LWN.net Weekly Edition for February 19, 2004

321 Studios and the free software community

In the Bunner DVD case, the DVD Copy Control Association attempted to suppress the distribution (or even linking to) of the DeCSS code (which decrypts content from DVDs) with the claim that the code contained trade secrets. The court's rulings suggested that the trade secret claim was not going to hold up, and the Bunner case was dropped last year. The trade secret weapon had proved ineffective in this case.

The DVDCCA has responded with a change of direction: the group is now suing 321 Studios, which makes a proprietary DVD copying program, for patent infringement. 321 and its DVD Copy program have been in and out of the courts for a while; the company started the litigation with a suit which attempted to obtain a ruling stating that its products do not violate the DMCA. The bringing of a patent suit changes the nature of this battle, however. It is a living demonstration of one of the free software community's deepest fears: that software patents will be used to prevent us from programming our computers to work the way we want them to.

It is interesting to note that patents are incompatible with trade secrets. Patent applications require full disclosure of the technology for which protection is sought; any technology which has been publicly disclosed in this manner cannot, by definition, be a trade secret. Thus far, we have been unable to turn up a reference for the exact patent which is being claimed by the DVDCCA; if anybody has a pointer, we would appreciate hearing about it. Given the timing, however, the patent application must have been in the works while the trade secret case was pending. Filing trade secret suits while having already disclosed the relevant technology would be, at the least, an act of bad faith.

321 Studios is also being sued by Macrovision, which is also claiming patent infringement along with DMCA violations. 321 has just filed a response pointing out that, among other things, Macrovision's patents cover an analog copy-protection mechanism which is not relevant to a digital copying program.

This company has been fighting many of the same digital rights battles as the free software community. But there has been no big outpouring of support for 321 studios; for the most part, its battles have been ignored. 321 Studios has not been able to obtain the same level of interest and support as, say, Elcomsoft has. One might point out that 321 Studios is a proprietary software company; that is true, but so is Elcomsoft. The real answer, perhaps, is that the community has sensed that 321 Studios does not really share its values; 321 appears to have little interest in any issues beyond immediate sales of DVD copying software.

The difference in values has just become rather more apparent, however; see this triumphant press release from February 5. Therein, 321 notes that one of its customers was said to be using DVDXCopy for "piracy." The company responded by shutting down the software remotely. This program, it seems, puts a watermark into every disk it creates allowing the company to identify who performed the copy and, should it feel so inclined, to shut down the software altogether.

This feature highlights one of the largest differences between free software and (at least some of) its proprietary relatives. The DeCSS code does not come with watermarking and remote shutdown capabilities. The Gimp will not attempt to prevent its users from creating an image that might look like some nations' currencies, and Ghostscript will not try to prevent that user from printing such images. Neither Freevo nor MythTV will phone home with details of just how often the user replayed the latest banal Superbowl publicity stunt. Nothing prevents anybody from coding any such features, but, equally, nothing prevents the rest of the world from taking them back out. Free software evolves toward one specific end: meeting the needs of its users. There is no room for conflicts of interest, no space for the agendas of industry consortia, advertisers, or governments.

321 Studios is not fighting for that view of the software universe; the company simply wants to be able to sell its product. We can certainly sympathize with the company as it deals with familiar problems like the DMCA and software patents. But, while 321 is fighting many of the same battles as the free software community, it is fighting them as part of a different war.

Comments (5 posted)

SCO Weekly News

Let us start off this week's SCO update with some quotes:

There are many more quotes available on this theme, but certainly the idea is clear by now. Like so many other bits of SCO bluster, the threats of suits against end users have not been followed up by any sort of action. Yet.

Whether such a suit will eventually come remains an open question, however. SCO is currently fighting IBM, Red Hat, and Novell in three separate cases, and none of the three appear to be going particularly well. At some point SCO's management should be forced to conclude that the company simply does not have the resources to open any more legal fronts. Dividing SCO's scarce cash and (possibly not so scarce) lawyers among even more courtrooms would not appear to be a wise strategy.

On the other hand, few people have accused SCO of acting wisely in recent times. The company is due to post a quarterly earnings report that, by all estimates, will be dismal. SCO stock is well below the peak values it hit in September and October. The mainstream media is beginning to wake up, and its coverage is increasingly hostile. SCO's only hope for continued existence would appear to be to somehow shake money out of some easily-cowed Linux users, but those users are proving to have rather more backbone than SCO may have anticipated. The SCO Group may yet decide that its best interests lie in even more litigation.

One view into how the shakedown effort is proceeding can be found in Red Hat's motion to supplement its filings in its suit against SCO. That case is (still!) waiting for the judge to come to a conclusion on SCO's motion to dismiss the case, which was filed in September. Since then, a few things have happened which have made it increasingly clear that SCO does, indeed, intend to go after Red Hat and its customers. Red Hat's motion is an attempt to bring SCO's more recent actions to the judge's attention.

One of the things Red Hat is pointing out is a letter sent by SCO to Lehman Brothers Holdings. It is a variant on the standard SCO shakedown letter; the point here is that Lehman Brothers is a Red Hat customer. Happily, Lehman Brothers saw no point in giving in to SCO; its response is short and clear, and is best paraphrased as "go bug Red Hat."

Part of the problem for SCO is that Novell's claims on the Unix copyrights make it easy for prospective SCO victims to ignore the letters. If SCO can't put forward a clear claim to the Unix copyrights, it will have a hard time collecting from anybody regardless of the validity of its statements about the provenance of Linux. For that reason, the company was compelled to file suit against Novell, in hopes of clearing that obstruction.

Unfortunately for SCO, Novell has filed a compelling motion to dismiss the suit. Essentially, says Novell, the SCO suit is missing two things that are required in "slander of title" suits: proof that the defendant's statements are false, and a demonstration that actual damages have been suffered. As Novell points out, SCO's demand that the court force Novell to transfer the copyrights proves that Novell's claims are true; SCO's suit contradicts itself. See Groklaw for a far more detailed discussion of Novell's motion.

Meanwhile, as of this writing, the Utah court still has not issued any rulings regarding the motions to compel in the IBM case. There is no way to know what this delay means until the court speaks. Chances are it will be something interesting, however.

Comments (6 posted)

The Grumpy Editor's browser review - a followup

The review of Gecko-based browsers we ran last week generated a great deal of feedback; this is evidently an area of great interest to many users. We have just a few things to add to that review this time around.

Thanks primarily to reader comments, your editor was able to resolve almost all of his complaints with the Firefox browser. Image animation can be controlled via the user-hostile about:config screen, the prefs.js file found in a randomly-named directory under ~/.phoenix, or via plugin extensions. Antialiased fonts are to be had by downloading the correct version of the browser. And so on. The situation has improved to the point where your editor is now using Firefox as his preferred browser.

The real key to the success of Firefox may well prove to be its extension architecture. History has shown many times that, if an application provides an easy mechanism for users to graft in additional or different functionality, those users will run with it. The lengthy list of extensions available for Firefox shows that this browser has reached a critical mass in this regard. Extensions are available to provide all kinds of navigation tools, to help with weblogging, to assist in web page authoring, and many other tasks including, inevitably, playing Tetris. It would be nice not to have to go find an extension to replace the missing "up" navigation button, but it's nice that you can. One can only hope that the security implications of encouraging users to download and install browser plugins have been thought through.

If last week's review were to be written today, the conclusion might have been written a little differently. Firefox has a level of performance, reliability, and features that well exceeds the other Gecko-based browsers available. One might well wonder why Galeon and Epiphany continue to exist; they appear to be trying to do the same thing as Firefox but - at this moment in time, anyway - they do it less reliably and with fewer features. (Do see, however, this posting on why Red Hat is shipping Epiphany for a different view). As we noted last week, there could well be a place for multiple browser projects, but each should be looking for a unique way to extend the state of the art.

Meanwhile, your editor also found the time to get Konqueror 3.2 working. Konqueror is everything its proponents claim it is: a fast, powerful and robust tool for navigating through information, be it on the local system or on the net. Your editor has never had much use for file managers, and so does not place much value on Konqueror's implementation. He can see, however, that Konqueror does look like a very nice file manager. The web browser is capable and fast, and highly configurable. Some features, such as the ability to change the identification string to get past certain difficult web site programmers, are unique.

What Konqueror still seems to be lacking, however is a password manager. Security-conscious users may feel better off without this feature, but the simple fact is that it has gotten hard to keep track of the long list of usernames and passwords needed to access many useful sites on the web. A password manager can be most useful when trying to remember which login information was used to get into some obscure site with its own strange rules. It is surprising, really, that Konqueror has not picked up this capability yet.

That notwithstanding, if Konqueror were the only browser available for Linux systems, we would be in good shape. Linux is second to no other system now in the quality of its web browsing support. It will be more than interesting to see where things go from here as the various projects look for new ways to extend the state of the art.

Comments (20 posted)

FOSDEM 2004

The 2004 edition of the Free and Open Source Developers Meeting will be happening on February 21 and 22 in Brussels. LWN editor Jonathan Corbet will be there. In a moment of weakness last month (he blames Australian wine), he agreed to give two different talks at the event. Happily, FOSDEM has three tracks this year, so it should be possible to avoid those talks and see something interesting. The schedule has the details. Keynote speakers include Tim O'Reilly, Richard Stallman, and, of course, Jon 'maddog' Hall. FOSDEM looks to be an interesting event.

For the first time, LWN is happy to be sponsoring this event. With luck, this sponsorship will allow us to help a community event while simultaneously bringing in more subscribers. If things work out, we'll be sponsoring more events in the future.

Meanwhile, we're looking forward to meeting some of our European readers; see you there.

Comments (2 posted)

Page editor: Jonathan Corbet

Security

Brief items

A new mremap() vulnerability

The mremap() system call allows a process to change its virtual memory layout by adjusting the size and location of a virtual memory area. One of the things mremap() can do is move one virtual memory area (VMA) into the middle of another one. In that case, the target VMA will be split in two so that the space in the middle can be freed and reused for the VMA being moved. As long as the calling process knows what it is doing (it doesn't need the pages being replaced by the moved area, for example), all of this is fine.

An interesting thing can happen in the 2.4.24 and 2.6.2 kernels, however. The kernel enforces a limit on the maximum number of VMAs that any one process can have. If the kernel attempts to split a VMA in response to the sort of mremap() call described above, it will check the process's VMA usage against the limit. Splitting requires the addition of a new VMA, so this check is necessary. If the limit has been reached, the internal call which splits the VMA (do_munmap()) will return a failure status. So far, so good.

The problem is that mremap() did not check to see if do_munmap() succeeded or not. If the split failed, mremap() would continue anyway. The end result is that the old target VMA would remain, with its existing permissions, but some of its associated page table entries would be overwritten by entries from the VMA being moved. In other words, an attacker can exploit this bug to obtain access to a set of pages which the kernel would not otherwise have allowed. This vulnerability can be exploited by a local hacker to obtain root access on any Linux system running a vulnerable kernel.

The solution is to upgrade to 2.4.25 or 2.6.3, or to apply the appropriate distributor security update. The LWN vulnerability entry tracks the available updates. For more information on the vulnerability, see this advisory from Paul Starzetz.

Comments (6 posted)

New vulnerabilities

cgiemail vulnerability allows unauthorized mail relaying

Package(s):	cgiemail	CVE #(s):	CAN-2002-1575
Created:	February 13, 2004	Updated:	February 18, 2004
Description:	A vulnerability in cgiemail, a cgi program, allows mail to be sent to arbitrary addresses, making the host capable of generating spam. New cgiemail packages fix open mail relaying.
Alerts:	Debian DSA-437-1 2004-02-11

Comments (none posted)

elm: vulnerability in frm command

Package(s):	elm	CVE #(s):	CAN-2003-0966
Created:	February 13, 2004	Updated:	February 18, 2004
Description:	Elm is a terminal mode email user agent. The frm command is provided as part of the Elm packages and gives a summary list of the sender and subject of selected messages in a mailbox or folder. A buffer overflow vulnerability was found in the frm command. An attacker could create a message with an overly long Subject line such that when the frm command is run by a victim arbitrary code is executed. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0966 to this issue.
Alerts:	Whitebox WBSA-2004:009-01 2004-02-12

Comments (1 posted)

kernel: local root exploit

Package(s):	kernel	CVE #(s):	CAN-2003-0961 CAN-2003-0985 CAN-2004-0077
Created:	February 18, 2004	Updated:	March 8, 2004
Description:	Another vulnerability has been found in the 2.4.24 and 2.6.2 mremap() system call; once again, this hole can be exploited by a local user to obtain root access. See this advisory from Paul Starzetz for details.
Alerts:	Gentoo 200403-02 2004-03-06 Debian DSA-456-1 2004-03-06 Fedora-Legacy FLSA:1284 2004-03-02 Debian DSA-454-1 2004-03-02 Debian DSA-453-1 2004-03-02 Debian DSA-450-1 2004-02-27 Immunix IMNX-2004-7+-001-01 2004-02-26 Mandrake MDKSA-2004:015-1 2004-02-25 Mandrake MDKSA-2004:015 2004-02-24 Trustix 2004-0008 2004-02-23 Netwosix NW-2004-0003 2004-02-20 Whitebox WBSA-2004:066-01 2004-02-19 Debian DSA-444-1 2004-02-20 Conectiva CLA-2004:820 2004-02-20 Red Hat RHSA-2004:066-01 2004-02-19 Fedora FEDORA-2004-080 2004-02-18 SuSE SuSE-SA:2004:005 2004-02-18 Red Hat RHSA-2004:069-01 2004-02-18 Fedora FEDORA-2004-079 2004-02-18 Debian DSA-441-1 2004-02-18 Trustix 2004-0007 2004-02-18 Slackware SSA:2004-049-01 2004-02-18 Debian DSA-438-1 2004-02-18 Red Hat RHSA-2004:065-01 2004-02-18 Debian DSA-439-1 2004-02-18 Debian DSA-440-1 2004-02-18

Comments (none posted)

metamail: integer and buffer overflows

Package(s):	metamail	CVE #(s):	CAN-2004-0104 CAN-2004-0105
Created:	February 18, 2004	Updated:	May 21, 2004
Description:	Versions of metamail through 2.7 contain a set of integer and buffer overflows which are remotely exploitable via a properly crafted message.
Alerts:	Gentoo 200405-17 2004-05-21 Debian DSA-449-1 2004-02-24 Mandrake MDKSA-2004:014 2004-02-18 Slackware SSA:2004-049-02 2004-02-18 Red Hat RHSA-2004:073-01 2004-02-18

Comments (none posted)

phpMyAdmin: directory traversal

Package(s):	phpMyAdmin	CVE #(s):
Created:	February 17, 2004	Updated:	February 18, 2004
Description:	A component of the phpMyAdmin software package (export.php) does not properly verify input that is passed to it from a remote user. Since the input is used to include other files, it is possible to launch a directory traversal attack.
Alerts:	Gentoo 200402-05 2004-02-17

Comments (none posted)

PWLib: possible Denial of Service

Package(s):	PWLib	CVE #(s):	CAN-2004-0097
Created:	February 13, 2004	Updated:	April 9, 2004
Description:	PWLib is a cross-platform class library designed to support the OpenH323 project. OpenH323 provides an implementation of the ITU H.323 teleconferencing protocol, used by packages such as Gnome Meeting. A test suite for the H.225 protocol (part of the H.323 family) provided by the NISCC uncovered bugs in PWLib prior to version 1.6.0. An attacker could trigger these bugs by sending carefully crafted messages to an application. The effects of such an attack can vary depending on the application, but would usually result in a Denial of Service. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0097 to this issue.
Alerts:	Gentoo 200404-11 2004-04-09 Mandrake MDKSA-2004:017 2004-03-03 Fedora FEDORA-2004-078 2004-03-02 Debian DSA-448-1 2004-02-22 Whitebox WBSA-2004:047-01 2004-02-18 Red Hat RHSA-2004:047-01 2004-02-18 Red Hat RHSA-2004:048-01 2004-02-13

Comments (none posted)

samba: access to disabled accounts

Package(s):	samba	CVE #(s):	CAN-2004-0082
Created:	February 18, 2004	Updated:	February 19, 2004
Description:	Samba 3.0.0 and 3.0.1 contains a difficult-to-exploit vulnerability which could give an attacker access to a disabled account.
Alerts:	Whitebox WBSA-2004:064-01 2004-02-18 Red Hat RHSA-2004:064-01 2004-02-18

