanups were done to simplify compilation on a wider range of POSIX systems. The documentation was updated. Many size optimizations and bugfixes were made to the desktop system."

Comments (none posted)

BG-Rescue Linux

BG-Rescue Linux has released v0.3.0 with major feature enhancements. "Changes: This release adds Linux 2.4.24 with support for the new NTFS 2.1.6a driver. It updates uClibc to 0.9.24, BusyBox to 1.0pre5, and some of the other included programs. ntfsprogs 1.8.3 and syslinux 2.08 have been added. Support for the Xircom 16-bit PCMCIA network device has been added, and some unused kernel options removed."

Comments (none posted)

MURIX Linux

MURIX Linux has released v2004-01-26 with major feature enhancements. "Changes: This version includes Linux kernel 2.6.x and all of the associated necessary updates."

Comments (none posted)

PLD RescueCD

PLD RescueCD has released v1.92 with major bugfixes. "Changes: The boot process and hardware detection were improved. This release requires an i386 PC with only 16 MB of RAM. Booting from IDE, SCSI, USB CD-ROM, or disk was implemented. The kernel was updated to 2.4.25pre6 with the nForce kernel nvnet module. 25 packages were updated in this release. USB keyboard support and a debug mode have been added. USB modules detection and the serial console have been fixed."

Comments (none posted)

Distribution reviews

Spawn of Debian faceoff: LibraNet 2.8.1 (Linux.com)

This installment of the 'Spawn of Debian' series looks at LibraNet v2.8.1. "With the packages finally loaded, all that was left to do was to configure the sound, network connection, and printers. Sound was easy. The installer determined that I should have the Trident driver, loaded it, and it worked. The network configuration was almost that easy. I just had to select the type of configure I wanted to do (ppp, network, or expert), specify the type of network (static, dynamic, pppoe), choose whether or not to send the hostname when signing on, and enter the IP addresses of the nameservers. That last one had me worried for a second, but it shouldn't have. All it wanted was the local address of the Belkins router (192.168.2.1). And it even prompted me to use that."

Comments (none posted)

Linux on Mac: a POWER programmer's primer (IBM developerWorks)

IBM developerWorks looks at Linux on the PowerPC. "For this article, I installed and evaluated four distributions of Linux for PowerPC machines: Debian, Knoppix, Yellow Dog, and Mandrake. All were installed and tested on a G4 iMac. I found two of the distributions to be well polished and easy to use, right on par with the best x86 Linux distributions; the other two I would have to describe as "not ready yet.""

Comments (none posted)

Review: Mandrake Linux 9.2 AMD64 Release (PCBurn)

This PCBurn author was not impressed with Mandrake's AMD64 release. "The first thing that hit me when I booted the AMD64 Mandrake Linux 9.2 CD was the fact that it uses a 2.4 series kernel. I know some of you are already groaning or rationalizing that the 2.4 kernel would obviously be the most stable and tested kernel series since 2.6.1 has only been recently released and there are still many bugs yet to be fixed. If this was a distribution for x86, I might be inclined to agree with you, but for an AMD64 box this just isn't so. The 2.4 kernel series is being deprecated for AMD64, and as of 2.4.23-pre7 the kernel has devfs support disabled completely for x86-64 due to it causing memory corruption of all things. Nobody is going to fix this problem or any of the others that currently exist in 2.4, so any distribution making use of it must provide their own patches and fixes if they want to continue using this kernel. There certainly won't be any official backports of the drivers and AMD64 fixes currently available in 2.6, such as support for the nForce3 chipset."

Comments (2 posted)

Review: Xandros Desktop OS 2.0 (eWeek)

eWeek reviews Xandros Desktop OS 2.0. "IT managers serious about making the switch from Windows have nothing to fear regarding Xandros' ability to integrate into a Windows- centric computing environment. Xandros is based on Debian GNU/Linux. Version 2.0 employs a Xandros-enhanced KDE 3.1.4 interface and an underlying 2.4.22 Linux kernel, which makes for an elegant, intuitive interface -- and a look and feel that will likely be familiar to most Windows users."

Comments (none posted)

Page editor: Rebecca Sobol

Development

The FlowDesigner Data Flow Development Environment

FlowDesigner, formerly known as OverFlow, is a data flow oriented development environment. The software is written in C++ and is licensed under the GNU GPL.

In other words, FlowDesigner allows the user to connect functional pieces together graphically using the cartoon programming approach.

FlowDesigner contains toolboxes for these applications:

• Signal processing
• Audio processing
• Vector quantization
• Neural network
• Fuzzy logic
• Real-time audio effects
• Linear algebra
• Robotics

Two projects that use FlowDesigner are the RobotFlow Robotics Toolkit, and the Open Mind Speech project which is building a set of speech recognition tools and applications.

Version 0.8.0 of FlowDesigner has been announced. "This release fixes many build problems and includes multiple GUI improvements, better node documentation, new nodes, and more."

The code is available for download here.

Some screenshots are available in the images section.

Comments (none posted)

System Applications

Audio Projects

ALSA 1.02 released

Version 1.02 of the ALSA sound driver is out. A new ALSA bug tracking system has also been set up. See the full announcement for all of the details.

Comments (none posted)

liblrdf 0.3.4 available

Version 0.3.4 of liblrdf is out. "liblrdf is a lightweight RDF metadata handling library with extensions for manipulating LADSPA Schema-specific data."

Full Story (comments: none)

Planet CCRMA Changes

The latest changes from the Planet CCRMA audio utility packaging project include new versions of the Alsa Modular Synth, Qjackctl, Qsynth, Seq24, and Noteedit.

Comments (none posted)

Speex 1.1.4 released

Version 1.1.4 of Speex, an audio codec, is out. "This release has minor fixed-point improvements and a code cleanup. The SSE code has been converted from inline assembly to SSE intrinsics, so it should now work on win32. More functions have been written to use SSE."

Comments (none posted)

Clusters and Grids

Perspectives on grid: Grid computing -- next-generation distributed computing (IBM developerWorks)

Matt Haynos writes about Grid computing on IBM's developerWorks. "Two major needs have dramatically increased the value of the concept of grid computing in the last few years. A lean economy has forced those with a limited IT budget to more fully utilize their existing computing assets and to become more flexible to respond to rapidly evolving markets by being able to intelligently allocate finite resources to the appropriate business applications. In this first of a series of articles, Matt Haynos provides a cursory analysis of the similarities and differences between grid computing and such distributed computing systems as P2P, CORBA, cluster computing, and DCE."