Comments (none posted)

Updated vulnerabilities

apache: buffer overflows in mod_alias, mod_rewrite

Package(s):	apache	CVE #(s):	CAN-2003-0542 CAN-2003-0789
Created:	October 28, 2003	Updated:	February 13, 2004
Description:	André Malo discovered buffer overflows in the mod_alias and mod_rewrite modules of the Apache webserver. These occurred if a regular expression with more than 9 capturing parenthesis was configured. To exploit this, an attacker would need to be able to locally create a carefully crafted configuration file (.htaccess or httpd.conf). CAN-2003-0542 Another buffer overflow in Apache 2.0.47 and earlier in mod_cgid's mishandling of CGI redirect paths could result in CGI output going to the wrong client when a threaded MPM is used. CAN-2003-0789.
Alerts:	Whitebox WBSA-2004:015-01 2004-02-12 Fedora FEDORA-2003-004 2004-01-08 Red Hat RHSA-2003:405-00 2003-12-18 Red Hat RHSA-2003:320-01 2003-12-16 Red Hat RHSA-2003:360-01 2003-12-10 Gentoo 200310-03 2003-10-28 Trustix 2003-0041 2003-11-15 Conectiva CLA-2003:775 2003-11-05 Slackware SSA:2003-308-01 2003-11-03 EnGarde ESA-20031105-030 2003-11-05 Mandrake MDKSA-2003:103 2003-11-03 Gentoo 200310-04 2003-10-31 Immunix IMNX-2003-7+-025-01 2003-10-28 OpenPKG OpenPKG-SA-2003.046 2003-10-28

Comments (none posted)

apache2: Denial of Service vulnerability

Package(s):	apache2	CVE #(s):
Created:	September 29, 2003	Updated:	March 25, 2004
Description:	A problem was discovered in Apache2 where CGI scripts that write more than 4k to the standard error stream will hang the script's execution. This problem can lead to a denial of service situation. See this bug report for additional details.
Alerts:	Gentoo 200403-04 2004-03-22 Netwosix NW-2004-0006 2004-03-25 Mandrake MDKSA-2003:096-1 2003-10-24 Mandrake MDKSA-2003:096 2003-09-26

Comments (none posted)

bind: cache poisoning

Package(s):	bind	CVE #(s):	CAN-2003-0914
Created:	November 26, 2003	Updated:	February 19, 2004
Description:	A cache poisoning vulnerability in BIND may be exploited causing a temporary denial of service until the bad record expires from the cache.
Alerts:	SCO Group CSSA-2004-003.0 2004-02-19 Debian DSA-409-1 2004-01-05 SuSE SuSE-SA:2003:047 2003-11-28 Trustix 2003-0044 2003-11-27 Immunix IMNX-2003-7+-024-01 2003-10-27 EnGarde ESA-20031126-031 2003-11-26

Comments (none posted)

CUPS: denial of service

Package(s):	CUPS	CVE #(s):	CAN-2003-0788
Created:	November 3, 2003	Updated:	March 4, 2004
Description:	Paul Mitcheson reported a situation where the CUPS Internet Printing Protocol (IPP) implementation in CUPS versions prior to 1.1.19 would get into a busy loop. This could result in a denial of service. In order to exploit this bug an attacker would need to have the ability to make a TCP connection to the IPP port (by default 631).
Alerts:	SCO Group CSSA-2004-012.0 2004-03-03 Conectiva CLA-2003:779 2003-11-07 Mandrake MDKSA-2003:104 2003-11-05 Red Hat RHSA-2003:275-01 2003-11-03

Comments (none posted)

cvs: possible root compromise

Package(s):	cvs	CVE #(s):	CAN-2003-0977
Created:	December 29, 2003	Updated:	February 13, 2004
Description:	Stable CVS 1.11.11 has been released, adding code to the CVS server to prevent it from continuing as root after a user login, as an extra failsafe against a compromise of the CVSROOT/passwd file.
Alerts:	Whitebox WBSA-2004:004-01 2004-02-12 Fedora-Legacy FLSA:1207 2004-01-28 Conectiva CLA-2004:808 2004-01-20 Debian DSA-422-1 2004-01-13 Red Hat RHSA-2004:003-01 2004-01-09 Gentoo 200312-08 2003-12-28

Comments (none posted)

ethereal: protocol dissector and other vulnerabilities

Package(s):	ethereal	CVE #(s):	CAN-2003-0925 CAN-2003-0926 CAN-2003-0927 CAN-2003-1012 CAN-2003-1013
Created:	December 19, 2003	Updated:	February 13, 2004
Description:	Serious issues have been discovered in two ethereal protocol dissectors. Both vulnerabilities will make the Ethereal application crash. The Q.931 vulnerability also affects Tethereal. It is not known if either vulnerability can be used to make Ethereal or Tethereal run arbitrary code. (CAN-2003-1012 and CAN-2003-1013)
Alerts:	Whitebox WBSA-2004:002-01 2004-02-12 Fedora-Legacy FLSA:1193 2004-01-31 Red Hat RHSA-2004:002-01 2004-01-05 Mandrake MDKSA-2004:002 2004-01-13 Conectiva CLA-2004:801 2004-01-07 Red Hat RHSA-2004:001-01 2004-01-07 Debian DSA-407-1 2004-01-05 Fedora FEDORA-2003-040 2003-12-18

Comments (none posted)

Filename disclosure vulnerability in fam

Package(s):	fam	CVE #(s):	CAN-2002-0875
Created:	August 19, 2002	Updated:	January 5, 2005
Description:	"fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible.
Alerts:	Red Hat RHSA-2005:005-01 2005-01-05 Debian DSA-154-1 2002-08-15

Comments (none posted)

fetchmail may crash on specially crafted message

Package(s):	fetchmail	CVE #(s):	CAN-2003-0792
Created:	October 17, 2003	Updated:	April 8, 2004
Description:	A bug was discovered in fetchmail 6.2.4 where a specially crafted email message can cause fetchmail to crash.
Alerts:	OpenPKG OpenPKG-SA-2004.012 2004-04-08 Gentoo 200403-10 2004-03-30 Netwosix NW-2004-0002 2004-02-20 SCO Group CSSA-2004-004.0 2004-02-19 Slackware SSA:2003-300-02 2003-10-22 Mandrake MDKSA-2003:101 2003-10-16

Comments (none posted)

fileutils/wu-ftpd: denial of service

Package(s):	fileutils	CVE #(s):	CAN-2003-0854
Created:	October 22, 2003	Updated:	March 2, 2004
Description:	There is, it seems, an integer overflow vulnerability in "ls" which can be exploited via wu-ftpd to create a denial of service situation. See this advisory from Georgi Guninski for details.
Alerts:	SCO Group CSSA-2004-006.0 2004-03-01 Trustix 2003-0042 2003-11-15 Mandrake MDKSA-2003:106 2003-11-12 Red Hat RHSA-2003:309-01 2003-11-03 Immunix IMNX-2003-7+-026-01 2003-10-31 Conectiva CLA-2003:771 2003-10-24 Conectiva CLA-2003:768 2003-10-22

Comments (none posted)

gaim: remote overflows

Package(s):	gaim	CVE #(s):	CAN-2004-0006 CAN-2004-0007 CAN-2004-0008
Created:	January 26, 2004	Updated:	February 17, 2004
Description:	Stefan Esser has discovered several vulnerabilities in Gaim 0.75. This advisory has details of 12 separate vulnerabilities.
Alerts:	Fedora FEDORA-2004-070 2004-02-16 Whitebox WBSA-2004:033-01 2004-02-12 Conectiva CLA-2004:813 2004-02-10 Red Hat RHSA-2004:045-01 2004-02-09 Debian DSA-434-1 2004-02-05 Mandrake MDKSA-2004:006-1 2004-01-30 SuSE SuSE-SA:2004:004 2004-01-29 Gentoo 200401-04 2004-01-27 Mandrake MDKSA-2004:006 2004-01-26 Slackware SSA:2004-026-01 2004-01-26 Red Hat RHSA-2004:033-01 2004-01-23 Red Hat RHSA-2004:032-01 2004-01-23

Comments (none posted)

gallery: code injection

Package(s):	gallery	CVE #(s):
Created:	February 12, 2004	Updated:	February 12, 2004
Description:	Gallery (through versions 1.4.1) suffers from a PHP code injection vulnerability which can provide a remote attacker with access to the web server process.
Alerts:	Gentoo 200402-04 2004-02-11

Comments (none posted)

GnuPG: ElGamal signing keys compromised

Package(s):	gnupg	CVE #(s):	CAN-2003-0971
Created:	November 28, 2003	Updated:	March 3, 2004
Description:	A severe vulnerability was discovered in GnuPG by Phong Nguyen relating to ElGamal sign+encrypt keys. This email message from Werner Koch contains more information. "Phong Nguyen identified a severe bug in the way GnuPG creates and uses ElGamal keys for signing. This is a significant security failure which can lead to a compromise of almost all ElGamal keys used for signing. Note that this is a real world vulnerability which will reveal your private key within a few seconds."
Alerts:	SCO Group CSSA-2004-009.0 2004-03-02 Debian DSA-429-2 2004-02-13 Debian DSA-429-1 2004-01-26 Gentoo 200312-05 2003-12-12 Fedora FEDORA-2003-025 2003-12-10 Red Hat RHSA-2003:395-01 2003-12-10 Red Hat RHSA-2003:390-01 2003-12-10 Conectiva CLA-2003:798 2003-12-09 SuSE SuSE-SA:2003:048 2003-12-03 Mandrake MDKSA-2003:109 2003-11-28

Comments (3 posted)

gtkhtml: malformed messages cause crash

Package(s):	gtkhtml	CVE #(s):	CAN-2003-0133 CAN-2003-0541
Created:	April 14, 2003	Updated:	April 18, 2005
Description:	GtkHTML is the HTML rendering widget used by the Evolution mail reader. GtkHTML supplied with versions of Evolution prior to 1.2.4 contain a bug when handling HTML messages. Alan Cox discovered that certain malformed messages could cause the Evolution mail component to crash.
Alerts:	Debian DSA-710-1 2005-04-18 Mandrake MDKSA-2003:093 2003-09-18 Conectiva CLA-2003:737 2003-09-12 Red Hat RHSA-2003:264-01 2003-09-09 Mandrake MDKSA-2003:046 2003-04-15 Red Hat RHSA-2003:126-01 2003-04-14

Comments (none posted)

iproute: local denial of service

Package(s):	iproute net-tools	CVE #(s):	CAN-2003-0856
Created:	November 25, 2003	Updated:	December 14, 2004
Description:	The iproute utility is susceptible to spoofed netlink messages sent by local users, with the result that denial of service attacks are possible.
Alerts:	Mandrake MDKSA-2004:148 2004-12-13 Fedora FEDORA-2004-154 2004-06-03 Fedora FEDORA-2004-115 2004-05-11 Debian DSA-492-1 2004-04-18 Gentoo 200404-10 2004-04-09 Red Hat RHSA-2003:316-01 2003-11-24

Comments (none posted)

kdepim: VCF file information reader vulnerability

Package(s):	kdepim	CVE #(s):	CAN-2003-0988
Created:	January 15, 2004	Updated:	May 26, 2004
Description:	KDE has issued a security advisory for all versions of kdepim as distributed with KDE versions 3.1.0 through 3.1.4 inclusive. A carefully crafted .VCF file potentially enables local attackers to compromise the privacy of a victim's data or execute arbitrary commands with the victim's privileges. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0988 to this issue.
Alerts:	Fedora FEDORA-2004-133 2004-05-19 Gentoo 200404-02 2004-04-06 Whitebox WBSA-2004:005-01 2004-02-12 Conectiva CLA-2004:810 2004-01-20 Slackware SSA:2004-014-01 2004-01-14 Mandrake MDKSA-2004:003 2004-01-14 Red Hat RHSA-2004:006-01 2004-01-07

Comments (none posted)

kernel: privilege vulnerability on AMD64

Package(s):	kernel	CVE #(s):	CAN-2004-0001
Created:	January 16, 2004	Updated:	February 17, 2004
Description:	On AMD64 systems, a fix was made to the eflags checking in 32-bit ptrace emulation that could have allowed local users to elevate their privileges. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0001 to this issue.
Alerts:	Gentoo 200402-06 2004-02-17 Red Hat RHSA-2004:017-01 2004-01-13

Comments (none posted)

kernel: local root exploit in 2.4.22

Package(s):	kernel	CVE #(s):	CAN-2003-0961
Created:	December 1, 2003	Updated:	April 5, 2004
Description:	A vulnerability was discovered in the Linux kernel versions 2.4.22 and previous. A flaw in bounds checking in the do_brk() function can allow a local attacker to gain root privileges. This vulnerability is known to be exploitable. The 2.4.23 kernel contains the fix. For more details on how this vulnerability works, see this LWN article.
Alerts:	Debian DSA-475-1 2004-04-05 Debian DSA-470-1 2004-04-01 Debian DSA-442-1 2004-02-19 Debian DSA-433-1 2004-02-04 Debian DSA-423-1 2004-01-15 Red Hat RHSA-2003:368-01 2003-12-19 Conectiva CLA-2003:796 2003-12-05 Gentoo 200312-02 2003-12-04 SuSE SuSE-SA:2003:049 2003-12-04 Yellow Dog YDU-20031203-1 2003-12-03 Red Hat RHSA-2003:389-01 2003-12-01 Fedora FEDORA-2003-026 2003-12-02 Slackware SSA:2003-336-01 2003-12-01 Red Hat RHSA-2003:392-00 2003-12-01 Trustix 2003-0046 2003-12-01 Mandrake MDKSA-2003:110 2003-12-01 Debian DSA-403-1 2003-12-01

Comments (1 posted)

kernel-utils: setuid vulnerability

Package(s):	kernel-utils	CVE #(s):	CAN-2003-0019
Created:	February 7, 2003	Updated:	January 21, 2005
Description:	The kernel-utils package contains several utilities that can be used to control the kernel or machine hardware. In Red Hat Linux 8.0 this package contains user mode linux (UML) utilities. The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was incorrectly shipped setuid root. This could allow local users to control certain network interfaces, add and remove arp entries and routes, and put interfaces in and out of promiscuous mode. All users of the kernel-utils package should update to these packages that contain a version of uml_net that is not setuid root. Alternatively, as a work-around to this vulnerability issue the following command as root: chmod -s /usr/bin/uml_net
Alerts:	Red Hat RHSA-2003:056-08 2003-02-07

Comments (none posted)

lftp buffer overflows

Package(s):	lftp	CVE #(s):	CAN-2003-0963
Created:	December 15, 2003	Updated:	February 13, 2004
Description:	According to this advisory versions of lftp prior to 2.6.10 are vulnerable to two exploitable buffer overflow problems. Both occur when you connect to a web server with lftp using HTTP or HTTPS, and then use lftp's "ls" or "rels" commands on specially prepared directories on the web server.
Alerts:	Whitebox WBSA-2003:404-01 2003-12-17 Conectiva CLA-2004:800 2004-01-06 Debian DSA-406-1 2004-01-05 Gentoo 200312-07 2003-12-16 OpenPKG OpenPKG-SA-2003.053 2003-12-17 Red Hat RHSA-2003:404-01 2003-12-16 Red Hat RHSA-2003:403-01 2003-12-16 Mandrake MDKSA-2003:116 2003-12-15 Fedora FEDORA-2003-034 2003-12-15 SuSE SuSE-SA:2003:051 2003-12-15 Immunix IMNX-2003-73-002-01 2003-12-09 Slackware SSA:2003-346-01 2003-12-12

Comments (none posted)

libpng, libpng3: buffer overflow

Package(s):	libpng, libpng3	CVE #(s):	CAN-2002-1363
Created:	December 19, 2002	Updated:	July 14, 2004
Description:	Glenn Randers-Pehrson discovered a problem in connection with 16-bit samples from libpng, an interface for reading and writing PNG (Portable Network Graphics) format files. The starting offsets for the loops are calculated incorrectly which causes a buffer overrun beyond the beginning of the row buffer.
Alerts:	Gentoo 200407-06 2004-07-08 OpenPKG OpenPKG-SA-2004.030 2004-07-06 Mandrake MDKSA-2004:063 2004-06-29 Whitebox WBSA-2004:249-01 2004-06-21 Fedora FEDORA-2004-176 2004-06-18 Fedora FEDORA-2004-174 2004-06-18 Fedora FEDORA-2004-175 2004-06-18 Fedora FEDORA-2004-173 2004-06-18 Red Hat RHSA-2004:249-01 2004-06-18 Conectiva CLA-2003:564 2003-01-23 Mandrake MDKSA-2003:008 2003-01-20 OpenPKG OpenPKG-SA-2003.001 2003-01-15 Yellow Dog YDU-20030114-2 2002-01-14 SuSE SuSE-SA:2003:0004 2003-01-14 Red Hat RHSA-2003:006-06 2003-01-09 Debian DSA-213-1 2002-12-19

Comments (none posted)

libtool - Insecure handling of temporary files

Package(s):	libtool	CVE #(s):
Created:	February 5, 2004	Updated:	March 8, 2004
Description:	GNU libtool consists of a set of shell scripts used to build shared libraries. Joseph S. Myers and Stefan Nordhausen independently found a vulnerability in the way the ltmain.sh script (which is part of the libtool package) creates temporary directories for its use. A local attacker could exploit this vulnerability to change/delete arbitrary files in the system on behalf of the user who is calling the script. The vulnerability has been fixed in the 1.5.2 version of libtool.
Alerts:	OpenPKG OpenPKG-SA-2004.004 2004-03-08 Conectiva CLA-2004:811 2004-02-05

Comments (none posted)

mailman: cross-site scripting vulnerabilities

Package(s):	mailman	CVE #(s):	CAN-2003-0965 CAN-2003-0992
Created:	February 6, 2004	Updated:	March 5, 2004
Description:	Dirk Mueller discovered a cross-site scripting bug in the admin interface in versions of Mailman 2.1 before 2.1.4. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0965 to this issue. A cross-site scripting bug in the 'create' CGI script affects versions of Mailman 2.1 before 2.1.3. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0992 to this issue.
Alerts:	Fedora FEDORA-2004-060 2004-03-04 Debian DSA-436-2 2004-02-21 Debian DSA-436-1 2004-02-08 Red Hat RHSA-2004:020-01 2004-02-05

Comments (none posted)

mailman denial of service

Package(s):	mailman	CVE #(s):	CAN-2003-0991
Created:	February 9, 2004	Updated:	May 25, 2004
Description:	Matthew Galgoci of Red Hat discovered a Denial of Service (DoS) vulnerability in versions of Mailman prior to 2.1. An attacker could send a carefully-crafted message causing mailman to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0991 to this issue.
Alerts:	Conectiva CLA-2004:842 2004-05-25 Red Hat RHSA-2004:156-01 2004-04-14 Mandrake MDKSA-2004:013 2004-02-13 Red Hat RHSA-2004:019-01 2004-02-09

Comments (1 posted)

mc: arbitrary code execution

Package(s):	mc	CVE #(s):	CAN-2003-1023
Created:	January 16, 2004	Updated:	April 5, 2004
Description:	A vulnerability was discovered in Midnight Commander, a file manager, whereby a malicious archive (such as a .tar file) could cause arbitrary code to be executed if opened by Midnight Commander.
Alerts:	OpenPKG OpenPKG-SA-2004.009 2004-04-05 Gentoo 200403-09 2004-03-29 Conectiva CLA-2004:833 2004-03-31 SCO Group CSSA-2004-014.0 2004-03-25 Whitebox WBSA-2004:035-01 2004-02-12 Fedora FEDORA-2004-058 2004-02-09 Red Hat RHSA-2004:035-01 2004-01-19 Mandrake MDKSA-2004:007 2004-01-26 Red Hat RHSA-2004:034-01 2004-01-19 Debian DSA-424-1 2004-01-16

Comments (none posted)

mikmod: buffer overflow

Package(s):	mikmod	CVE #(s):	CAN-2003-0427
Created:	June 16, 2003	Updated:	June 16, 2005
Description:	Ingo Saitz discovered a bug in mikmod whereby a long filename inside an archive file can overflow a buffer when the archive is being read by mikmod.
Alerts:	Fedora FEDORA-2005-405 2005-06-16 Red Hat RHSA-2005:506-01 2005-06-13 Fedora FEDORA-2005-404 2005-06-09 Gentoo 200307-01 2003-07-02 Debian DSA-320-1 2003-06-13

Comments (none posted)

mod_python: denial of service vulnerability

Package(s):	mod_python	CVE #(s):	CAN-2003-0973
Created:	January 27, 2004	Updated:	October 4, 2004
Description:	Apache's mod_python module could crash the httpd process if a specific, malformed query string was sent. The Apache Foundation has reported that mod_python may be prone to Denial of Service attacks when handling a malformed query. Mod_python 2.7.9 was released to fix the vulnerability, however, because the vulnerability has not been fully fixed, version 2.7.10 has been released. Users of mod_python 3.0.4 are not affected by this vulnerability.
Alerts:	Fedora-Legacy FLSA:1325 2004-10-03 Conectiva CLA-2004:837 2004-04-12 Whitebox WBSA-2004:058-01 2004-03-01 Debian DSA-452-1 2004-02-29 Red Hat RHSA-2004:058-01 2004-02-26 Red Hat RHSA-2004:063-01 2004-02-26 Gentoo 200401-03 2004-01-27

Comments (none posted)

monkeyd: denial of service

Package(s):	monkeyd	CVE #(s):
Created:	February 12, 2004	Updated:	February 12, 2004
Description:	The monkeyd HTTP server suffers from a parsing bug which can be exploited to crash the server process. Upgrading to version 0.8.2 fixes the problem.
Alerts:	Gentoo 200402-03 2004-02-11

Comments (none posted)

mpg123: heap overflow

Package(s):	mpg123	CVE #(s):	CAN-2003-0865
Created:	November 12, 2003	Updated:	February 19, 2004
Description:	Versions of mpg123 through 0.59s contain a heap overflow which may be exploited remotely (by a hostile server). See this advisory for details.
Alerts:	SCO Group CSSA-2004-002.0 2004-02-19 Debian DSA-435-1 2004-02-06 Conectiva CLA-2003:781 2003-11-12

Comments (none posted)

mpg321: format string vulnerability

Package(s):	mpg321	CVE #(s):	CAN-2003-0969
Created:	January 6, 2004	Updated:	March 28, 2005
Description:	A vulnerability was discovered in mpg321, a command-line mp3 player, whereby user-supplied strings were passed to printf(3) unsafely. This vulnerability could be exploited by a remote attacker to overwrite memory, and possibly execute arbitrary code. In order for this vulnerability to be exploited, mpg321 would need to play a malicious mp3 file (including via HTTP streaming).
Alerts:	Gentoo 200503-34 2005-03-28 Debian DSA-411-1 2004-01-05

Comments (none posted)

mplayer: remotely exploitable buffer overflow vulnerability

Package(s):	mplayer	CVE #(s):	CAN-2003-0835
Created:	September 29, 2003	Updated:	April 6, 2004
Description:	A remotely exploitable buffer overflow vulnerability was found in MPlayer. A malicious host can craft a harmful ASX header, and trick MPlayer into executing arbitrary code upon parsing that header. Read the full advisory for details.
Alerts:	Mandrake MDKSA-2004:026 2004-04-05 Gentoo 200403-13 2004-03-31 Conectiva CLA-2003:760 2003-10-06 Mandrake MDKSA-2003:097 2003-09-30 Gentoo 200309-15 2003-09-27

Comments (none posted)

mutt: buffer overflow

Package(s):	mutt	CVE #(s):	CAN-2004-0078
Created:	February 12, 2004	Updated:	March 26, 2004
Description:	mutt suffers from a buffer overflow in its "index menu" code. This overflow can be exploited via a hostile message to crash mutt and, perhaps, execute arbitrary code. Version 1.4.2 fixes the problem; see this advisory for details.
Alerts:	SCO Group CSSA-2004-013.0 2004-03-25 OpenPKG OpenPKG-SA-2004.005 2004-03-09 Netwosix NW-2004-0001 2004-02-16 Trustix 2004-0006 2004-02-13 Whitebox WBSA-2004:050-01 2004-02-12 Mandrake MDKSA-2004:010 2004-02-11 Slackware SSA:2004-043-01 2004-02-12 Red Hat RHSA-2004:051-01 2004-02-11 Red Hat RHSA-2004:050-01 2004-02-11 Fedora FEDORA-2004-061 2004-02-11

Comments (none posted)

Nessus NASL scripting engine security issues

Package(s):	nessus	CVE #(s):
Created:	May 27, 2003	Updated:	August 12, 2004
Description:	Some some vulnerabilities exsist in the Nessus NASL scripting engine. To exploit these flaws, an attacker would need to have a valid Nessus account as well as the ability to upload arbitrary Nessus plugins in the Nessus server (this option is disabled by default) or he/she would need to trick a user somehow into running a specially crafted nasl script. Read the full advisory for additional information.
Alerts:	Gentoo 200305-10 2003-05-27

Comments (none posted)

netpbm: insecure temporary files

Package(s):	netpbm	CVE #(s):	CAN-2003-0924
Created:	January 19, 2004	Updated:	December 29, 2004
Description:	netpbm is graphics conversion toolkit made up of a large number of single-purpose programs. Many of these programs were found to create temporary files in an insecure manner, which could allow a local attacker to overwrite files with the privileges of the user invoking a vulnerable netpbm tool.
Alerts:	Conectiva CLA-2004:909 2004-12-29 Gentoo 200410-02 2004-10-04 Mandrake MDKSA-2004:011-1 2004-09-27 Whitebox WBSA-2004:031-01 2004-02-12 Mandrake MDKSA-2004:011 2004-02-11 Red Hat RHSA-2004:030-01 2004-02-05 Fedora FEDORA-2004-068 2004-02-06 Red Hat RHSA-2004:031-01 2004-01-22 Debian DSA-426-1 2004-01-18

Comments (1 posted)

Net-SNMP: security bugs in versions before 5.0.9

Package(s):	Net-SNMP	CVE #(s):	CAN-2003-0935
Created:	December 2, 2003	Updated:	February 13, 2004
Description:	The Net-SNMP project includes various Simple Network Management Protocol (SNMP) tools. A security issue in Net-SNMP versions before 5.0.9 could allow an existing user/community to gain access to data in MIB objects that were explicitly excluded from their view. Version 5.0.9 of Net-SNMP is not vulnerable to this issue. In addition, Net-SNMP 5.0.9 fixes a number of other minor bugs.
Alerts:	Whitebox WBSA-2004:023-01 2004-02-12 Red Hat RHSA-2004:023-01 2004-01-15 Mandrake MDKSA-2003:115 2003-12-11 Red Hat RHSA-2003:335-01 2003-12-02

Comments (none posted)

nfs-utils xlog() off-by-one bug

Package(s):	nfs-utils	CVE #(s):	CAN-2003-0252
Created:	July 14, 2003	Updated:	March 8, 2004
Description:	Linux NFS utils package contains remotely exploitable off-by-one bug. A local or remote attacker could exploit this vulnerability by sending specially crafted request to rpc.mountd daemon. See this BugTraq post for more details.
Alerts:	Trustix TSLSA-2004-0009 2004-03-05 SCO Group CSSA-2003-037.0 2003-11-17 Conectiva CLA-2003:700 2003-07-22 Mandrake MDKSA-2003:076 2003-07-21 Gentoo 200307-07 2003-07-19 Yellow Dog YDU-20030718-1 2003-07-18 Slackware SSA:2003-195-01b 2003-07-15 Immunix IMNX-2003-7+-018-01 2003-07-14 SuSE SuSE-SA:2003:031 2003-07-15 Slackware SSA:2003-195-01 2003-07-14 Debian DSA-349-1 2003-07-14 Red Hat RHSA-2003:206-01 2003-07-14

Comments (none posted)

openssh: timing attack leads to information disclosure

Package(s):	openssh	CVE #(s):	CAN-2003-0190
Created:	May 2, 2003	Updated:	November 30, 2004
Description:	From the advisory: "During a pen-test we stumbled across a nasty bug in OpenSSH-portable with PAM support enabled (via the --with-pam configure script switch). This bug allows a remote attacker to identify valid users on vulnerable systems, through a simple timing attack. The vulnerability is easy to exploit and may have high severity, if combined with poor password policies and other security problems that allow local privilege escalation."
Alerts:	Ubuntu USN-34-1 2004-11-30 OpenPKG OpenPKG-SA-2003.035 2003-08-06 Red Hat RHSA-2003:222-01 2003-07-29 Gentoo 200305-02 2003-05-13 Gentoo 200305-01 2002-03-05

Comments (1 posted)

perl information leak

Package(s):	perl	CVE #(s):	CAN-2003-0618
Created:	February 2, 2004	Updated:	April 21, 2004
Description:	Paul Szabo discovered a number of bugs in suidperl, a helper program to run perl scripts with setuid privileges. By exploiting these bugs, an attacker could abuse suidperl to discover information about files (such as testing for their existence and some of their permissions) that should not be accessible to unprivileged users.
Alerts:	Debian DSA-431-2 2004-04-16 Debian DSA-431-1 2004-02-01

Comments (none posted)

PHP setting leaks from .htaccess files on virtual hosts

Package(s):	php	CVE #(s):
Created:	February 9, 2004	Updated:	February 12, 2004
Description:	If the server configuration "php.ini" file has "register_globals = on" and a request is made to one virtual host (which has "php_admin_flag register_globals off") and the next request is sent to the another virtual host (which does not have the setting) through the same Apache child, the setting will persist. Depending on the server and site, an attacker may be able to exploit global variables to gain access to reserved areas, such as MySQL passwords, or this vulnerability may simply cause a lack of functionality. As a result, users are urged to upgrade their PHP installations.
Alerts:	Gentoo 200402-01 2004-02-07

Comments (none posted)

postfix: denial of service vulnerabilities

Package(s):	postfix	CVE #(s):	CAN-2003-0468 CAN-2003-0540
Created:	August 5, 2003	Updated:	May 27, 2004
Description:	The postfix MTA, versions through 1.1.12 (but not 2.0) is subject to two remotely exploitable denial of service vulnerabilities; see this advisory from Michal Zalewski for details.
Alerts:	Mandrake MDKA-2004:028 2004-05-26 Trustix 2003-0029 2003-08-04 Mandrake MDKSA-2003:081 2003-08-04 EnGarde ESA-20030804-019 2003-08-04 Conectiva CLA-2003:717 2003-08-04 SuSE SuSE-SA:2003:033 2003-08-04 Red Hat RHSA-2003:251-01 2003-08-04 Debian DSA-363-1 2003-08-03

Comments (none posted)

rsync - remotely exploitable heap overflow

Package(s):	rsync	CVE #(s):	CAN-2003-0962
Created:	December 4, 2003	Updated:	March 3, 2004
Description:	An advisory has gone out warning of a remotely exploitable heap overflow vulnerability in rsync versions 2.5.6 and prior. If you are running an rsync server, you will want to apply a distributor patch or upgrade to 2.5.7 in the near future.
Alerts:	SCO Group CSSA-2004-010.0 2004-03-02 Immunix IMNX-2003-73-001-01 2003-12-05 Mandrake MDKSA-2003:111 2003-12-04 Red Hat RHSA-2003:399-01 2003-12-04 Red Hat RHSA-2003:398-01 2003-12-04 Fedora FEDORA-2003-030 2003-12-04 Conectiva CLA-2003:794 2003-12-04 Gentoo 200312-03 2003-12-04 EnGarde ESA-20031204-032 2003-12-04 Debian DSA-404-1 2003-12-04 OpenPKG OpenPKG-SA-2003.051 2003-12-04 SuSE SuSE-SA:2003:050 2003-12-04 Trustix 2003-0048 2003-12-04 Slackware SSA:2003-337-01 2003-12-03

Comments (none posted)

Multiple-use vulnerability in Safe.pm

Package(s):	Safe.pm	CVE #(s):	CAN-2002-1323
Created:	October 9, 2002	Updated:	February 20, 2004
Description:	usePerl has a description of a vulnerability in the Safe.pm Perl module. It seems that if a Safe compartment is used more than once, it ceases to be safe. The problem is fixed in Safe 2.08.
Alerts:	SCO Group CSSA-2004-007.0 2004-02-20 Gentoo 200212-6 2002-12-20 Trustix 2002-0087 2002-12-19 OpenPKG OpenPKG-SA-2002.014 2002-12-16 Debian DSA-208-1 2002-12-12