Comments (none posted)

Database Software

PostgreSQL Weekly News

The January 26, 2004 PostgreSQL Weekly News is out with another roundup of PostgreSQL database news.

Full Story (comments: none)

Filesystem Utilities

ntfsprogs 1.8.4 released (SourceForge)

Version 1.8.4 of ntfsprogs, a set of ntfs filesystem utilities, has been announced. "This release fixes several memory leaks (mostly in directory lookup/handling code)."

Comments (none posted)

Mail Software

milter-spamc 0.13 is out

Version 0.13 beta of milter/spamc, an email spam filter, has been announced. Change information can be found here.

Comments (none posted)

Troubleshooting with Postfix Logs (O'Reilly)

Kyle Dent digs through Postfix log files on O'Reilly. "Postfix provides a number of ways to get information that can be helpful when you are trying to diagnose a problem. The standard logging often provides more than adequate information for understanding problems and determining their cause. This article discusses Postfix logging in general, how to find all of the relevant information in the logs, and finally, how to increase the amount of logging when more information is needed."

Comments (none posted)

Printing

cups_ftp 1.04 released

Version 1.04 of cups_ftp, which allows the CUPS print server to work over an FTP connection, is available.

Comments (none posted)

Foomatic 3.0.1rc2 released!

Version 3.0.1rc2 of the Foomatic printer database is available. "This release is a pre-release approaching the next stable release Foomatic 3.0.1. This time mainly bugfixes were done, but also the compatibility to *BSD and non-bash systems is improved."

Also, a companion release of foomatic-filters is also out with some bug fixes.

Comments (none posted)

Telecom

VoIP and POTS Integration with Asterisk (O'Reilly)

John Todd shows how to integrate Voip and standard telephony with Asterisk. "Asterisk is an open source PBX replacement system, which does in software what many expensive PBX systems do in custom hardware. Voicemail, voicemail/email forwarding, call forwarding, voice menus, multi-ring -- these are just a few of the hundreds of features that Asterisk offers."

Comments (none posted)

Web Site Development

Gallery v1.4.2 Release Candidate 1 Available! (SourceForge)

Release candidate 1 for Gallery 1.4.2 has been announced. Gallery is a web-based image archive. "This version is mostly focused on bugfixes and minor improvements. Some of these include: Improved voting/ranking features; Gallery internationalized in even more languages; Config. Wizard is more informative and friendly; Improved skins capabilities (more customizable); EZ-Prints service updated to their new, friendlier interface; Tons of small improvements and bugfixes."

Comments (none posted)

mnoGoSearch-php 3.2.4 is out

Version 3.2.4 of mnoGoSearch-php, the PHP frontend to the mnoGoSearch web site search engine, has been released. See the Change Log file for more details.

Comments (none posted)

mod_python 2.7.10 is released

Version 2.7.10 of mod_python has been released. This is a security fix, more change information is in the source code.

Comments (none posted)

Tiki 1.7.5 -Eta Carinae- released (SourceForge)

Version 1.75 of Tiki, a CMS/Groupware package, is available. "The main purpose of this release is to address the CSRF issues which affect web applications. However, we have also managed to sneak in some extra goodies as a bonus."

Comments (none posted)

Desktop Applications

Accessibility

Free Standards Group launches accessibility workgroup

The Free Standards Group has announced the launch of a workgroup to develop accessibility standards for Linux.

Comments (none posted)

Audio Applications

Two new releases of Tkeca

Two new versions of Tkeca, a GUI interface for the ecasound audio utility, have come out this week. Version 4.0.0 was announced and features many changes and bug fixes. Version 4.0.1 features one more bug fix.

Comments (none posted)

Visecas 0.3.5 announced

Version 0.3.5, a GUI frontend for the Ecasound audio utility, is out. "This is an interim release which fixes several serious bugs. Hacking Gtk::Fileselection from Ruby on a Debian system (which currently comes with a patched GtkFileselection) turned out to be a very bad idea regarding portability."

Full Story (comments: none)

Desktop Environments

GNOME Clipboard Daemon - your clipboard will actually work (GnomeDesktop)

GnomeDesktop.org mentions the GNOME Clipboard Daemon as a solution to some of the problems with cut and paste operations under the X window system. "Normally, when you copy something in an X application and you close it, the content of the clipboard is lost. This is probably one of the biggest reasons why people keep saying that copy & paste in Linux "doesn't work"."

Comments (2 posted)

GNOME Platform Bindings 2.5.3 released (GnomeDesktop)

Version 2.5.3 of the GNOME Platform Bindings has been announced. "Here is another scheduled release of the GNOME Platform Bindings, which provide a GNOME development platform for programming languages other than C, in the style of those languages. This release set gives some bindings a schedule and rules to work within, so we can endorse those bindings. We very much hope that Linux distributions will therefore choose to distribute these bindings as a supported development platform."

Comments (none posted)

Gnome Summary for January 18 - January 24, 2004

Here is this week's Gnome Summary, with news about new GTK# applications, Gaim status, and much more.

Full Story (comments: none)

KDE Traffic

Issue #74 of KDE Traffic has been published. Take a look for the latest KDE development news.

Comments (none posted)

KDE-CVS-Digest

The January 23, 2004 edition of the KDE-CVS-Digest is out. Here's the summary: "KStars adds more telescope devices. KAddressbook adds custom field support. Krita gets working brush and new patterns. CSS code from Safari added to Khtml."

Comments (none posted)

kdenonbeta Official Clean Up: Where will your code go? (KDE.News)

KDE.News reminds developers that they are cleaning out old, inactive projects from the KDE source repository. "If you are the author of a program in kdenonbeta that is still there after this cleanup, now is a good time to think about the future of your code."

Comments (none posted)

Electronics

Gnucap 0.34 released

Version 0.34 of Gnucap, the Gnu Circuit Analysis Package, is out. "This is primarily a bug fix and compatibility release."

Comments (none posted)

TkGate 1.8.1 released

Version 1.8.1 of TkGate, a digital circuit simulator, has been released. "A bug occurring when clocks are used to drive adders, when printing partial scope traces, and when doing an undo from the edit module interface screen was fixed. Several enhancements were added to the scope window, inluding a toolbar, a "crosshair", and the ability to select ranges on the scope for printing using the right mouse button. The capability to suppress sorting of traces on the scope was also added."

Comments (none posted)

XCircuit 3.1.37 released

Version 3.1.37 of XCircuit, an electronic schematic drawing program, is available. Change information is in the source code.