Comments (none posted)

sane-backends: several vulnerabilities

Package(s):	sane-backends	CVE #(s):	CAN-2003-0773 CAN-2003-0774 CAN-2003-0775 CAN-2003-0776 CAN-2003-0777 CAN-2003-0778
Created:	September 11, 2003	Updated:	February 20, 2004
Description:	Alexander Hvostov, Julien Blache and Aurelien Jarno discovered several security-related problems in the sane-backends package, which contains an API library for scanners including a scanning daemon (in the package libsane) that can be remotely exploited. These problems allow a remote attacker to cause a segfault fault and/or consume arbitrary amounts of memory. The attack is successful, even if the attacker's computer isn't listed in saned.conf. You are only vulnerable if you actually run saned e.g. in xinetd or inetd. If the entries in the configuration file of xinetd or inetd respectively are commented out or do not exist, you are safe. Try "telnet localhost 6566" on the server that may run saned. If you get "connection refused" saned is not running and you are safe. The Common Vulnerabilities and Exposures project identifies the following problems: CAN-2003-0773: saned checks the identity (IP address) of the remote host only after the first communication took place (SANE_NET_INIT). So everyone can send that RPC, even if the remote host is not allowed to scan (not listed in saned.conf). CAN-2003-0774: saned lacks error checking nearly everywhere in the code. So connection drops are detected very late. If the drop of the connection isn't detected, the access to the internal wire buffer leaves the limits of the allocated memory. So random memory "after" the wire buffer is read which will be followed by a segmentation fault. CAN-2003-0775: If saned expects strings, it mallocs the memory necessary to store the complete string after it receives the size of the string. If the connection was dropped before transmitting the size, malloc will reserve an arbitrary size of memory. Depending on that size and the amount of memory available either malloc fails (->saned quits nicely) or a huge amount of memory is allocated. Swapping and OOM measures may occur depending on the kernel. CAN-2003-0776: saned doesn't check the validity of the RPC numbers it gets before getting the parameters. CAN-2003-0777: If debug messages are enabled and a connection is dropped, non-null-terminated strings may be printed and segmentation faults may occur. CAN-2003-0778: It's possible to allocate an arbitrary amount of memory on the server running saned even if the connection isn't dropped. At the moment this can not easily be fixed according to the author. Better limit the total amount of memory saned may use (ulimit).
Alerts:	SCO Group CSSA-2004-005.0 2004-02-19 SuSE SuSE-SA:2003:046 2003-11-18 Conectiva CLA-2003:769 2003-10-22 Mandrake MDKSA-2003:099 2003-10-09 Red Hat RHSA-2003:278-01 2003-10-07 Debian DSA-379-1 2003-09-11

Comments (none posted)

screen: privilege escalation

Package(s):	screen	CVE #(s):	CAN-2003-0972
Created:	November 28, 2003	Updated:	March 3, 2004
Description:	According to this advisory a buffer overflow in GNU screen allows privilege escalation for local users. Usually screen is installed either setgid-utmp or setuid-root. It also has some potential for remote attacks or getting control of another user's screen. The problem is that you have to transfer around 2-3 gigabytes of data to user's screen to exploit this vulnerability. 4.0.1, 3.9.15 and older versions are vulnerable.
Alerts:	SCO Group CSSA-2004-011.0 2004-03-02 Fedora-Legacy FLSA:1187 2004-01-26 Conectiva CLA-2004:809 2004-01-20 Debian DSA-408-1 2004-01-05 Mandrake MDKSA-2003:113 2003-12-08 OpenPKG OpenPKG-SA-2003.050 2003-11-28

Comments (none posted)

slocate: buffer overflow

Package(s):	slocate	CVE #(s):	CAN-2003-0848
Created:	January 20, 2004	Updated:	February 16, 2004
Description:	A vulnerability was discovered in slocate, a program to index and search for files, whereby a specially crafted database could overflow a heap-based buffer. This vulnerability could be exploited by a local attacker to gain the privileges of the "slocate" group, which can access the global database containing a list of pathnames of all files on the system, including those which should only be visible to privileged users. This problem, and a category of potential similar problems, can be fixed by modifying slocate to drop privileges before reading a user-supplied database.
Alerts:	Fedora-Legacy FLSA:1232 2004-02-11 Whitebox WBSA-2004:041-01 2004-02-12 SCO Group CSSA-2004-001.0 2004-02-10 Fedora FEDORA-2004-059 2004-01-26 Red Hat RHSA-2004:041-01 2004-01-22 Mandrake MDKSA-2004:004 2004-01-23 Trustix 2004-0005 2004-01-21 Debian DSA-428-1 2004-01-20

Comments (none posted)

File overwrite vulnerability in tar and unzip

Package(s):	tar unzip	CVE #(s):	CAN-2001-1267 CAN-2001-1268 CAN-2001-1269 CAN-2002-0399
Created:	October 1, 2002	Updated:	April 10, 2006
Description:	The tar utility does not properly filter file names containing "../", meaning that a hostile archive can, if unpacked by an unsuspecting user, overwrite any file that is writable by that user. GNU tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42 has the same vulnerability.
Alerts:	Fedora-Legacy FLSA:183571-1 2006-04-04 Red Hat RHSA-2006:0195-01 2006-02-21 Conectiva CLA-2002:538 2002-10-29 Mandrake MDKSA-2002:066 2002-10-10 Mandrake MDKSA-2002:065 2002-10-10 EnGarde ESA-20021003-022 2002-10-03 Gentoo unzip-20021001 2002-10-01 Gentoo tar-20021001 2002-10-01 Red Hat RHSA-2002:096-24 2002-09-18

Comments (1 posted)

tcpdump: flaws in the ISAKMP decoding routines

Package(s):	tcpdump	CVE #(s):	CAN-2003-0989 CAN-2004-0057 CAN-2004-0055
Created:	January 15, 2004	Updated:	April 6, 2004
Description:	George Bakos discovered flaws in the ISAKMP decoding routines of tcpdump versions prior to 3.8.1. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0989 to this issue. Jonathan Heusser discovered two additional flaws in the ISAKMP decoding routines of tcpdump versions up to and including 3.8.1. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0057 to this issue. Jonathan Heusser discovered a flaw in the print_attr_string function in the RADIUS decoding routines for tcpdump 3.8.1 and earlier. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0055 to this issue. Remote attackers could potentially exploit these issues by sending carefully-crafted packets to a victim. If the victim uses tcpdump, these packets could result in a denial of service, or possibly execute arbitrary code as the 'pcap' user.
Alerts:	Gentoo 200404-03 2004-03-31 Fedora FEDORA-2004-091 2004-03-04 SCO Group CSSA-2004-008.0 2004-03-02 Fedora FEDORA-2004-092 2004-03-02 Whitebox WBSA-2004:008-01 2004-02-12 Fedora-Legacy FLSA:1222 2004-01-31 Mandrake MDKSA-2004:008 2004-01-26 EnGarde ESA-20040119-002 2004-01-19 Debian DSA-425-1 2004-01-16 OpenPKG OpenPKG-SA-2004.002 2004-01-16 Trustix 2004-0004 2004-01-05 SuSE SuSE-SA:2004:002 2004-01-14 Red Hat RHSA-2004:008-01 2004-01-15 Red Hat RHSA-2004:007-01 2004-01-14

Comments (none posted)

Multiple vendor telnetd vulnerability

Package(s):	telnet Telnet netkit-telnet-ssl kerberos telnetd netkit-telnet nkitb/nkitserv/telnetd krb5	CVE #(s):
Created:	May 21, 2002	Updated:	October 5, 2004
Description:	This vulnerability, originally thought to be confined to BSD-derived systems, was first covered in the July 26th Security Summary. It is now known that Linux telnet daemons are vulnerable as well.
Alerts:	Gentoo 200410-03 2004-10-05 Yellow Dog YDU-20010810-2 2001-08-10 Yellow Dog YDU-20010810-1 2001-08-10 SuSE SuSE-SA:2001:029 2001-09-03 Slackware sl-997726350 2001-08-09 Red Hat RHSA-2001:100-02 2001-08-09 Red Hat RHSA-2001:099-09 2002-02-07 Red Hat RHSA-2001:099-06 2001-08-09 Progeny PROGENY-SA-2001-27 2001-08-14 Mandrake MDKSA-2001:093 2001-12-17 Mandrake MDKSA-2001:068 2001-08-13 HP HPSBTL0202-023 2002-02-12 Debian DSA-075-2 2001-08-14 Debian DSA-075-1 2001-08-14 Conectiva CLA-2001:413 2001-08-24 SCO Group CSSA-2001-030.0 2001-08-10

Comments (none posted)

util-linux: information leak in the login program

Package(s):	util-linux	CVE #(s):	CAN-2004-0080
Created:	February 3, 2004	Updated:	April 8, 2004
Description:	The util-linux package contains a large variety of low-level system utilities that are necessary for a Linux system to function. In some situations, the login program could use a pointer that had been freed and reallocated. This could cause unintentional data leakage.
Alerts:	Netwosix NW-2004-0010 2004-04-08 Gentoo 200404-06 2004-04-07 Fedora-Legacy FLSA:1256 2004-03-04 Whitebox WBSA-2004:056-01 2004-02-12 Red Hat RHSA-2004:056-01 2004-02-02

Comments (1 posted)

XFree86: buffer overflow

Package(s):	XFree86	CVE #(s):	CAN-2004-0083 CAN-2004-0084 CAN-2004-0106
Created:	February 12, 2004	Updated:	February 23, 2004
Description:	The XFree86 code which reads "fonts.alias" files suffers from a buffer overflow which may be turned into a local root exploit; see this advisory for details.
Alerts:	SuSE SuSE-SA:2004:006 2004-02-23 Debian DSA-443-1 2004-02-19 Conectiva CLA-2004:821 2004-02-20 Whitebox WBSA-2004:061-01 2004-02-17 Red Hat RHSA-2004:061-01 2004-02-13 Fedora FEDORA-2004-069 2004-02-13 Mandrake MDKSA-2004:012 2004-02-14 Red Hat RHSA-2004:060-01 2004-02-13 Red Hat RHSA-2004:059-01 2004-02-13 Immunix IMNX-2004-73-002-01 2004-02-12 Slackware SSA:2004-043-02 2004-02-12 Gentoo 200402-02 2004-02-11

Comments (none posted)

Resources

February CRYPTO-GRAM newsletter

Bruce Schneier's CRYPTO-GRAM newsletter for February is out; this issue looks at security policies, ID requirements, spam solutions, and the MyDoom worm. "I don't think the solution is to educate users. This is a case where overall security is determined by the stupidest user. If 1,000 people in your corporate network know enough not to click on the attachment and only one does not, you're still infected."

Full Story (comments: 13)

Page editor: Jonathan Corbet

Kernel development

Brief items

Kernel release status

The current 2.6 kernel is 2.6.3, which was released on February 17. Only a handful of patches have gone in since the last release candidate. Overall, 2.6.3 includes a great deal of internal cleanup work, the removal of the USB scanner driver (in favor of the user-space libusb solution), the new generic DMA pool mechanism, "context mount" support for SELinux, a big ALSA update, a fix for the new mremap() vulnerability, and quite a few architecture updates. See the long-format changelog for the details.

During the last week, we also saw 2.6.3-rc3 (changelog) and 2.6.3-rc4 (changelog).

The current kernel tree from Andrew Morton is 2.6.3-mm1. Recent additions to the -mm tree include some more scheduler improvements, a new CPU hotplug implementation, journaled quotas for the ext3 filesystem, and numerous fixes.

2.6.3-mm1 also contains the new device mapper crypto target code. This target allows the creation of encrypted filesystems by way of the device mapper (LVM) subsystem. If things work out, this approach is likely to replace the (buggy) cryptoloop driver; if you have an interest in encrypted filesystems, testing out this patch might be a good idea.

The current 2.4 kernel is 2.4.25, released by Marcelo on February 18. Among other things, this release includes the mremap() vulnerability fix. Marcelo has had a busy week, having previously released 2.4.25-rc2, -rc3, and -rc4.

Comments (4 posted)

Kernel development news

Quote of the week

-- Linus Torvalds

Comments (2 posted)

The kernel and character set encodings

It all started as a JFS bug report. The JFS filesystem, it seems, gets upset when user space passes it file names encoded in the UTF-8 format. Rather than create or open a file with the name as given, it gives up and returns EINVAL. Patches which fix the problem have been posted, but the resulting discussion has taken rather longer to be resolved.

JFS has an "iocharset" option which can be used to state explicitly, at mount time, which character encoding is being used. There were calls on linux-kernel for this option to be added to other filesystems as well. The idea was rather strongly shot down, however, for a few reasons. One of those is that multiple users could be simultaneously using different character encodings on the same filesystem; a global option for the whole filesystem clearly will not be able to address that case.

The real reason, however, is that performing character set conversion requires the kernel to interpret the file name strings being passed to it from user space. The kernel hackers are very resistant to the imposition of any such policy; it would go against decades of Unix tradition. Officially, the kernel has no policy regarding which character set is being used for file names, content, or anything else. In each case, the kernel sees nothing more than a stream of bytes.

That said, the kernel does have some policies regarding file names: they use "/" as a directory delimiter, and they are terminated by a NULL byte. This policy rules out the use of many encodings which are sometimes employed to represent non-ASCII characters; the fixed-width wide encodings all tend to use lots of bytes containing zero. In reality, the only practical choices for representing characters beyond the ASCII set are iso-8859-1 (which allows the representation of characters used in many continental European languages) and UTF-8, which can encode pretty much anything.

UTF-8 is relatively easy to use; for US users it looks just like ASCII, but it can handle a far wider range of characters while not breaking (most) code which uses traditional C strings. Thus it is often said that UTF-8 is the encoding used by the Linux kernel. That statement is a mistake, however: Linux does not use any particular encoding. If user space uses UTF-8 to represent extended characters, everything will work. But nothing forces user space to work in that way.

This approach keeps policy out of the kernel, but some developers are not entirely happy with it. The lack of policy can lead to user-space confusion in a number of ways. For example, if a user creates a file called WéîrdÑàmë, that name could be represented in the filesystem in more than one way. Depending on how user space is configured, it could choose either iso-8859-1 or UTF-8; the encoding of that name will be quite different depending on that choice. A different user space could interpret the file name differently in the future, resulting in unreadable filenames and confused users. The kernel, lacking a character encoding policy of its own, will do nothing to help prevent this situation.

Confusion over character sets can also facilitate the creation of security holes; code which attempts to clean up file names can fail if evil characters are given in an unexpected encoding. Code which expects UTF-8 must also be careful when dealing with the Linux kernel because the kernel itself makes no effort to ensure that any string is, in fact, a legal UTF-8 encoding.

To complicate the situation even more, Andrew Tridgell posted another reason why, he thinks, the kernel will have to adopt a specific character encoding: case insensitivity. Says Tridge:

Needless to say, the idea of implementing case-insensitive filesystem operations in the kernel was not particularly popular. Not too many kernel hackers want to complicate the filesystem code to implement what they see as being a broken Windows feature to begin with. There are other difficulties as well: case-insensitive matching must be done differently in different languages. The end result is that case insensitive lookups are not very likely to make it into the kernel anytime soon.

Linus is not averse to trying to help out Samba and other applications which wish to implement case-insensitive behavior, however. He has proposed a new "magic_open()" interface which would make it easier for user space to perform case-insensitive lookups without actually doing that work in the kernel. This interface would likely require quite a bit of work before it would do what the Samba developers need, but something derived from it could just make an appearance in the 2.7 development series.

Meanwhile, the kernel does not seem likely to adopt any sort of official encoding anytime soon. The problems that result from the lack of an encoding policy are mostly seen as user space issues. Proper locale support is still relatively new in Linux, and many rough edges remain. Given the high level of interest in high-quality localization support in Linux, however, one might expect those edges to be smoothed down quickly.

(For those who would like to learn more about UTF-8, see this FAQ or RFC 3629).

Comments (23 posted)

invalidate_page_range() for non-GPL modules

The kernel function invalidate_page_range() is not something which has a lot of callers. Its job is to invalidate all memory mappings which cover a specific part of a file, presumably because the contents of the relevant pages have changed on disk. This function is currently exported only to GPL-licensed modules.

Paul McKenney has requested that this function be exported to all modules. It seems that IBM's GPFS filesystem needs it, and that filesystem is not free software. The claim is that the filesystem is an entirely independent development, and is thus not derived from the kernel; it should not have to be licensed under the GPL to be loadable into the kernel.

Andrew Morton says he is not opposed to the patch. One might think it would not be too controversial, especially since that function was first created and submitted by...Paul McKenney. There are developers, however, who believe that any module which is digging that deeply into the virtual memory subsystem cannot help but be derived, in some fashion, from the Linux kernel. There is also, perhaps, a certain desire to demonstrate that even IBM can't obtain arbitrary access to the kernel for proprietary modules.

In general, the kernel hackers are more interested in seeing their work be useful and used, instead of fighting over licensing battles. So one might expect to see this patch eventually get incorporated. In more recent times, however, some developers have been adopting a firmer position with regard to proprietary modules. This patch may still get in, but it's likely to have a harder time than would have once been the case.

Comments (2 posted)

No more 24-bit atomic_t

The atomic_t type in the Linux kernel is a simple integer variable with a set of operations which are guaranteed to be atomic without the need for explicit locking. For years, atomic_t variables have operated under the constraint that they can be expected to hold no more than 24 bits; this limitation was forced by the Sparc32 architecture, which used the other eight bits to implement the atomic operations.

As of 2.6.3, this limitation no longer holds. This patch by Keith M Wesolowski has changed the Sparc32 implementation to a version (taken from the PA-RISC architecture) which provides full 32-bit atomic variables.

The new implementation works by creating a small array (four entries) of spinlocks. When an operation is to be performed on an atomic variable, one of those spinlocks is chosen by a hash function; the code holds the given lock while manipulating the variable. The result is proper locking for atomic operations without doubling the size of every atomic_t in the system. The patch was quickly picked up and merged, and kernel programmers have one less strange limitation to worry about.

Comments (3 posted)

Patches and updates

Kernel trees

• Linus Torvalds: Linux 2.6.3. (February 18, 2004)

• Andrew Morton: 2.6.3-mm1. (February 18, 2004)

• Con Kolivas: 2.6.3-ck1. (February 18, 2004)

• Linus Torvalds: Linux 2.6.3-rc4. (February 17, 2004)

• Linus Torvalds: Linux 2.6.3-rc3. (February 15, 2004)

• Andrew Morton: 2.6.3-rc3-mm1. (February 16, 2004)

• Andrew Morton: 2.6.3-rc2-mm1. (February 12, 2004)

• Martin J. Bligh: 2.6.2-mjb1. (February 12, 2004)

• Marcelo Tosatti: linux-2.4.25 released. (February 18, 2004)

• Bernhard Rosenkraenzer: 2.4.25-pac1. (February 18, 2004)

• Marcelo Tosatti: Linux 2.4.25-rc4. (February 18, 2004)

• Marcelo Tosatti: Linux 2.4.25-rc3. (February 16, 2004)

• Marcelo Tosatti: Linux 2.4.25-rc2. (February 12, 2004)

Development tools

• Con Kolivas: kernbench-0.20. (February 13, 2004)

• dan carpenter: Strace Test. (February 16, 2004)

• Keith Owens: Announce: kdb v4.3 is available for kernel 2.6.3-rc3. (February 17, 2004)

• Keith Owens: Announce: kdb v4.3 is available for kernel 2.6.3-rc4. (February 17, 2004)

• Keith Owens: Announce: kdb v4.3 is available for kernel 2.6.3. (February 18, 2004)

• Pavel Machek: kgdb-lite for 2.6.2. (February 17, 2004)

• Pavel Machek: kgdb-lite for 2.6.2 (i386 specific parts). (February 17, 2004)

Device drivers

• H. Peter Anvin: Updated dynamic pty patch available. (February 12, 2004)

• Jeff Garzik: 2.6.x libata update. (February 14, 2004)

• Jean Tourrilhes: new driver : stir4200. (February 14, 2004)

• Len Brown: ACPI for 2.6. (February 14, 2004)

• Matthew Wilcox: Expanded PCI config space (against 2.6.3-rc4). (February 18, 2004)

Documentation

• Michael Frank: PATCH, RFC: Version 3 of 2.6 Codingstyle. (February 14, 2004)

• Michael Frank: PATCH, RFC: Version 4 of 2.6 Codingstyle. (February 15, 2004)

• Michael Frank: PATCH, RFC: Version 5 of 2.6 Codingstyle. (February 16, 2004)

Filesystems and block I/O

• Jan Kara: Journalled quota (fwd). (February 12, 2004)

• Miklos Szeredi: [PATCH] allowing user mounts. (February 17, 2004)

• Christophe Saout: dm-crypt using kthread. (February 17, 2004)

• Niraj Kumar: [2.6] UFS2 Read Only Patch. (February 18, 2004)

• Karim Yaghmour: relayfs patch for 2.6.3. (February 18, 2004)

Janitorial

• Randy.Dunlap: sys_device_[un]register() are not syscalls. (February 13, 2004)

• Randy.Dunlap: syscalls.h update #9 (open/close). (February 14, 2004)

• Randy.Dunlap: syscalls.h #10. (February 16, 2004)

Architecture-specific

• Benjamin Herrenschmidt: Update platinumfb driver. (February 16, 2004)

• Santiago Leon: IBM PowerPC Virtual Ethernet Driver. (February 18, 2004)

• Keith M Wesolowski: RFC: [sparc32] atomic_t is 32 bits. (February 17, 2004)

Security-related

• Valdis.Kletnieks@vt.edu: [PATCH} 2.6 and grsecurity. (February 17, 2004)

• James Morris: Event notifications via Netlink. (February 18, 2004)

Benchmarks and bugs

• Con Kolivas: 2.6.3-rc2 v 2.6.3-rc3-mm1 kernbench. (February 16, 2004)

• Judith Lebzelter: OSDL tiobench Sequential Reads improved with AS due to read-ahead changes. (February 17, 2004)

Miscellaneous

• Mariusz Mazur: linux-libc-headers 2.6.2.0. (February 12, 2004)

• Greg KH: udev 017 release. (February 13, 2004)

Page editor: Jonathan Corbet

Distributions

News and Editorials

An Early Look at Fedora Core 2

The first beta version of Fedora Core 2 was released last week, after a 10-day delay from the original schedule. Also known as version 1.90 or FC2-test1, this is the earliest preview of what will in due time form the basis of Red Hat Enterprise Linux 4, and what will soon be making its way to desktops and servers of Fedora users. In many ways, this is the most significant product by Red Hat in years, with the brand new Linux kernel, substantially enhanced security, and new versions of the popular GNOME and KDE desktop environments. As such, it warrants a closer look, even in its present unfinished state.

First the bad news. Those accustomed to high standards of past releases by Red Hat, even the beta ones, will be surprised at the apparent lack of attention to detail in this release. A glaring error while building the ISO images prevents the installation CD from booting on architectures other than i686. The usually comprehensive release notes were replaced by a quick overview listing a few known issues and a link to Red Hat's bugzilla. The two main desktop environments, GNOME and KDE are both beta versions - GNOME is a development release 2.5, while KDE is version 3.1.95 (also known as 3.2rc1).

The version of GNOME included in this release is very buggy. Both Evolution and Nautilus are reportedly prone to crashes and Evolution is unable to import existing mail. Some users have complained about the new default way of browsing folders in Nautilus, the so-called "spatial mode", in which every click on a folder opens a new Nautilus window (without a menu or toolbar). The left panel with a tree structure is missing in spatial mode. Apparently, this is an intended behavior of Nautilus in GNOME 2.6, so those users who prefer the old way of doing things can restore the "browsing mode", either by launching the program with the "nautilus --browser" command, or by right-clicking within a Nautilus window and selecting "browser mode". Others have voiced their concerns about the newly overhauled "Open File..." dialog in GNOME, which in the words of one of the testers on the Fedora mailing list, is "poorly laid out, improperly sized and unnecessarily complex". Even the most faithful GNOME users are bound to be displeased with all the glitches and inconsistencies in this development version of GNOME.

Surprising as it may sound for a distribution that has traditionally demonstrated a clear preference for GNOME, the KDE desktop seems in much better shape. It still uses the Bluecurve theme by default, but users can select a different one during KDE's initial configuration dialog. Apart from misplaced menu entries of certain system applications, accidentally placed under a "Lost and Found" (!) menu entry, there have been few reports of KDE applications crashing or behaving unexpectedly.

Another surprise, and a rather pleasant one for users with older hardware, is the appearance of XFce (version 4.0.3) in the distribution. This is the first time that XFce was included in any Red Hat product and it comes at the expense of WindowMaker, which was dropped from Red Hat Linux after version 8.0. The inclusion of a light-weight desktop would seem to indicate that Red Hat has decided to lower the stringent hardware requirements and give users an option to run a less resource-hungry desktop on older hardware. Unfortunately, there is no mention of this in the release notes. XFce is not given as a choice during system installation; however, once installed directly from RPMs, it appears as an option on the login screen, alongside GNOME and KDE.

Disappointingly, the much awaited SELinux functionality was pulled from this release due to "a couple of last minute problems". It is now expected to be ready for inclusion in Fedora Core 2 Test 2, scheduled for release on March 8. SELinux (or Security Enhanced Linux) is one of the two major new features planned for Fedora Core 2; it is designed to enhance security of the operating system by allowing users to define explicit rules for file and device access and by confining user programs to the minimum amount of privilege they need to perform their tasks.

Unless you are an experienced user or intend to help with bug reporting, this first beta release of Fedora Core 2 is best left alone. Some of the many, many bugs in it are not necessarily Red Hat's fault, although one has to question the company's insistence to ship a highly experimental version of GNOME, which seems to have a long way to go before it becomes 2.6 final. Other frequently reported problems include issues with sound, printing, up2date and yum, which together with missing SELinux functionality and haphazard release notes make for a rather poor distribution. The Fedora developers have a lot of work on their hands before the product enters its second phase of testing.

Luckily for them, the final release of Fedora Core 2 is only scheduled for April 19, so there is plenty of time. But as things stand now, Mandrake's own beta releases appear to be in a much better shape.

Comments (9 posted)

Another early look at Fedora Core 2

The first Fedora Core 2 test release was pushed out last week, so we thought we'd take a look to see what Fedora users can look forward to with the second Fedora Core release. Fedora Core has grown since the first release, literally. Fedora has grown from three installation ISO images to four, which I downloaded using BitTorrent.

I installed FC2 on two machines, a dual Pentium III Xeon machine with 1 GB of RAM and a Pentium III 500MHz machine with 384 MB of RAM. The install hasn't changed significantly since Fedora Core 1, though the install procedure no longer automatically ejects CDs -- something that has been widely discussed on the Fedora-test mailing list. The first install, on the dual Xeon machine, went flawlessly. The second install failed on the first attempt when I jiggled the mouse while Anaconda was in the process of trying to detect it. The second attempt at installation went fine.

Unfortunately, test1 does not include the much-anticipated SELinux functionality, at least not by default. The packages are included in the distribution, but the user will have to install and configure them manually. There is precious little documentation for the user to do so. The package "selinux-doc" contains only a brief README with a list of necessary components, a file with instructions for porting SELinux-aware applications to the new policy and API, and a brief Changelog. According to this post from Jeremy Katz, SELinux should be available in test2. Users who are looking forward to trying SELinux without having to get deeply involved in the actual mechanics of SELinux will have to wait a while.

Fedora still sports the familiar "Bluecurve" theme for GNOME and KDE, so there are no real surprises for users of Fedora Core 1 when GNOME starts up. FC2 uses GNOME 2.5 by default, though KDE and XFce are also available. The GNOME panel froze on me a few times during testing, which required a restart of GNOME. Evolution 1.5.3 is also a bit buggy. I wanted to import a mailbox file from an older version of Evolution, but it simply refused to open the Import dialog from the menu.

Nautilus, or at least its default behavior, has changed in FC2 -- and not necessarily for the better. The familiar "browser" interface for Nautilus is no longer the default, though the user can return to the old behavior by launching Nautilus with the "--browser" option, or by right-clicking on an object and selecting "Browse Folder." Annoyingly, the default for Nautilus is now to open a new window for each object, rather than opening the object in the same window. Users who prefer to point-and-click their way through the directory structure will find their desktop filling up with Nautilus windows in short order. This is, of course, not specific to Fedora Core, but a reflection of upstream changes in GNOME.

A number of users have reported having problems with sound in test1. Some users have noted that their sound card is detected, but sound is muted by default -- leaving the user to think that sound is completely broken. Other users have noted that their sound card, which was previously supported, simply isn't detected. Neither of my test systems has a sound card, so I was unable to verify the sound-related problems.

Another interesting feature for FC2, of course, is the inclusion of the 2.6 kernel by default. From a user perspective, however, I didn't notice any real difference in using the 2.6 kernel versus using a system with a 2.4 kernel.

Other than aforementioned glitches, the user experience for FC2 is pretty much the same as FC1. Most, if not all, of the packages in Fedora Core 1 have been upgraded -- but it feels more like a minor version upgrade than a major version release. This isn't a bad thing, Fedora users are likely to appreciate the fact that FC2 is largely familiar and full of gradual improvements rather than jarring changes.

If all goes as scheduled, the second test release should be out around March 8, followed by a third test release by the end of March. The final Fedora Core 2 release is slated for April 16, if all goes well. However, if the first test release is any indication, it may take longer for the Fedora project to fully integrate SELinux and iron out all of the various bugs present in FC2.

Comments (1 posted)

Distribution News

Debian GNU/Linux

The Debian Weekly News for February 17, 2004 is out. This week's topics include a debian-desktop IRC meeting, Debian ranking according to Google, the new ftp-master, Project Leader nominations, and more.

Debian Project Leader Martin Michlmayr lists the conferences that he will be attending in February.

Comments (none posted)

Fedora

Test release number one of the Fedora Core 2 distribution has been released. "Yes, it's time for the first test release of Fedora Core 2. This release is the first Fedora Core release to include the 2.6 kernel, GNOME 2.5, KDE 3.2, and XFCE. Testing of all of these areas would be appreciated, above and beyond any other testing."

Fedora Core 1 updates:

• samba: Samba 3.0.0 and 3.0.1 could overwrite the password field of a disabled account with uninitialized memory.
• rdesktop: update to v1.3.1 bug fix release
• redhat-config-printer: bug concerning printer sharing in the Printing configuration tool
• freeradius: a flaw in 0.9.2 (and earlier versions) may allow an attacker to DoS the server.

Comments (none posted)

Gentoo Weekly Newsletter - Volume 3, Issue 7

The Gentoo Weekly Newsletter for the week of February 16, 2004 is out; with a look at Gentoo's growing popularity, using 2.6 kernels, and several other topics.

Full Story (comments: none)

Mandrake Linux

The Mandrake Linux Community Newsletter for February 13, 2004 is out. This issue covers Mandrake Linux 10.0 Beta 2, MandrakeSoft's first profitable quarter since 1999, and several other topics.

A bug was discovered in Nautilus where if the last file is deleted in the list view, Nautilus continues to display the file and if clicked on to open, Nautilus will crash. This bug has been fixed for Mandrake Linux 9.2.

Comments (none posted)

New support for Netwosix Users

Linux Netwosix has announced that the official Linux Netwosix Mailing Lists are available. Three lists have been created to help Netwosix users. Click below for more information.

Full Story (comments: none)

Slackware Linux

Slackware Linux has lots of recompiled, rebuilt and upgraded packages, and some unsupported packages were purged from -current See the slackware-current changelog for complete details.

Comments (none posted)

Who's The Fastest Growing Linux Distro? (internetnews.com)

internetnews.com uses Netcraft numbers and other factors in this discussion of popular Linux distributions. "Which Linux distribution is the most popular? For many players in the open source realm, that answer depends on which part of the globe is counting, and how. It could also depend on where the major Linux distributors stand with their product release cycles with the latest 2.6 Linux kernel."

Comments (1 posted)

New Distributions

bioknoppix: A Live-CD Linux distribution for bioinformatics

Bioinformatics.Org covers a new live CD distribution. BIOKNOPPIX comes from the University of Puerto Rico High Performance Computing facility (HPCf) and the Puerto Rico Biomedical Research Infrastructure Network (BRIN-PR). It's a Live-CD Linux distribution, based on KNOPPIX, specialized to include tools for bioinformatics. Bio-Knoppix beta version 0.2 was released February 13, 2004. The 0.3 release mentioned in the Bioinformatics article was recalled due to errors in the master.