Comments (none posted)

Financial Applications

GNUe Traffic

Issue #105 of GNUe Traffic is out with the latest GNU Enterprise news. Topics include Sequences, Dropdown triggers, and GNUe on Mandrake 9.2.

Comments (none posted)

Games

Planesweeper 0.3 released

Version 0.3 of Planesweeper, a MineSweepr clone, is available. "It uses PyOpenGL to render the traditional board onto a three dimensional plane."

Comments (none posted)

GUI Packages

FLTK Beginner Tutorial 1.0

A beginner's tutorial for FLTK, the Fast, Light ToolKit, has been published by Robert Arkiletian.

Comments (none posted)

GTK+-2.3.2 released (unstable) (GnomeDesktop)

Unstable version 2.3.2 of GTK+ has been released. "This is a development release leading up to GTK+-2.4. Changes since GTK+-2.3.1 include many API fixes for new widgets and bug fixes in new and old code, along with various new API enhancements, such as allowing saving a GdkPixbuf to an in memory buffer, and a blazingly fast fixed-height mode that can be enabled for GtkTreeView."

Comments (none posted)

Advanced UI design for GNOME (IBM developerWorks)

Vladimir Silva introduces SLIK on IBM's developerWorks. "GTK programming has almost never been this easy: IBM developer Vladimir Silva shares his skills, his enthusiasm, and his modified code for the SimpLIstic sKin interface (or SLIK). SLIK provides a great tool for building advanced user interfaces in Linux or Unix systems. A part of the GQmpeg toolset, it is written using the GTK toolkit, a powerful set of widgets for graphics used by such applications as the GIMP and other GNOME-based apps."

Comments (1 posted)

Imaging Applications

GQview 1.3.8 released

Version 1.3.8 of GQview, an image viewing application, is available. "This continues the series of beta releases for the next stable release (1.4), many bugs were fixed. The Finnish, Japanese, and Swedish translations are also updated."

Comments (none posted)

Interoperability

Wine Traffic

Issue #206 of Wine Traffic is out with the latest Wine news.

Comments (none posted)

Wine 20040121 is available

Release 20040121 of Wine, the WINdows Emulator, has been announced. "This is still a developers only release."

Comments (none posted)

Mail Clients

Aethera 1.0.2 Now with Kolab Support (KDE.News)

Version 1.0.2 of Aethera, an email/PIM client, has been announced. "Aethera now has integrated support for the Kolab groupware server. Aethera 1.0.2 comes with support for email, calendar and todo using KOrganizer as a plug-in, sticky notes, address book and now Kolab integration."

Comments (none posted)

Multimedia

GNOME multimedia software releases flourishing (GnomeDesktop)

GnomeDesktop.org mentions several new GNOME multimedia applications. "The earlier reported GTK#-based Muine is now at v0.2, Rhythmbox released v0.6.5 while mp3 clients GNomad v2.4.1 and gtkPod v0.72 were also released."

Comments (none posted)

Music Applications

Didgeridoo 0.0.1 announced

The initial release of didgeridoo, a voice-controlled resonator-based musical instrument for JACK, is out. Who says open-source software isn't innovative?

Full Story (comments: none)

gmorgan 0.22 Released

Version 0.22 of gmorgan is out with lots of new features. "gmorgan is a rhythm station. a full programable accompaniment tool in real-time and also a pattern based sequencer."

Full Story (comments: none)

New LADSPA Plugins

Version 0.1-0 of TAP, Tom's Audio Plugins for LADSPA, has been released. The components of TAP include an equalizer, a reverb effect, a stereo echo, and a tremolo effect.

Full Story (comments: none)

Office Suites

KOffice 1.3 released

The release of KOffice 1.3 has been announced. This release includes many improvements over 1.2, including a new Word import filter, better spell checking, automatic hyphenation, over 100 new formulas in KSpread, and much more.

Comments (none posted)

OpenOffice.org Developers Digest

The OpenOffice.org Developers Digest for week 3, 2003 is available. "Topics include : so whats currently being implemented for OOo 2.0?, Release of developers snapshot m20, OOo thesauri development, Native Lang Translation Tools, The start of a grammar checker?, The dev@api.openoffice.org newsletter, Developers Guides in multiple languages, Separation of icon set from build process, Separate builds of 1.1.1 for Mac OSX 10.2 and 10.3, Multiple-Inheritance Interface Types for UNO, and MinGW + tcsh build efforts started."

Comments (none posted)

Web Browsers

Epiphany 1.1.5 is available

Development version 1.1.5 of Epiphany, a lightweight web browser for GNOME, is available with lots of bug fixes, new translations, and more.

Comments (none posted)

Galeon 1.3.12 released (GnomeDesktop)

version 1.3.12 of Galeon, the lightweight web browser, is out. "Here it is! After much parallel development we can finally announce the first egg based release of galeon. So, lots of changes and improvements in this one!". This release works with Mozilla 1.4 through 1.6.

Comments (none posted)

Lynx 2.8.5 pre 3 released

Version 2.8.5 pre 3 of Lynx, a text-mode browser, is available for download. Change information is in the source code.

Comments (none posted)

Elinks 0.9.0 stable released

Version 0.9.0 (stable) of Elinks, a text-mode browser, is out. "ELinks is an enhanced version of Links, a Lynx-like text Web browser with support for tables, frames, background downloads, SSL etc. It has a menu-fashioned user interface and is smaller and more lightweight than Lynx. ELinks adds many valuable features, like HTTP and proxy authentication, reasonable cookies support, Lua scripting, downloads resuming, very high configurability and more. ELinks has built-in support for HTTP, FTP, finger and local files; users can define their own external handlers for any other protocols."

Comments (none posted)

New translations of Mozilla 1.6 available

New Spanish and Polish translations of Mozilla 1.6 are available.

Comments (none posted)

Minutes of the mozdev Admin Meeting

The minutes are available for the January 23, 2004 mozdev admin meeting. The MozillaZine summary says: "Issues discussed include site performance improvements, news feeds, the generation of category pages, mirrors and incorporation."

Comments (none posted)

Developers Must Now Consider Mozilla Firebird, Mozilla Thunderbird and Camino When Making API Changes (MozillaZine)

MozillaZine reports on changes to the Mozilla development process. "In a newsgroup posting, Mozilla Firebird developer Ben Goodger, Mozilla Thunderbird developer Scott MacGregor and Camino developer Mike Pinkerton have announced that those making API changes to core components must now ensure that they do not adversely affect Firebird, Thunderbird or Camino."