Comments (none posted)

Mandows

Mandows is a live CD project based in France. The Mandrake 9.2 fivestar distribution was chosen as the base because of its ease of use. A package list is available here. Version 1.4 was released under the GPL on February 3, 2004. The current version is 1.5, released February 15, 2004.

Comments (none posted)

Medialinux

Medialinux is a live CD based on Knoppix. It includes all audio, graphics and video software included in Debian. Version 1.0 was released February 17, 2004 - based on KNOPPIX 3.3 with extra packages from Debian experimental and unstable trees.

Comments (1 posted)

Minor distribution updates

Astaro Security Linux

Astaro Security Linux has released beta v4.702 with major feature enhancements. "Changes: This release has intrusion detection and prevention, content filtering that now includes HTTP virus protection and POP 3 spam protection, IPSec VPN client features, Microsoft Windows native IPSec VPN Client, L2TP over IPSec, centralized and unified logging, local as well as remote archiving, increased support for system reliability and performance with high memory support for up to 4 GB RAM, and symmetric multi-processor support. There are a lot more enhancements and improvements under the hood."

Comments (none posted)

Bluewall GNU/Linux

Bluewall GNU/Linux has released v1.1 with major feature enhancements. "Changes: This release includes Linux 2.4.24 and 2.6.2 with ext2, ext3, Reiserfs, and XFS (only 2.6) support, Bluewall Perl installer scripts (bw-config/bw-post/bw-install) for making the installation easier and faster by only running three commands, 95 new Debian packages, and a preconfigured initrd to load modules at boot-time. The reboot command/scripts have been fixed and included in the ramdisk. The NetBSD package system (pkgsrc) has also been included."

Comments (none posted)

Damn Small Linux

Damn Small Linux has released v0.6 with major feature enhancements. "Changes: A new kernel and modules were added, supporting more hardware. busybox is used to save space. Space was saved by having dpkg-restore restore not only package structure, but also related programs. Backup or restore to a specific device (such as a hard drive) was improved. The PPP dial scripts were improved, so manual editing is no longer required. The hard drive install script was improved to pass the fb800x600 screen size. The speed of installation was also improved. The menu was reorganized for easier navigation. The /opt/bootlocal.sh was added to allow the user to specify miscellaneous system startup commands."

Comments (none posted)

Feather Linux

Feather Linux has released v0.3.5 with minor feature enhancements. "Changes: This version adds ntfstools, dosfstools, e2undel, iftop, gtkrecover, bbpager, utelnetd, picocom, bridge-utils, index, and various dockapps to show the system status. It includes BusyBox versions of dc and fbset, and changes the Firebird script to download Firefox instead. It adds menu options to play CDs and DVDs, and a documentation menu. There are small changes to HD install script, and adds a script to save the config to HD (use knoppix hdrestore=hda1)."

Comments (none posted)

INside SEcurity Rescue Toolkit

INSERT has released v1.2.2 with major feature enhancements. "Changes: The latest virus database for ClamAV has been added, making the virus scan functionality independent from a working network connection. The floppy boot image has been removed; instead, a small script and syslinux provide the functionality to generate the boot disk from the files already on the CD. Some minor corrections in the captive documents page have been made. wmnet has been removed."

Comments (none posted)

KnoppiXMAME

KnoppiXMAME has released v1.2.1 with minor bugfixes. "Changes: This is a small point release which fixes a bug where the new addroms utility would not save configuration changes if remastering from an already remastered CD. Type "addroms" at the boot prompt to try the new utility which adds your ROMs to the CD and makes you a new .iso. All filesystems are supported, but writing to NTFS (although possible) is still experimental."

Comments (none posted)

LGIS GNU/Linux

GnomeDesktop provides an update on LGIS GNU/Linux. "The ISO images contains many more updates than in the first announcement, and I've added the mono packages to the installation."

Comments (none posted)

Linux Embedded Appliance Firewall

LEAF has released Bering-uClibc v2.1-rc2 with minor bugfixes. "Changes: This release fixes bugs reported for the first 2.1 release candidate, such as problems loading the airo module, saving packages smaller than the original one, and some more minor changes."

Comments (none posted)

MoviX

MoviX has released v0.8.1rc3 with major feature enhancements. "Changes: MPlayer menu functions have been greatly improved. The menu is now available in Italian and German. Subtitle information is also displayed for CDs and playlists. Net booting through TFTP has been improved. Many small bugs have been fixed."

Comments (none posted)

Pingwinek GNU/Linux

Pingwinek GNU/Linux has released v1.0rc1 with minor feature enhancements. "Changes: This release has a new XML-based package management tool (BOX). It features many new software packages like OpenOffice.org and XFCE4. The main desktop is now GNOME 2.4.2. The release contains the stable kernel 2.6.2."

Comments (none posted)

Sentry Firewall

Sentry Firewall has released v1.5.0-rc9 with minor feature enhancements. "Changes: This release updates the kernel to 2.4.24-ow1, upgrades Snort and net-snmp, and adds radvd and OpenVPN. It also adds support for pulling the sentry.conf and other configuration files from a USB thumb drive."

Comments (none posted)

Source Mage GNU/Linux

Source Mage GNU/Linux has released the v0.9.1 ISO image.

Comments (none posted)

Trustix Secure Linux

Trustix Secure Linux has released 2.1 Beta 1, also known as Snow. Click below for more details.

Full Story (comments: none)

White Box Linux

White Box Linux has rebuilt Red Hat Update1 SRPMs and has these packages available for download. Click below for a package list.

Full Story (comments: none)

Distribution reviews

The Linux desktop is here (SMH)

The Sydney Morning Herald reviews Xandros 2.0. "There is very little about Xandros which will raise the ire of a user - though one can complain that there are limited applications. But then, when all common tasks are looked after, why does one have to look any further? Those of an adventurous turn of mind can add new packages and play around as their knowledge of the system increases. About the only thing which I could fault was the absence of the best-known graphics program for Linux, the GIMP."

Comments (1 posted)

Red Hat Professional Workstation: More expensive, fewer features (NewsForge)

NewsForge reviews Red Hat Enterprise Linux Workstation. "By contrast, small businesses that ran Red Hat Linux 9 on their servers certainly will notice what they're missing. A lot of the functionality that was available in Red Hat Linux 9 has been stripped out of Enterprise Linux WS, undoubtedly to force subscribers to the Enterprise Linux product line to move to the more expensive ES and AS platforms. This has naturally filtered down to Professional Workstation, which is missing server components such as BIND, OpenLDAP, DHCP, inews, and Kerberos 5."

Comments (12 posted)

Newbies take on LiveCDs; everybody wins (linux.com)

In this linux.com article newbies take on three LiveCD distributions; Knoppix, MandrakeMove, and Slax. "Slax, the most unlikely finalist, is based on Slackware Linux. Slackware is often perceived as the no-nonsense, geeks-only distribution, and Slax remains true to its roots, providing the same no-nonsense approach that purists will appreciate. In spite of invoking a little culture shock, Slax was surprisingly well received by my team of novices."

Comments (none posted)

XandrosOS: User-friendly to a fault (Register)

The Register says XandrosOS is friendly, but not secure enough. "There's a serious lack of attention to encryption and data hygiene. It's very easy to integrate GnuPG with KMail; unfortunately, GnuPG and KGpg are not included. It's also easy to integrate GnuPG with Mozilla Mail using a recent feature called Enigmail, though the Mozilla version (1.4) packaged with Xandros lacks it. The Shred utility is included, but it's not integrated with the file browser. The right-click menu and menu bar offer only to delete a file, not remove it securely. Shred must be run from the shell, which, again, is a bit much for novices."

Comments (none posted)

Page editor: Rebecca Sobol

Development

KBarcode - the open-source barcode solution

The KBarcode project is a GUI-based barcode creation application for KDE 3:

Some of the KBarcode features include:

• Creation of 1D and 2D barcodes.
• Contains a rich text editor and has graphical drawing capabilities.
• Has optional database support, works with mySQL, PostgreSQL, and SQLite.
• Outputs to printer, image files, and Cut/Paste to other KDE applications.
• Has support for batch printing of labels.
• Contains built-in label definitions.
• Supports user-defined label definitions.
• Can act as a replacement for xbarcode.

KBarcode supports a lengthy list of barcode types by acting as a front end to several barcode back ends including GNU Barcode, PDF417 Encode, and the commercial TBarcode.

The complete documentation for KBarcode is available in PDF formatted files.

For a better understanding of the capabilities of KBarcode, see the screen shots of the GUI and some online examples of the software's output.

KBarcode version 1.6.2 (stable) was recently released. "This release fixes a major bug, which prevented correct creation of UPC-A barcodes. Also a Greek translation was added."

KBarcode dependencies include KDE 3.x, GNU Barcode, ImageMagick, and if SQL support is needed, QT SQL Tools and mysql or PostgreSQL. KBarcode is available for download here.

Some user feedback shows what people are doing with the software.

If you have access to the hardware, the Linux CueCat driver may be a useful resource for reading back your new barcode labels.

Comments (2 posted)

System Applications

CORBA

CLORB 0.5 released

Version 0.5 of CLORB, a Common Lisp CORBA 2 Object Request Broker, is out. "This version provides Valuetype, a new IDL parser, improved ports, and a new stub and skeleton implementation."

Full Story (comments: none)

Database Software

Firebird 1.5 Release Candidate 9

Version 1.5 RC 9 of the Firebird Database is available. "The 1.5 release is the first version based on new, cleaned and improved C++ source code tree with many new features and bugs fixed."

Comments (none posted)

MySQL 4.0.18 has been released

Version 4.0.18 of the MySQL database is out. "This is a bugfix release for the current production version."

Full Story (comments: none)

PostgreSQL Weekly News

The February 16, 2004 edition of the PostgreSQL Weekly News is available with the latest PostgreSQL database information. "Another exciting, action-packed week of PostgreSQL development has come and gone. Work included a number of cleanup improvements to recent changes, some work on new features, and bug fixing at a minimum; but enough generalizing, let's get to it."

Full Story (comments: none)

ZODB 3.2.1 and 3.1.5 released

Two new releases of ZODB, the Zope Object DataBase, came out this week. "These releases correspond to the Zope 2.7 and 2.6.4 releases made yesterday. They are bug fix releases, and users of earlier versions are encouraged to upgrade. There are no significant changes since the release candidates of three weeks ago."

Full Story (comments: none)

Mail Software

Three new milters

A bunch of new email filters are available on milter.org. The new filters include milter-sender 0.50, milter-spamc 0.14, milter-date 0.7, milter-ahead 0.2, and milter-7bit 0.1.

Comments (none posted)

Web Site Development

KimDaBa version 1.1 released.

Version 1.1 of KimDaBa, the KDE Image Database, is out. "KimDaBa version 1.0 was announce early December last year. Lots of users started using KimDaBa back then, and lots of feature requested came in. This version tries to honor the most wanted features, and thus makes it an even more attractive application."

Full Story (comments: none)

Two new versions of Zope

Versions 2.6.4 and 2.7.0 of the Zope content management system are available.

Comments (none posted)

Web Services

Tip: Passing files to a Web service (IBM developerWorks)

Benoît Marchal works with binary data and SOAP on IBM's developerWorks. "In this tip, Benoît discusses the different solutions available for passing binary data (typically files) to a Web service."

Comments (none posted)

Desktop Applications

Audio Applications

jackEQ 0.4.0 released

Version 0.4.0 of jackEQ, an equalizer application for the JACK Audio Connection Kit, has been released. The changes are summarized as: "Fixed the rc file so the io menu displays the checks properly. General tidyups which I have forgotten."

Full Story (comments: none)

Zinf 2.2.5 released (GnomeDesktop)

Version 2.2.5 of the Zinf audio player has been announced. "This is the first version of zinf to use GTK2 for it's interface. This is good news for those of us who don't really get on with RB, but want to rid the world of GTK1. As always I'm sure the Zinf developers would appreciate user feedback (and of course more people willing to help)."

Comments (none posted)

Desktop Environments

GNOME Development Release 2.5.4 (GnomeDesktop)

Development Release 2.5.4 of the GNOME desktop environment has been announced. "This release is a snapshot of development code. Although it is buildable and usable, it is primarily intended for testing and hacking purposes."

Comments (none posted)

GNOME Development Release 2.5.5 (GnomeDesktop)

The GNOME developers have been busy this week, development version 2.5.5 of GNOME was announced. "The latest GNOME Development Release is ready for your bug-busting and testing pleasure!"

Comments (none posted)

The latest Gnome Summary

The GNOME Summary covering developments through February 14 is available. This issue looks at the 2.5.4 development release, Gcalctool, and several other topics.

Full Story (comments: 1)

Bag of Software (GnomeDesktop)

GnomeDesktop.org has a multiple announcement for several utilities. "New releases of a GTK partitioning tool, USB Storage device manager and pppoe configurator...."

Comments (none posted)

Quickies: Kuake, Scribus, GTK-Qt, KDE Web Dev, KimDaba (KDE.News)

KDE.News has a multiple announcement for a bunch of new KDE software and information. Read about Kuake, Scribus, GTK-Qt, KDE Web Dev, and KimDaba.

Comments (none posted)

KDE-CVS-Digest (KDE.News)

The February 13, 2004 edition of the KDE-CVS-Digest is online, here's the summary: "The LDAP kio-slave is improved with TSL and SSL for secure connections and SASL for authentication. KDEPIM has a new certificate manager. Work proceeds apace on the khtml XML parser and xpath libraries. Plus a large number of bug fixes in Kopete. Whenever someone does any changes in the name of Usability, it seems to generate much discussion."

Comments (none posted)

XFree86 4.4.0 Release Candidate #3

Release Candidate #3 of XFree86 version 4.4.0 has been announced. "In what is hoped to be the final showing of our Release Candidate Series, RC3 is finally tagged! Well, this certainly took long enough, but there were a lot of bugs, even some security ones, trapped during this delay of the Great Licence Debate, so it was well worth it."

Comments (34 posted)

Electronics

gEDA News

The latest releases from the gEDA project include new versions of the Covered Verilog code coverage analysis tool, and the Icarus Verilog compiler.

Comments (none posted)

PCB 20040215 released

The Open Collector site mentions the availability of a new snapshot of PCB, a printed circuit board CAD program. This version features new library additions, lots of bug fixes, and more.

Comments (none posted)

Financial Applications

SQL-Ledger 2.2.4

Version 2.2.4 of SQL-Ledger, a Perl-based accounting system, has been announced. Changes include updated translations, a new customer and vendor history report, a patchlevel check for Apache 2.0, and more.

Comments (none posted)

Games

New Pygame Releases

New Python-based games on the Pygame site include Solarwolf 1.5, Pycadia 0.5.1, and Pydance 0.9.1.

Comments (none posted)

wftk version 0.7.0 released

Version 0.7.0 of the WorldForge game project's wftk library has been announced. Change information is in the source code.

Comments (none posted)

Graphics

Inkscape 0.37 Officially released (GnomeDesktop)

Version 0.37 of Inkscape, a drawing package, has been announced. "Inkscape 0.37 includes many major new features, numerous bug fixes, and extensive codebase cleanup." Also, boolean operations can be applied to graphics.

Comments (none posted)

Sodipodi 0.34 released

Version 0.34 of Sodipodi, a drawing package, has been announced. "This release incorporates for the first time path composition operations (union, intersection and subtraction) and new, calligraphic pen based freehand drawing. Plus many bugfixes and smaller features, as usual."

Comments (none posted)

GUI Packages

New software for FLTK

The latest releases for FLTK, the Fast Light Toolkit include version 2.9.1 of FLU, small collection of FLTK Widgets, and version 0.3 of FL_Signal, a callback and signal/slot library.

Comments (none posted)

Interoperability

Samba 3.0.2a Available for Download

Samba version 3.0.2a has been released. "Samba 3.0.2a is a minor patch release for the 3.0.2 code base to address, in particular, a problem when using pdbedit to sanitize (--force-initialized-passwords) Samba's tdbsam backend. This is the latest stable release of Samba. This is the version that all production Samba servers should be running for all current bug-fixes."

Full Story (comments: none)

Wine 20040213 released

Release 20040213 of Wine has been announced. Changes include screen resolution change improvements, shell32 improvements, Winelib compatibility fixes, bug fixes, and more.