Comments (none posted)

Word Processors

AbiWord v2.0.3 released (GnomeDesktop)

Version 2.0.3 of the AbiWord word processor has been announced. "The AbiWord Development Team is pleased to announce the immediate availablity of AbiWord v2.0.3. This is mostly a bugfix release, and fixes numerous issues reported by our users. We encourage everyone to try out, or upgrade to this release."

Comments (none posted)

Miscellaneous

ClusterSSH 1.46 released

Version 1.46 of ClusterSSH has been released. "ClusterSSH controls a number of xterm windows via a single graphical console window to allow commands to be interactively run on multiple servers over an ssh connection."

Comments (none posted)

Liar Liar v0.5 Released (GnomeDesktop)

FootNotes announces the first release of a different sort of free software package. LiarLiar analyzes voice samples in an attempt to determine whether the speaker is telling the truth or not. "Currently, the software is very pre-Beta, so don't expect too much accuracy. Accuracy will be addressed in an upcoming release."

Comments (6 posted)

Languages and Tools

Caml

Caml Weekly News

The Caml Weekly News for January 20-27, 2004 is out with three new Caml language articles.

Full Story (comments: none)

Java

Java theory and practice: Garbage collection and performance (IBM developerWorks)

Brian Goetz covers Java garbage collection issues on IBM's developerWorks. "This month, columnist Brian Goetz looks at the performance impact of the choice of collector, how various coding idioms interact with the garbage collector, and how allocation and other related costs have changed in Java virtual machines over the past several years."

Comments (none posted)

Taming Tiger: Pre-release of Tiger is now available (IBM developerWorks)

John Zukowski covers the latest version of J2SE on IBM's developerWorks. "Sun has quietly released an alpha version of J2SE 1.5, also known as "Tiger," and developer John Zukowski is in the big top ready to start his Tiger-taming act. This new column picks up where Magic with Merlin left off, detailing the changes to the platform and providing examples for quick reference."

Comments (none posted)

Lisp

Introducing Movitz

Movitz is an ANSI Common Lisp development platform with the unique ability to be booted directly on x86 PC architecture machines, i.e. with no operating system. "It can be used for developing "operating system kernels, embedded, and single-purpose applications". The Movitz platform consists of a Common Lisp cross compiler for the x86 architecture, a run time environment, and debugging/monitoring tools. It also includes a sample operating system kernel written in Common Lisp."

Full Story (comments: none)

Perl

This Week on perl5-porters (use Perl)

The January 19-25, 2004 edition of This Week on perl5-porters has been published. "Another summary this week, not really different from the previous ones, as it contains the usual bug reports and other discussions. The bugs, however, are new."

Comments (none posted)

PHP

PHP Weekly Summary for January 26, 2004

The PHP Weekly Summary for January 26, 2004 is out. Topics include: SPL now default, SimpleXML asXML(), SimpleXML documentation, PHP 5 for Netware, Removal of gpc_order, Tidy extension OO.

Comments (none posted)

Web App Security Testing with a Custom Proxy Server (O'Reilly)

Nitesh Dhanjani explains PHP security issues on O'Reilly. "In this article, I'll discuss some common web-application security flaws and then demonstrate how to detect them. In the process of auditing web applications for security flaws, I will also present a PHP script that will act as a web proxy server, allowing us to intercept and alter HTTP requests between the web browser and the target web server. As we will see, this PHP script will aid us tremendously in testing for security flaws."

Comments (none posted)

Python

Year in Python 2003

Here is a summary of what happened in the Python community in 2003. "In 2003, there was one new major release of Python and several minor bugfix releases. The Python Software Foundation began to assume a greater role and visibility in the community, organizing the first PyCon conference. A number of noteworthy books were published, and the conference calendar was also full."

Comments (none posted)

Dr. Dobb's Python-URL!

Dr. Dobb's Python-URL! for January 26, 2004 is out. Take a look for a new collection of Python language articles.

Full Story (comments: none)

Python Computer Graphics Kit 1.1.0 released

Version 1.1.0 of the Python Computer Graphics Kit is out with the following changes: "Two new modules "cgkitinfo" and "slparams" and a bunch of fixes and additions".

Comments (none posted)

Tcl/Tk

Dr. Dobb's Tcl-URL!

Dr. Dobb's Tcl-URL! for January 26, 2004 is out with the week's Tcl/Tk article links.

Full Story (comments: none)

XML

XML Security: The XML Key Management Specification (IBM developerWorks)

Manish Verma explains XKMS on IBM's developerWorks. "The XML Key Management Specification (XKMS) outlines an easy mechanism for accessing and integrating with Public Key Infrastructure (PKI). In this article, Manish Verma explains the objective behind XKMS and then offers a step-by-step guide to using the XKMS service to register and retrieve information related to a public and/or private key."

Comments (none posted)

Cross Assemblers

gputils-0.12.0 Released

Version 0.12.0 of gputils, the GNU Pic Utilities, is out. Here's the release blurb: "Fixed many bugs and released gpal. Although, gpal really isn't ready to be used."

Comments (none posted)

Page editor: Forrest Cook

Linux in the news

Recommended Reading

GNOME if you want to (ComputerWorld)

ComputerWorld looks forward to GNOME 2.6. "According to GNOME release team head Jeff Waugh, who gave a presentation at the Linux.conf.au 2004 conference last week, the GNOME project has undergone a major facelift over the past 12 months. This has included switching to a time-based release schedule, starting with its 2.x series, as well as redefining the project's social structure into module maintainers, a release team, and an administrative and advisory foundation board." (Found on Footnotes)

Comments (none posted)

Open-source shifts spell an end for UnitedLinux (ZDNet)

ZDNet notes the end of UnitedLinux. "The shutdown marks the end of an ambitious effort to attract more hardware and software partners, standardize Linux, and boost research and development. Instead, it was OSDL--a more neutral coalition in the Linux industry and the employer of Linux leader Linus Torvalds--that succeeded where UnitedLinux failed."

Comments (12 posted)

With Friends Like These, Linux Doesn't Need Enemies (eWeek)

Steven Vaughan-Nichols comments on the MyDoom worm in eWeek. "Companies are going to lose, at a guess, hundreds of millions of dollars in lost productivity thanks to MyDoom. And, who are they going to blame? Microsoft for producing crappy software?... No, what will happen is that at least some corporate IT decision makers are going to blame Linux because one or two worm writers decided that they had enough of SCO and decided to get back at them, and some others decided to at least jokingly support the worm."