Comments (none posted)

Wine Traffic

Issue #210 of Wine Traffic is out with the latest Wine news.

Comments (none posted)

Music Applications

BEAST/BSE 0.6.0 is released (GnomeDesktop)

Version 0.6.0 of BEAST/BSE, a music composition and modular synthesis application, has been announced. "Outstanding new features include support for skins, many sample file formats, MIDI file import abilities, an improved piano roll widget, the track editor which allows for easy selection of synthesisers or samples as track sources, loop support in songs and unlimited Undo/Redo capabilities."

Comments (none posted)

Horgand 1.06 released

Version 1.06 of Horgand, an organ synthesizer, is available with lots of new changes.

Full Story (comments: none)

wigwamjam proof of concept

Wigwamjam is a proof-of-concept implementation of a genetic programming synthesizer. "The idea behind genetic interfaces is to grow complex functions merely by choosing from a range of options (or a population of genomes). each genome represents a function to create a sound, each iteration of the process of growing a sound, you choose the best one from the population which is then reseeded with mutants of that sound."

Full Story (comments: none)

Office Suites

OpenOffice.org Newsletter

Volume 1, Issue 8 of the OpenOffice.org Newsletter is available with the latest OpenOffice.org office suite news.

Full Story (comments: none)

Digital Photography

Digikam 0.6 Released (KDE.News)

Version 0.6 of Digikam has been announced. "After nearly one and half years of development Digikam 0.6 and its plugin package have been released. Digikam is a simple digital photo management application which makes importing and organizing digital photos a "snap". The photos can be organized in albums which are automatically sorted chronologically. An easy to use interface is provided to connect to your camera and preview images and download and/or delete them."

Comments (1 posted)

Science

GRAMPS 1.0.0 ''Stable as a Tombstone'' released (GnomeDesktop)

Version 1.0.0 of GRAMPS, the Genealogical Research And Management Programming System, has been announced. "The GRAMPS project is pleased to announce the 1.0.0 ("Stable as a Tombstone") release of GRAMPS, the Genealogical Research And Management Programming System. After more that 2 1/2 years of development, GRAMPS is leaving the "beta" stage with its first "stable" release."

Comments (none posted)

Web Browsers

Galeon 1.3.13a released

Version 1.3.13a of Galeon, a minimalist web browser, has been announced on the heels of version 1.3.13. The earlier release was dubbed "Lets try that again". "I suppose you can say we were asking for it with a release name like that... I used the shiny new automake 1.8.2 when building the tarballs and that was obviously a mistake. It fails to include a helper script needed to make installation succeed. I've readded this file and pushed out 1.3.13a tarballs."

Comments (none posted)

Mozilla Links Newsletter

The Mozilla Links Newsletter for February 17, 2004 is available. "Along with the new name and version, a definitive logo for Mozilla Firefox was released. A new image featuring an agile firefox (red panda) surrounding a globe, a product slogan ("The browser, reloaded") and a marketing slogan ("Take back the web") were unveiled, as well as buttons you can use to let your web visitors know about this terrific product."

Full Story (comments: none)

Independent Status Reports (MozillaZine)

The Mozilla Independent Status Reports for February 15, 2004 are out. "The latest set of status reports includes updates from MSDbar, DownloadWith, the Mozilla-Delphi Project, MozManual, mozCC, Launchy, Reload Every and Dictionary Search."

Comments (none posted)

mozilla.org Status Update (MozillaZine)

The mozilla.org Status Update for February 16, 2004 has been announced. "It includes news on Mozilla Firefox, Mozilla Thunderbird, junk mail detection, browser data migration, popup blocking, SVG, new mail notification, permissions and more."

Comments (none posted)

Miscellaneous

BloGTK 0.9 Released (GnomeDesktop)

Version 0.9 of the BloGTK web logging client is out. "This version has been thoroughly injected with Botox so that unnecessary lines no longer uglify the interface. Also character handling has been improved so that Unicode characters can be properly escaped for non-Unicode blogs."

Comments (none posted)

Languages and Tools

Caml

Caml Weekly News

The February 10-17, 2004 edition of the Caml Weekly News is out with the latest Caml language news.

Full Story (comments: none)

Java

Approaches to Mocking

Simon Stewart writes about mock objects on O'Reilly. "Everyone knows what a mock is, just from the name, but as with many seemingly simple ideas, there is more to them than first meets the eye. This article explores the two types of mocks that exist and covers some of the problems inherent in their use. Finally, it considers the reason why a developer might chose to use mocks. After all, common understanding holds that mocks are used for unit testing, a key part of Test Driven Design, but that isn't necessarily about testing at all."

Comments (none posted)

JSP

Six Cool New JSP and Servlet Features

Bruce W. Perry introduces new JSP and Servlet Features on O'Reilly. "If you use a web container such as Tomcat 5.x, which supports Servlet API 2.4 and JSP 2.0, then you can use a number of useful new features. These include: 1. Using a servlet as a welcome file. 2. Mapping filters to RequestDispatchers. 3. The new ServletRequestListener and ServletRequestAttributeListener interfaces. 4. Using Expression Language (EL) code within template text, not just as tag attribute values. 5. Writing tag files. 6. Writing Expression Language qualified functions."

Comments (none posted)

Lisp

OpenMCL 0.14.1 released

Version 0.14.1 OpenMCL, a Common Lisp implementation, is out. "This version provides better integration of Objective-C objects into CLOS, bundles some popular system building tools, makes REQUIRE more flexible, and more."

Full Story (comments: none)

Maintaining Portable Lisp Programs - new paper

Paolo Amoroso has sent us a link to a new paper on writing portable Lisp. "Christophe Rhodes has written the paper "Maintaining Portable Lisp Programs - It's a bug, not a feature". It examines "the use of read-time feature conditionals, with particular emphasis on writing portable Common Lisp code which aspires to both forwards- and backwards-compatibility"."

Full Story (comments: none)

Performance and Evaluation of Lisp Systems released in PDF format

Richard Gabriel's book Performance and Evaluation of Lisp Systems is available in PDF format for download.

Full Story (comments: none)

Perl

This Week on perl5-porters (use Perl)

February 9-15, 2004 edition of This Week on perl5-porters has been published. "Another quiet week on perl5-porters; but big patches were proposed, demonstrating that the porters are not dead yet. Read about a revamp of the parser, an in-depth modification of the internals, and other bugs and associated fixes."

Comments (none posted)

This week on Perl 6 (O'Reilly)

This week on Perl 6 for February 8, 2004 is out, here's the summary: "Lots of little clean-ups done to Parrot this week, while the Perl 6 language design focuses on vector operations and Unicode operators."

Comments (none posted)

PHP

PHP 4.3.5RC3 released!

Version 4.3.5RC3 of PHP is available. "This will be the last release candidate prior to the final release, so please test it as much as possible." PHP 5.0 Beta 4 is also out.

Comments (none posted)

PHP Weekly Summary for February 16, 2004

The PHP Weekly Summary for February 16, 2004 is out. Topics include: Deprecate dl(), PHP beta 4, Exceptions change.

Comments (none posted)

Python

DrPython 2.2.3 released

Version 2.2.3 (stable) of DrPython, a Python language editing environment, is out. See the Change Log for details.

Comments (none posted)

Stackless 3.0 for Python 2.3.3 is ready

Version 3.0 of Stackless Python for Python 2.3.3 is out. Stackless Python does not use the C Stack. "After a longer search for some final bug which applied to both Stackless for Python 2.2 and 2.3, I am releasing a so far final version of Stackless 3.0. There are a couple fo enhancements planned, of course. Some of them will be the theme of the upcoming Sprint on Stackless Python in March 2004".

Comments (none posted)

What's New in Python 2.4

A.M. Kuchling has released an early version (version 0.0) of the document What's New in Python 2.4. "This article explains the new features in Python 2.4. No release date for Python 2.4 has been set; expect that this will happen mid-2004. While Python 2.3 was primarily a library development release, Python 2.4 may extend the core language and interpreter in as-yet-undetermined ways."

Comments (none posted)

PyZine Issue #5

Issue #5 of PyZine, an online Python magazine is out with several interesting Python articles.

Comments (none posted)

Dr. Dobb's Python-URL!

The February 17, 2004 edition of Dr. Dobb's Python-URL! is available with links to many Python language articles.

Full Story (comments: none)

Ruby

Why's (Poignant) Guide to Ruby

The Ruby Garden mentions a new online Ruby book, Why's (Poignant) Guide to Ruby. "The (Poignant) Guide is a new approach to teahcing Ruby, emphasizing the lingual traits of Ruby and illustrating its uniqueness with comics, visual imagery, and songs with accompanying hand gestures. This date marks the release of the first three chapters."

Comments (3 posted)

Tcl/Tk

Dr. Dobb's Tcl-URL!

Dr. Dobb's Tcl-URL! for February 16, 2004 is available with the week's Tcl/Tk article links.

Full Story (comments: none)

XML

A survey of XML standards: Part 3 (IBM developerWorks)

Uche Ogbuji continues his series on XML standards with part three. "The world of XML is vast and growing, with a huge variety of standards and technologies that interact in complex ways. It can be difficult for beginners to navigate the most important aspects of XML, and for users to keep track of new entries and changes in the space. XML is a basic syntax upon which you develop local and global vocabularies. The key to its success is that several very important data formats are defined as XML vocabularies. In this article, Uche Ogbuji presents the most important of these."

Comments (none posted)

Miscellaneous

dejaGnu 1.4.4 (stable) released

Version 1.4.4 (stable) of the dejaGnu software testing framework has been announced. The What's new document says: "This release has a number of substantial changes over version 1.3. The most visible change is that the version of Expect and Tcl included in the release are up-to-date with the current stable net releases. The biggest change is years of modifications to the target configuration system, used for cross testing. While this greatly improved cross testing, is has made that subsystem very complicated. The goal is to have this entirely rewritten using iTcl by the next release."

Comments (none posted)

Rapid application development tools, part 3: More RAD tools (OSDN DevChannel)

Michael Stibane covers several more rapid application development tools in part 3 of an OSDN DevChannel series. "In parts 1 and 2 of this series I discussed database front end development tools and RAD environments for the BASIC language on Linux. I'll conclude by looking at tools for smaller programming languages (I won't talk about C++/KDevelop/Anjuta or Java/Eclipse) and little-known or independently developed languages."

Comments (none posted)

Page editor: Forrest Cook

Linux in the news

Recommended Reading

Pandora's box for open source (News.com)

News.com examines the increasing acceptance of open-source software by large companies. "Open source has become something like the invisible hand of the software economy, driving prices down and pinpointing those areas ripe for commodity status. While Microsoft continues to fight it, other companies have no choice but to embrace the technology, even though its long-term profitability remains largely unproven."

Comments (8 posted)

A Proposal of Truce (LinuxWorld)

LinuxWorld is running an open letter to Darl McBride which purports to be a set of conditions for a truce between SCO and the Linux community. "We fully recognize your right to defend your IP. We ask that you recognize our right to defend our IP. This means obeying the terms of our licenses. You must stop distributing Linux, Samba and GCC unless you are willing to agree to the terms of our General Public License (GPL)." Of course, this begs the question of just how many people in the community want a truce with SCO at this point.

Comments (38 posted)

Trade Shows and Conferences

Emerging Technology Conference Coverage (O'Reilly)

O'Reilly has published extensive coverage of the ongoing Emerging Technology Conference Coverage and Digital Democracy Teach-In.

Comments (none posted)

Report: KDE at Paris Solutions Linux 2004 (KDE.News)

KDE.News has a report on KDE activity at the Solutions Linux trade show in France. "Solutions Linux ran for three days and welcomed around 9600 visitors this year. After speaking with our (prospective) users, my impression is that there is no big migration plan to Linux on desktop happening now in France. The boldest move is being done by the Homeland Ministry (Ministère de l'intérieur) which is migrating to OpenOffice.org on Windows."

Comments (none posted)

The SCO Problem

Weirder & Weirder (ComputerWorld)

ComputerWorld looks at SCO's suit against Novell. "If SCO's lawyers could make a good case with a contract lawsuit, they would. Apparently, they can't. It turns out that SCO's lawyers aren't likely to have much luck with a slander-of-title suit either. It won't pry loose the Unix copyrights from Novell, since that's a contract issue that's not affected by any of Novell's public statements. And a slander-of-title lawsuit is likely to be tossed out by a judge, whose first question will be, 'Why didn't you file a contract suit?'" (The article is a couple of weeks old, but worth a mention).

Comments (5 posted)

Novell Notifies SCO (Groklaw)

Groklaw looks at Novell's latest letter to SCO. "It seems SCO did not obey Novell's instructions by the deadline. Consequently, Novell in a new letter, dated February 11, takes the following action:"

""Accordingly, pursuant to Section 4.16(b) of the Asset Purchase Agreement, Novell, on behalf of The SCO Group, hereby waives any purported right SCO may claim to require Sequent (or IBM as its successor) to treat Sequent Code as subject to the confidentiality obligations or use restrictions of Sequent's SVRX license.""

Comments (none posted)

Novell's Motion to Dismiss and Memorandum in Support (Groklaw)

Groklaw has posted Novell's motion to dismiss the SCO lawsuit, along with the associated memorandum of support. "SCO admits, they point out, that they are not the copyright owners in the very relief they ask the court to grant them: namely, they ask that the Court issue an injunction 'requiring Novell to assign to SCO any and all copyrights Novell has registered in UNIX and UnixWare.' You can't ask for copyrights to be assigned to you if you already have them, can you? If you don't already have them, you can't scream slander of title if the person you want to assign them to you says they own them."

Comments (7 posted)

Followup Letters to Lehman - Exh. B & C to Red Hat's Motion to Supplement (Groklaw)

Groklaw has posted the SCO followup letter to Lehman Brothers' CEO. "I wish I could have seen the look on the CEO Mr. Fuld's face when he received this letter."

Comments (none posted)

An analysis of SCO Group (IT Manager's Journal)

IT Manager's Journal (an OSDN site, it seems) has unwittingly given us a view into the bizarre mindset of investment analysts with this long-winded "analysis" of the SCO Group. "In addition, if SCO Group's various lawsuits were to result in reduced demand for Linux, from both current and potentially new large enterprise customers, then that could be negative for Linux-related stocks such as SCOX."

Comments (11 posted)

AT&T trips up SCO (ComputerWorld)

ComputerWorld has discovered AT&T's old communications on the meaning of the Unix licenses, as dug up by Novell. "Of the million lines of Linux code that SCO claims IBM hijacked from Unix, SCO hasn't identified a single line that came from the original Unix source code. It was all created by IBM. According to AT&T in 1985, that means it's IBM's to keep -- or give away. And SCO's theory that it owns Linux code appears to be kaput."

Comments (10 posted)

Companies

Developer offers Linux-based RFID (Computerworld)

Computerworld covers the use of a Linux-based RFID system from Magellan Technologies. "Magellan Technologies has developed what it claims to be a world-first in RFID technology that allows many closely bunched tags to be uniquely identified without interference. The developer has taken the open source route using Linux-based readers and an open source application interface. Magellan's software manager Jeff Gray said the decision to adopt Linux was due to cost and interoperability. "

Comments (none posted)

Intel to speed lagging Linux support (ZDNet)

ZDNet has an article on Intel's plan to improve its Linux support. "Theo de Raadt, head of another open-source operating system, OpenBSD, steers people away from Intel and toward the Prism wireless networking chips from GlobespanVirata. 'Everyone in the open-source community is buying Prism chip based (wireless network) cards,' de Raadt said. 'The chipset is fully documented, and open-source drivers exist on all operating systems.'"

Comments (30 posted)

Microsoft grapples with leak of source code (CNN)

CNN reports on the apparent leak of some Windows code. "The leak could potentially put more Windows users at risk because it opens the door to more people finding vulnerabilities in Microsoft's code -- and using them in malicious ways.... That could, in turn, wreak havoc on Microsoft's ability to respond with fixes in a controlled manner."

Comments (28 posted)

Linux Adoption

Australian users back desktop Linux (ZDNet)

ZDNet Australia covers a study of tech users in Australian and New Zealand. "More than two-thirds of the survey respondents had used Linux personally, with the greatest single percentage of respondents (29.4 per cent) having used it for more than three years. New users (those who have used Linux for under twelve months) amounted to a relatively small percentage of total respondents, indicating that Linux is well-established within its user base."