Comments (39 posted)

New virus infects PCs, whacks SCO (ZDNet)

ZDNet reports that the current Microsoft worm clogging our mailboxes is actually intended to set up a denial of service attack on SCO. One assumes that, by the February trigger date, it will have been cleaned up reasonably well and SCO will be prepared; meanwhile it feels like a DOS attack on anybody with a mailbox. "Early data indicated an epidemic several times the size of the Sobig.F virus, which caused widespread infections last summer...."

Comments (23 posted)

Trade Shows and Conferences

X.org and Xfree86 reform as a single group (NewsForge)

NewsForge reports from a LinuxWorld press conference where it was announced that X.org and XFree86 have merged together under the FreeDesktop.org umbrella. "Members of the newly-reformed X.org are still coming to grips with their new style of development, but most of the 'ex-core' XFree86 people and their cohorts agree that their new, more open style is likely to speed development not just of the visual portion of the X Window System but also of components related to sound, printing, and all the other 'pieces' needed to create and maintain a complete, user-friendly desktop environment for Linux, Unix, and related operating systems."

Update: the rumors appear to be exaggerated; see the XFree86 site for that project's denial of a merger.

Comments (3 posted)

Bruce Perens expounds 'Open Source State of the Union' (NewsForge)

NewsForge covers Bruce Perens' Open Source State of the Union speech at LinuxWorld. "Perens feels the biggest challenge to open source going forward is software patents. In the U.S., 50% to 95% of software patents should not be granted, he said, because they are not inventions and are written extremely broadly. He expects that after SCO suit is over, we'll see a number of patent lawsuits brought against Linux."

Comments (12 posted)

IBM: 'Who Says Penguins Can't Fly?' (eWeek)

eWeek covers a LinuxWorld keynote by IBM's Ross Mauri. "Now, however, Linux seems to be everywhere, according to the IBMer. "I can't think of a place where Linux hasn't been successful," he evangelized, citing implementations ranging from supercomputers down to embedded systems. Supercomputing applications really started to come to the fore during the second half of 2003, he noted. "Linux clusters are the biggest segment." Mauri delivered quick case studies of organizations using Linux across fields that include communications, health care, pharmaceuticals, education and multimedia entertainment."

Comments (none posted)

More pictures at a Linux exhibition (NewsForge)

Here is a NewsForge LinuxWorld report, with pictures. "Most vendor people I've talked to have declared this a "good show" -- which means they are satisfied with the amount of traffic. LinuxWorlds the past few years have left some vendors unhappy with the number of people who came to their booths. Companies spend frightful sums to exhibit at shows like these, and if they don't get enough leads and eventual sales in return, they don't come back. I think most of this show's vendors are happy and will be be around at future LinuxWorlds."

Comments (1 posted)

Postcard from Penguin Land, Part 1 (ZDNet)

ZDNet's David Berlind went to LinuxWorld. "Fresh from acquisitions of Ximian and SuSE, and a day after SCO announces that it's launching a suit, Novell CEO Jack Messman gives an impassioned keynote about how his company has adopted a new religion: open source. He sets the stage for two themes that for me will drive the focus of LinuxWorld: raising the bar on managing everything from Linux desktops to servers to clusters and the SCO indemnification issue. Novell indemnifies. HP indemnifies. Red Hat announced it will replace any code found to be infringing. But what about IBM, Sun, Dell and others?"

Comments (5 posted)

Postcard from Penguin Land, Part 2 (ZDNet)

ZDNet continues its LinuxWorld trip report. "...the only question in my mind about MySQL's future is 'who will acquire it?' My top three choices are Novell, BEA, and Sun. Novell in particular has been on the open source acquisition trail. After Ximian and SuSE, MySQL would fit into Novell's portfolio like a glove and, furthermore, would make it the only company to have two of the letters (L and M) in the LAMP stack."

Comments (6 posted)

The SCO Problem

Linux Code Red (Salt Lake Weekly)

The Salt Lake Weekly has published a lengthy and relatively high-clue summary of the SCO case. "In other words, regardless of whether other companies indemnify their customers against lawsuits, SCO sees itself as having the upper hand. Can SCO have it both ways?"

Comments (12 posted)

Open Source thieves stealing my American code - SCO boss (The Register)

SCO's CEO Darl McBride takes his rampage against Linux into the realm of US Homeland Security. "SCO Group chief executive Darl McBride has attempted to nudge the Homeland Security Advisory alert back up towards Red, by accusing foreign interests of undermining US national security in a draft letter to Congressmen. How are they doing this? "Instead of UNIX from any number of US companies or Windows from Microsoft, governments throughout Europe and Asia are using Linux… I find this particularly galling because that Linux software contains thousands of lines of my company's proprietary UNIX code - for which we receive no revenue."" Thanks to Dr. DJ Clark.

Comments (16 posted)

Groklaw on SCO's letter to Congress

Groklaw has posted a set of comments on SCO's letter to Congress. The article also includes the article text, for those who don't want to deal with PDF. "The letter is offensive in many ways, and there are several obviously untrue things in it, but the most egregious is the assertion that open source is a security risk. If Linux is a security risk, why is there a National Security Agency version of Linux, Security Enhanced Linux?"

Comments (4 posted)

IBM-SCO Group Squabble over Linux System Extends Even to Court Calendar (SL Tribune)

The Salt Lake Tribune reports on the delay of the hearing that will look at whether SCO has answered IBM's questions. "If [Judge] Wells finds sufficient evidence to support SCO's claims, a trial is expected in spring 2005. If she rules for IBM, SCO's lawsuit would be derailed and its recently launched, potentially lucrative global campaign to sell licenses to corporate Linux users also could flop."

Comments (6 posted)

The Most Hated Company In Tech (Business Week)

Business Week has a lengthy article on the SCO case. "But who stands to gain the most from an SCO win? Microsoft. Linux is the primary force standing between Microsoft and domination of the computer world. The software giant is happily fanning customers' fears with an anti-Linux campaign while pumping money into SCO." (See also this interview with Linus Torvalds that goes along with the article.)

Comments (10 posted)

Companies

Intel mulls Linux Centrino support (News.com)

Intel will support Linux on the Centrino processor, but the company isn't quite ready to release the code. "Intel has in mind a two-phase approach to providing software that Linux needs to take advantage of the processor maker's Centrino chips, an Intel executive said Wednesday. The chipmaker likely will begin by releasing a proprietary software module, called a driver, said Will Swope, general manager of Intel's Software and Solutions Group, speaking in an interview at the LinuxWorld Conference and Expo here. He said he hopes the company will later offer an open-source driver, software that the general Linux programming community may scrutinize and reshape if desired."

Also, Intel will produce a WiFi driver for the Centrino. "The driver will be released initially under a proprietary licence, but Intel general manager of software and solutions, Will Swope, did suggest that the driver could later move into the open source domain."

Comments (9 posted)

Microsoft Files for XML Patents (LinuxWorld News Desk)

The LinuxWorld News Desk reports on an interesting patent move by Microsoft. "In what is being interpreted as either a preemptive move against IBM's plan to migrate to Linux on the desktop, a direct challenge to software vendors who want to interoperate with Word through XML, or just a more general confirmation that it is worried about Open Source, Microsoft last week filed - in the European Union and New Zealand though not in the US - for various XML patents."

Comments (34 posted)

Linux Adoption

Linux in the Ministry of Finance in Poland (Linuxnews.pl)

Linuxnews.pl covers a large Linux deployment in Poland. "Deliveries of diskless net endings (Linux ones, of course) for the Ministry of Finance have already begun. In total, 12.210 terminals (Linux, Xfree, rdesktop, etc.) will be delivered. ComputerLand, a polish company, takes care of supplying required parts while DTK Kraków makes endings complete. It is the biggest delivery of such devices in Poland and, if we include one-time orders, one of the biggest in the world".

Comments (1 posted)

Decatur Jones' Cornett: Desktop Linux Will Affect Microsoft Faster Than Expected. (Groklaw)

Groklaw reprints a report by Decatur Jones analyst Dion Cornett, who was struck by what he saw at LinuxWorld. "More importantly, corporations are looking to switch from Microsoft, not so much to save on licensing fees, but to potentially enhance the security of their IT infrastructures. This week’s MyDoom virus only serves to reinforce such thinking."

Comments (15 posted)

Interviews

Q and A: Lindows.com's Kevin Carmony (OSNews)

OSNews interviews Kevin Carmony, president and COO of Lindows.com. "Interestingly, however, was that because we attracted a fair amount of attention in those early days with WINE, it got companies like Codeweavers, SuSE and Xandros excited about Microsoft Windows compatibility. The irony is that while these companies were getting excited and jumping into this, we were changing our direction and moving completely away from Microsoft Windows compatibility. We've never regretted our decision to use and support native Linux software." (Found on KDE.News.)

Comments (none posted)

An interview with Robert Love (Ars Technica)

Ars Technica interviews Robert Love. "Those of you who have tried the new 2.6 Linux kernels will undoubtedly have noticed how much more responsive the system feels under interactive use than earlier kernels. Others who have tried the kernel preemption patches or Con Kolivas' patches for interactive use will appreciate the difference as well. A large part of the credit for this work goes to Robert M. Love."

Comments (none posted)

Brewster Kahle on the Internet Archive and People's Technology (O'Reilly)

Lisa Rein interviews Brewster Kahle on O'Reilly. "Brewster Kahle is the founder and digital librarian for the Internet Archive (IA). He is also on the board of the Electronic Frontier Foundation. The IA started out as just that -- a non-profit organization dedicated to taking snap shots of the entire Web every six months, in order to create a searchable archive."

Comments (none posted)

Resources

WorldForge Weekly News

The January 23, 2004 WorldForge Weekly News has been published. Take a look to see what's new with the WorldForge game project.

Comments (none posted)

Reviews

A look at KDE 3.2 Beta 2 (NewsForge)

NewsForge takes a look at KDE 3.2 Beta 2. "An unusual splash screen appears after your first KDE 3.2 startup. It seems to be a photo of all the developers from the KDE developers conference in Nove Hrady (near Prague). After this the well-known First Time Assistant leads you through the initial setup. If you follow the suggestions of the wizard you end up with the default look and feel of 3.1x, but with a more modern-looking taskbar and a nicely shortened KMenu."

Comments (none posted)

Savage: The Battle For Newerth (LinuxLookup.com)

LinuxLookup reviews the game Savage: The Battle For Newerth. "As far as I am aware, Savage is the first title to attempt an amalgamation of two popular existing genres - Real Time Strategy & First Person Shooter. The question to pose is this: Savage - success or mess?"

Comments (none posted)

MySQL's MaxDB: A work in progress (NewsForge)

NewsForge takes a look at MaxDB. "The lineage of MaxDB goes back several years, involves a few companies, and uses a few names. It grew out of Adabas, a database that has been around since the 1980s. A version of Adabas was obtained by the German software company SAP AB in the mid-1990's and eventually rebranded as SAP DB. Displaying amazing foresight for the time, SAP AB decided to release the source code of SAP DB under the GNU GPL in the year 2000. Unfortunately, this event was not promoted by SAP AB, so SAP DB languished as perhaps the most significant yet obscure Open Source project in the community."

Comments (2 posted)

Wikipedia Shows Power of Cooperation (SiliconValley)

Dan Gillmor looks at Wikipedia for his Mercury News (and beyond) column. "Similarly, a Wiki draws strength from its volunteers who catch and fix every act of online vandalism. When the bad guys learn that someone will repair their damage within minutes, and therefore prevent the damage from being visible to the world, they tend to give up and move along to more vulnerable places."

Comments (1 posted)

Miscellaneous

Lessons from the Campaign Pressure Cooker (Linux Journal)

Doc Searls reports from the Dean camp, in this Linux Journal article. "During my time with the Dean team, I heard Cluetrain quoted a number of times. There was my "markets are conversations" line and David Weinberger's "hyperlinks subvert hierarchy." But the one that made the most sense for the campaign itself was Chris Locke's "networked markets get smarter faster than most companies". Exactly that principle, they said, applied in electoral politics today. That's why they were building or applying technologies that embraced their own networked markets."

Comments (4 posted)

Page editor: Forrest Cook

Announcements

Non-Commercial announcements

Apache Version 2 License Approved

Version 2.0 of the Apache License has been approved. "The goals of this license revision have been to reduce the number of frequently asked questions, to allow the license to be reusable without modification by any project (including non-ASF projects), to allow the license to be included by reference instead of listed in every file, to clarify the license on submission of contributions, to require a patent license on contributions that necessarily infringe the contributor's own patents, and to move comments regarding Apache and other inherited attribution notices to a location outside the license terms."

Full Story (comments: none)

DVDCCA gives up on Bunner case

According to this EFF advisory, the DVD Copy Control Association has decided to push for the dismissal of the DeCSS suit against Andrew Bunner. By doing so, the DVDCCA has given up its attempt to claim that DeCSS violates trade secrets. The battle to win the right to view DVDs on Linux systems is not yet won, since DeCSS remains vulnerable to DMCA charges. But the elimination of the trade secret attack is an important step in the right direction.

Comments (5 posted)

Freenode turns 10

At 1:49 UTC on January 29, Freenode (once #linuxneo, once irc.linpeople.org) will celebrate its 10th birthday. It started small in 1994, but has grown since then: "Today, Freenode peaks at over 15,000 users, and we're home to coordination channels for such projects as Debian GNU/Linux, fedora, Gentoo, KDE and subversion. We're the official IRC network of the Free Software Foundation's GNU project; we provide support channels for FreeBSD, GNU/Linux and a variety of free software applications." The party will be happening over IRC, of course, and will last all day; click below for the details.

Full Story (comments: 1)

Free Standards Group becomes an ISO specification submitter

The Free Standards Group has announced that it has been recognized by the International Organization for Standardization (ISO) as a "submitter of publicly available specifications" for Linux. This is the first step toward the FSG's goal of getting ISO certification for the Linux standards.

Comments (4 posted)

IEEE and The Open Group grant permissions to the Linux Man Pages project

The IEEE and The Open Group have given the Linux Man Pages project permission to incorporate materials from the POSIX Standard and the Open Group Base Specifications.

Full Story (comments: none)

Japanese NEC Soft joins OSDL

NEC Soft, a Japanese software and systems integration firm, has joined the OSDL.

Full Story (comments: none)

RealNetworks and Helix buy into Ogg

The Ogg Vorbis site mentions several moves by RealNetworks to support Ogg Vorbis, an open-source audio compression system that is similar to mp3. "A triple treat! First, RealNetworks has awarded the Xiph.Org foundation one of its Helix Grants to support continued development of Ogg, second, the Real Helix player now supports Vorbis and [alpha-release] Theora, and third, Real has announced its intention to support Ogg across client, server and native production tools."

Comments (49 posted)

wxWindows copyright program withdrawn

The wxWindows cross-platform GUI project has cancelled its new copyright assignment process. "The wxWindows Software Foundation regrets that it is cancelling the copyright assignment process due to support for assignment within the wxWindows community failing to reach a critical mass."

Comments (none posted)

Commercial announcements

Intel Launches Linux Tool (TechWeb)

Intel Corp. has announced a new version of its commercial performance analysis tool for the Itanium processor.

Comments (1 posted)

MandrakeSoft posts first quarter results

The MandrakeSoft shareholder newsletter for the company's first quarter is out. The bottom line: a €270,000 profit, the company's first in years. MandrakeSoft predicts a break-even result for the rest of the coming year.

Comments (3 posted)

MySQL Administrator available

MySQL AB has announced the availability of the commercial MySQL Administrator. "MySQL Administrator is a powerful visual administration console so you can now easily administer your MySQL environment and gain significantly better visibility into the how your databases are operating. MySQL Administrator now integrates database management and maintenance into a single, seamless environment, with a clear and intuitive graphical user interface."

Comments (none posted)

Red Hat (re)launches WIDE OPEN Magazine

Those of us who have been watching Red Hat for a while will remember "Wide Open Source," an online news site that the company launched back when it was planning to be in the web portal business. Wide Open didn't last for very long, but, at LinuxWorld, Red Hat has announced its return - this time as a subscription-based, bi-monthly print magazine.

Comments (none posted)

Red Hat to roll out Linux OS in Hindi.

Red Hat has announced that it will be releasing a Hindi version of Linux in India. "Matthew Szulik, Red Hat's chief executive officer and president who is visiting India, said Thursday that the Hindi version would hit Indian markets in two months."

Comments (none posted)

Sleepycat Software sales increase 60%

Sleepycat Software, the company behind the Berkeley DB, has announced that sales grew 60% in 2003 and the company achieved "record levels of profitability." It is possible to make money in the free software business, it seems.

Comments (9 posted)

A letter from Sun to IBM

Sun's Jonathan Schwartz has posted an open letter to IBM on how IBM could move over to Linux desktops. "You're probably familiar with Sun's Java Desktop System - it's the most popular Linux desktop on the market today, featuring Sun's Java Virtual Machine, the award winning StarOffice productivity suite, Mozilla browser, Gnome windowing environment, and support from Real Networks, Macromedia and Adobe.... To help IBM with your transition, we can offer a desktop for every one of your employees - with a free right to use the desktop at home - for $50/employee. Consider this a formal quote from Sun. But only if you're willing to buy in volume."

Comments (30 posted)

weather.com Delivers Winter Storm Details in Record Time

Here's a press release from weather.com expressing their satisfaction with their new Dell systems powered by SUSE Linux.

Comments (5 posted)

Xandros launches business desktop and management system

Xandros has sent out a couple of announcements this morning. The first is for its new "Business Desktop," which is optimized to work within Windows-dominated environments. Xandros "xDMS" is a management system intended to help with the administration of thousands of desktops.

Full Story (comments: none)

New Books

Prentice Hall publishes a new book on Qt

Prentice Hall has published the book C++ GUI Programming with Qt 3 by Blanchette and Summerfield.

Full Story (comments: none)

Resources

LDP Weekly News

The Linux Documentation Project Weekly News is out for January 21, 2004. Take a look for the latest documentation changes.

Full Story (comments: none)

LDP Weekly News

The January 28, 2004 edition of the Linux Documentation Project Weekly News has been published. Take a look for the latest new documentation releases.

Full Story (comments: none)

Contests and Awards

LinuxWorld Magazine Readers' Choice Awards Winners

The winners of the LinuxWorld Magazine Readers' Choice Awards have been announced. "LinuxWorld Magazine Readers' Choice Awards Recognize 56 Winners and Finalists for Excellence in Every Aspect of Linux in 14 Separate Categories, From Best Linux Distro to Best Linux Programming Environment".

Comments (none posted)

Winners of Product Excellence Awards

IDG World Expo has announced the winners of the Product Excellence Awards at LinuxWorld Conference & Expo. Some of the award winners include Novell, IBM Tivoli, Xandros and KDE.

Comments (4 posted)

ActiveState Perl Haiku Poetry Contest

A new Perl Haiku Contest is being held by ActiveState. Prizes are available, Perl Poetry should be submitted by February 8, 2004.

Comments (none posted)

Event Reports

Thursday's LinuxWorld press releases

LinuxWorld is, as always, an effective generator of press releases. Here's a sampling:

• Arkeia has a new backup offering which includes hot backup for MySQL databases.
• Black Duck Software has announced its existence as a company providing software for automated "software intellectual property risk management."
• Concurrent has announced the availability of RedHawk Linux 2.0, a real-time distribution aimed at the AMD64 processor.
• IBM has announced the "Carrier Grade Open Framework Reference Implementation," based on Linux.
• Intel is shipping the "VTune" performance analyzer tool (v2.0) for Linux.
• MySQL and Zend have announced a partnership to improve the integration between MySQL and PHP. MySQL has also released a new administration tool.
• MySQL and JBoss have also announced a partnership to integrate their respective offerings.
• Pathscale has a set of high-performance Linux compilers for C, C++, and Fortran on the AMD64 architecture.
• Progeny has announced that its Red Hat Linux Transition Service is getting a "tremendous" response.
• Red Hat has announced a new provisioning module for the Red Hat Network.
• Scalix has released a new version of its calendaring and messaging system for Linux.
• Scyld has announced the "29-series" release of Scyld Beowulf, featuring Itanium and AMD64 support along with numerous new features.

Comments (none posted)

Free Software and World Social Forum 2004 - Mumbai

The World Social Forum in Mumbai, India made use of Linux and open-source software. "Free Software keeps communications alive at the WSF The Media Center at WSF 2004, equipped with a complete network lab of 120 computers and 40 lap-top connections was maintained open and functional 24 hrs for the entire forum with FREE SOFTWARE!!!"

Full Story (comments: none)

Upcoming Events

Second LAD Conference

The second Linux Audio Developers (LAD) conference has been announced. The event will take place from April 29 - May 2, 2004 in Karlsruhe, Germany. A call for music (CFM) is included in the announcement.

Full Story (comments: none)

AGNULA at Sounds Expo 2004

Members of the AGNULA project (A GNU Linux Audio distribution) will be at the GNU/Linux Audio Centre booth during the Sounds Expo 2004 conference in London on February 10-12, 2004.

Full Story (comments: none)

The Open Group's Open Standards and Certification Conference

The Open Group will be holding their Boundaryless Information Flow: Open Standards & Certification conference on February 2-6, 2004 in San Diego, CA.

Full Story (comments: none)

Third Annual CodeCon announced

The Third Annual CodeCon conference will be held in San Francisco, CA on February 20-22, 2004.

Full Story (comments: none)

Copyright in the Digital Age, Brussels

A free workshop entitled "Copyright in the Digital Age" will be held in Brussels on February 4, 2004. "This is a one day workshop hosted by the The Trans Atlantic Consumer Dialogue (TACD) Committee on Intellectual Property, with support from the Rockefeller Foundation."

Full Story (comments: none)

LogOn Briefings at CeBIT - Call for Submissions

LogOn Technology Transfer has announced its upcoming technical briefings program. "As part of the enhanced educational program of this year's CeBIT show in Hannover (March 18-24, 2004), LogOn Technology Transfer is organizing a program of technical briefings."

Full Story (comments: none)

Mozilla Developer Day (MozillaZine)

The next Mozilla Developer Day will be held on February 27, 2004 in (or near) Mountain View, CA.

Comments (none posted)

SIIA Announces First Enterprise Software Summit

The first Enterprise Software Summit has been announced. The event will take place on May 17-19, 2004 in San Francisco, CA. "The list of topics to be addressed include: offshore outsourcing, utility computing, licensing models, open source issues, consolidation, revenue recognition issues and many more of the challenges facing the new software industry."

Comments (none posted)

6th German Perl Workshop

The sixth German Perl Workshop will be held near Stuttgart, Germany on June 29 - July 1, 2004. A call for papers has been posted.

Comments (none posted)

PyCon Early Bird Registration Deadline

The early bird registration deadline for PyCon DC 2004 is February 1, 2004.

Full Story (comments: none)

Events: January 29 - March 27, 2004

Date	Event	Location
January 29 - February 1, 2004	NordU/USENIX 2004	Copenhagen, Denmark
January 29, 2004	Linux for business 2004	Hotel De Biltsche Hoek, de Bilt
January 31 - February 1, 2004	WineConf 2004	(Court International Building)St. Paul, Minnesota
February 2 - 6, 2004	EclipseCon 2004	(Disneyland Hotel)Anaheim, CA
February 2 - 4, 2004	Open Standards and Certification Conference	(San Diego Marriott Mission Valley)San Diego, CA
February 3 - 5, 2004	Linux Solutions 2004	Paris, France
February 9 - 12, 2004	O'Reilly Emerging Technology Conference(ETech)	(The Westin Horton Plaza)San Diego, CA
February 20 - 22, 2004	CodeCon 2004	(Club NV)San Francisco, CA
February 20 - 24, 2004	PaWS PHP and Web Standards UK 2004	Manchester, UK
February 21 - 22, 2004	Mozilla Developers Meeting in Europe 4.0	Brussels, Belgium
February 21 - 22, 2004	FOSDEM 2004	(SOLBOSCH)Brussels, Belgium
February 23 - 27, 2004	PostgreSQL Bootcamp	(Big Nerd Ranch, Inc.)Atlanta, GA
February 25 - 26, 2004	UKUUG LISA/Winter Conference and Tutorial	(Lansdowne Campus, Bournemouth Univ.)Bournemouth, UK
February 27, 2004	Mozilla Developer Day	Mountain View, CA
March 1 - 5, 2004	PHP|Cruise	The Caribbean
March 5, 2004	Perl Workshop 2004	Amsterdam, the Netherlands
March 15 - 17, 2004	Open Source in Government Conference	(George Washington University)Washington, DC
March 16 - 17, 2004	Open Source Business Conference 2004	(The Westin St. Francis)San Francisco, CA
March 18 - 24, 2004	CeBIT	(Hannover Exhibition Center)Hannover, Germany
March 24 - 26, 2004	PyCon DC 2004	Washington, D.C.
March 27 - 28, 2004	Nordic Perl Workshop 2004	(Symbion Science Park)Copenhagen, Denmark
March 27 - 28, 2004	YAPC::Taipei::2004	Taipei, Taiwan

Comments (none posted)

Web sites

OSDir BB for Linux

Steve Mallett has announced his OSDir open source applications forum in an O'Reilly article. The forum aims to help Windows users transition to the world of Open Source software.

Comments (none posted)

Software announcements

This week's software announcements

Here are the software announcements, courtesy of Freshmeat.net. They are available in two formats:

• Sorted alphabetically,
• Sorted by license.

Comments (none posted)

Page editor: Forrest Cook