Comments (none posted)

Survey: More data centers will use Linux in '04 (SearchEnterpriseLinux)

SearchEnterpriseLinux reports on a survey that indicates substantial growth of Linux in the data center market. "In an online spending survey of 130 IT managers and decision makers, 30% said that, among Linux-related projects planned for 2004, a data center migration to Linux would receive the greatest monetary commitment. Of that percentage, 52.7% indicated they'd be spending up to $99,000 on the migration, and 13% expect to spend between $100,000 and $499,000."

Comments (none posted)

Paris eyes open-source switch (News.com)

News.com reports on a study concerning Linux deployment in Paris, France. "Systems integrator Unilog is set to carry out a feasibility study on the installation of open-source software systems for the city of Paris, the company has said. On the strength of an earlier Unilog study, Munich agreed to migrate thousands of desktops from Windows to the open-source operating system Linux."

Comments (none posted)

Linux Finishes Second Among Oracle Developers (CXOtoday)

CXOtoday reports on the rising popularity among India's Oracle developers. "Oracle India announced that Linux has emerged the second most popular OS platform among its developers in India, and that seven of its new customers have recently chosen to run its technology and applications software on the OS."

Comments (none posted)

A Computer Lab with No Windows, Part I (Linux Journal)

The Linux Journal reports from Sisler High School (in Manitoba) on the use of the Linux Terminal Server Project distribution to equip student labs. "Public school systems always are underfunded, and because we are using taxpayers' money, we have the responsibility to get the most for our money. By using a Linux terminal server with cheap, 'obsolete' thin clients, I have been able to deliver many computer courses that are fully compatible with if not better than what teachers using Microsoft Windows are offering. With the money saved on a Linux terminal server lab, the school can fund other subject areas."

Comments (1 posted)

Interviews

FOSDEM 2004: Interview with Gunnar Schmi Dt of KDE Accessibility Project

The FOSDEM team talks with Gunnar Schmi Dt of the KDE Accessibility Project. "Gunnar Schmi Dt - In my talk on Saturday afternoon I will talk about the Qt Accessibility Framework and the bridge to ATK. Part of that talk will be an overview of the architecture around ATK and AT-SPI, but I will also show the impact of the accessibility architectures when writing KDE applications. During the tutorial on Sunday afternoon I will show which accessibility features are currently available on the current KDE 3.2."

Comments (none posted)

The final FOSDEM interviews

The final set of FOSDEM interviews has been posted; they are with Gunnar Schmi Dt (KDE accessibility), Ian Formanek (NetBeans), and Tim O'Reilly: "My fundamental premise is that the world we all grew up in -- the world of both Microsoft and the Free Software Foundation -- is fundamentally challenged by the internet. The internet (not linux) is the greatest triumph to date of the open source approach, yet it has changed the rules of software deployment so fundamentally that many of the techniques embraced by the open source community as first principles don't necessarily give the desired results. We need to reinvent open source in the age of the internet. My talk gives some suggestions for what we need to think about."

Comments (none posted)

Resources

Power Upgrades with apt4rpm (Linux Journal)

Mike McCallister writes about apt4rpm in the Linux Journal. "If you've ever had experience with a Debian-based system, you know that keeping a system updated is little more than a command away. The Advanced Packaging Tool (APT) simplifies things immensely. Simply type apt-get update to see what's new and apt-get install package to get it. Is a new version of your distribution out? Type apt-get dist-upgrade, and you're on your way. What many folks don't know is it is indeed possible to have the best of both worlds. Thanks to the magic of free software and a terrific team of Brazilian developers, you can use APT with your RPM-based distribution."

Comments (none posted)

Building PHP Web services with PEAR (devchannel)

DevChannel.org looks at PEAR (PHP Extension and Application Repository). "Once you have installed the PEAR Package Manager you can proceed to installing the necessary PEAR modules for using SOAP in PHP by using the pear install [Module_Name] command. If you execute this command while you have an active connection to the Internet, it will automatically download and install the module in your local environment. If you don't have an active connection, you will need to download the SOAP package for PEAR as well as some prerequisite PEAR modules from http://pear.php.net/packages.php in order to install the SOAP package, including Mail_Mime, Net_URL, HTTP_Request, and Net_DIME."

Comments (none posted)

SpamAssassin Quickstart (Linux Productivity Magazine)

Linux Productivity Magazine is running a set of articles on SpamAssassin in their latest edition. "This issue of Linux Productivity Magazine details Spamassassin: how to install it, how to configure it, and how to use it. No two SpamAssassin installations are alike because of how differently email is handled in different situations. But this issue will guide you through a few of the most common scenarios."

Comments (none posted)

Zope SuperGuide for Newbies

ZopeMag has published a new Zope SuperGuide. "While this SuperGuide is written mainly for beginners, we hope that an occasional nugget of information may also be of help to the more experienced Zope user or developer, for example if he/she needs to learn about Zope Sprinting or the Zope Public License."

Comments (none posted)

Reviews

Cubicleware: Sun's JDS vs. Ximian XD2 (NewsForge)

NewsForge compares the Java Desktop System (JDS) from Sun to Ximian XD2. "Sun's Java Desktop System joins Novell's Ximian XD2 as a tailored GNOME desktop that's aimed at cubicle workers in large enterprise settings, such as government offices and big educational institutions. In the future, Linux will be the desktop used by the most, and the least, computer-literate folks on the planet."

Comments (none posted)

Marcel Gagne: Books Featuring KDE (KDE.News)

KDE.News covers KDE oriented books by Marcel Gagne. "We have a scoop about a new book Marcel is writing. He is finishing his third book which will feature KDE 3.2 as the corporate desktop of choice."

Comments (none posted)

The Secret World of ReiserFS (Yahoo!News)

Yahoo!News looks at ReiserFS and the upcoming Reiser4 release. "Among the early adopters will be Lindows.com, which has a financial relationship with Namesys and is building Reiser4 into the next version of LindowsOS, the desktop operating system. The new version of Lindows will be out sometime in 2004. (LindowsOS currently uses version 3 of ReiserFS.) SuSE Linux and Gentoo also use ReiserFS as their default filesystem." (Thanks to Rich Brown)

Comments (10 posted)

Miscellaneous

Improvements in kernel development (developerWorks)

developerWorks has posted a look at how the kernel development process has changed between 2.4 and 2.6. "Having a live, central repository for the latest changes to the Linux kernel is invaluable. Every change or patch that is accepted into the kernel is tracked as a changeset. End users and developers can keep their own copy of the source repository and update it at will with the latest changesets using a simple command. For developers, this means the ability to always be working with the latest copy of the code."

Comments (none posted)

OSS in Space (Linux Journal)

Linux Journal takes a look at how OSS might have benefited the 1997 Mars Pathfinder mission. "At first glance, this dialogue is merely interesting; I think every hardware and software engineer/tinkerer should read them. On deeper reflection, however, I was struck by something more. Although I assume it was not their intention, the authors quite clearly demonstrate how open-source software (OSS) and the OSS development model would have helped this project enormously, not only in finding the bug but, in all probability, preventing the bug in the first place. The extracts from these e-mails and my comments below should make more sense to you after you've read the original postings."

Comments (3 posted)

Page editor: Forrest Cook

Announcements

Non-Commercial announcements

Finnish Government supports Open Source in South Africa

The Finnish government will fund the use of Midgard in South Africa. "The Finnish government has funded Ungana-Afrika to support Southern African NGOs, which will include the recommendation of appropriate web-site and content management solutions using the Open Source Midgard Content Management System (CMS)."

Full Story (comments: none)

Medical gives FreeB and OpenEMR greenlight (LinuxMedNews)

LinuxMedNews covers the acceptance of the FreeB medical billing system in California. "FreeB the only medical billing system available under the GPL, has just passed a major milestone thanks to the OpenEMR Project. A X12 file generated by FreeB has passed the tests to be accepted by Medical."

Comments (none posted)

Non-Profit Mozilla Europe Group Launches (MozillaZine)

MozillaZine has an announcement for a new non-profit European Mozilla group. "Mozilla Europe aims to promote Mozilla, encourage contributions to project and provide services to stimulate enterprise adoption. The group plans to work with existing Mozilla communities throughout the continent and has the full backing of the Mozilla Foundation, which has designated the nascent organisation as its first international affiliate."

Comments (none posted)

The Open Group's February 12 Teleconference Minutes

The minutes from the February 12, 2004 Open Group teleconference are available.

Full Story (comments: none)

Commercial announcements

Allnet GmbH resolves iptables GPL violation

The Netfilter/iptables project has sent out a press release noting that Allnet GmbH, which had been shipping a couple of routers containing netfilter code but which had not been making source available as required by the GPL, has come to a settlement with the project. Allnet will bring itself into compliance with the GPL; the company will also be making a "significant" donation to the Free Software Foundation Europe and the Foundation for a Free Information Infrastructure.

Full Story (comments: 10)

Aonix Expands Its ObjectAda for Linux Product Line

Aonix has announced the availability of its product line on Linux. "Aonix, a leading provider of Ada 95 software development environments, is pleased to announce the expansion of their Linux product line with the new ObjectAda(R) for Linux cross PowerPC/LynxOS."

Comments (none posted)

Astaro Unveils Configuration Manager for Management of Security Policies on Astaro Firewalls

Astaro has released a new configuration manager. "Astaro (www.astaro.com), makers of the popular Astaro Security Linux, an all-in-one Internet security software appliance, today announced shipping of the Astaro Configuration Manager, a configuration tool that allows users to manage and configure their security policies centrally, automating the provisioning of network security rules on Astaro firewalls and VPNs."

Full Story (comments: none)

BitRock InstallBuilder 1.0 Released

Version 1.0 of BitRock InstallBuilder has been announced. "BitRock InstallBuilder simplifies the installation process of commercial Linux software, helping Independent Software Vendors and custom application developers improve the packaging, distribution and deployment of their products."

Full Story (comments: none)

Grand Central Communications Elects Tim O'Reilly to Board of Directors

Tim O'Reilly has been elected to the Board of Directors of Grand Central Communications, Inc.

Comments (none posted)

Lin---s (Lindash) Program Ensures LindowsOS for all

Lindows.com has announced the "Lin---s" (Lindash) program. In countries where the use of 'Lindows' is no longer allowed, the company has launched a new website at www.lin---s.com.

Comments (none posted)

MailStripper 1.1.4 released

Version 1.1.4 of MailStripper, a commercial spam filter, is available.

Full Story (comments: none)

Red Hat Enterprise Linux Chosen for Electronic Design Automation

Red Hat has announced that it has made inroads into the EDA market. "..Red Hat Enterprise Linux has been selected as the recommended Linux platform for the x86, Itanium 2, and Opteron hardware architectures specified in the Electronic Design Automation (EDA) Operating System Industry Roadmap published by the EDA Consortium. Leading EDA software companies such as Cadence Design Systems, Inc., Mentor Graphics and Synopsys, Inc. have also demonstrated their support for Red Hat by releasing products running on Red Hat Enterprise Linux."

Comments (none posted)

Red Hat Appoints Matrix As Distributor of Its Solutions and Services In Israel

Red Hat has announced the appointment of Matrix as its main Solutions and Services Distributor in Israel.

Comments (none posted)

SCO OpenServer Update Pack 2

For your amusement: the SCO Group has just announced the availability of "OpenServer Update Pack 2." Bleeding-edge features in this update include support for USB devices and the bundling of PostgreSQL. Free software, it seems, is OK if it does not compete with SCO products. The "OpenServer development roadmap" calls for the eventual addition of other advanced features, including Apache and Mozilla.

Comments (13 posted)

New Books

"The Perl CD Bookshelf, Version 4.0" Released by O'Reilly

O'Reilly has published The Perl CD Bookshelf, Version 4.0. ""The Perl CD Bookshelf" keeps all the books Perl programmers have come to rely on right at their fingertips, wherever they may go. Version 4.0 gives them convenient access to their favorite books, traight from their CD-ROM drive."

Full Story (comments: none)

Resources

IBM releases free Q104 Software Evaluation Kit

IBM has released a new Q104 Software Evaluation Kit on two DVDs. "Get the latest DB2, Lotus, Rational, Tivoli, and WebSphere Linux code from IBM on DVD. This is the fastest way to get access to all of IBM middleware that has been ported to Linux."

Full Story (comments: none)

LSB-FHS 2.3 Beta Release Available

The Open Group has announced the beta release of the LSB-FHS test suite for the Filesystem Hierarchy Standard Version 2.3, used to test the filesystem hierarchy aspects of the Linux Standard Base. This release is targeted for testing the LSB 2.x specification release series and is not for use with LSB 1.3 or earlier.

Full Story (comments: none)

Upcoming Events

Real-time and Embedded Systems Workshop CFP

A call for papers has gone out for the Annual Real-time and Embedded Systems Workshop. The event will take place in Washington, DC on July 12 - 15, 2004.

Comments (none posted)

Novell's Chris Stone Will Not Speak at Harvard Feb. 23 - Moglen Will (Groklaw)

Novell's Chris Stone is unable to speak at the Harvard Journal of Law and Technology on February 23, Eben Moglen will take his place. "Due to concerns regarding litigation filed by SCO after our invitation for Mr. Stone to speak was issued, Novell's General Counsel has informed us that Novell Vice Chairman Chris Stone will be unable to come speak to JOLT on Feb 23rd."

Comments (none posted)

OSBC 2004: Major Linux VCs, Users and Legal experts

Open Source Business Conference 2004 debuts March 16 and 17 at the Westin St. Francis in San Francisco. Keynote presentations, panel sessions and speakers from some of the world's leaders in business, law, venture capital and technology assess the financial impact of open source software on global business.

Full Story (comments: none)

PyCon Early Bird Registration Extended

The early bird registration for PyCon 2004 has been extended to February 22.

Comments (none posted)

Invitation to GNU/Linux Summit 2004

The GNU/Linux Summit 2004 Seminar will be held in Helsinki, Finland on February 26 and 27, 2004.

Full Story (comments: none)

Events: February 19 - April 15, 2004

Date	Event	Location
February 20 - 22, 2004	CodeCon 2004	(Club NV)San Francisco, CA
February 20 - 24, 2004	PaWS PHP and Web Standards UK 2004	Manchester, UK
February 21 - 22, 2004	Mozilla Developers Meeting in Europe 4.0	Brussels, Belgium
February 21 - 22, 2004	FOSDEM 2004	(SOLBOSCH)Brussels, Belgium
February 23 - 27, 2004	PostgreSQL Bootcamp	(Big Nerd Ranch, Inc.)Atlanta, GA
February 25 - 26, 2004	UKUUG LISA/Winter Conference and Tutorial	(Lansdowne Campus, Bournemouth Univ.)Bournemouth, UK
February 26 - 27, 2004	GNU/Linux Summit 2004	(Finlandia Hall)Helsinki, Finland
February 27, 2004	Mozilla Developer Day	Mountain View, CA
March 1 - 5, 2004	PHP|Cruise	The Caribbean
March 4 - 5, 2004	Linux Automation Konferenz	Hannover, Germany
March 5, 2004	Perl Workshop 2004	Amsterdam, the Netherlands
March 6 - 7, 2004	Linux-Day Chemnitz	Chemnitz, Germany
March 15 - 17, 2004	Open Source in Government Conference	(George Washington University)Washington, DC
March 16 - 17, 2004	Open Source Business Conference 2004	(The Westin St. Francis)San Francisco, CA
March 18 - 24, 2004	CeBIT	(Hannover Exhibition Center)Hannover, Germany
March 21 - 26, 2004	Novell BrainShare 2004	Salt Lake City, Utah
March 24 - 26, 2004	PyCon DC 2004	Washington, D.C.
March 27 - 28, 2004	Nordic Perl Workshop 2004	(Symbion Science Park)Copenhagen, Denmark
March 27 - 28, 2004	YAPC::Taipei::2004	Taipei, Taiwan
April 5 - 7, 2004	Samba eXPerience 2004	(Hotel Freizeit In)Göttingen, Germany
April 12 - 14, 2004	Samba eXPerience 2004	(Hotel Freizeit In)Göttingen, Germany
April 13 - 15, 2004	Real World Linux 2004 Conference & Expo	(Metro Toronto Convention Centre)Toronto, Ontario, Canada
April 14 - 16, 2004	MySQL Users Conference and Expo 2004	(Peabody Hotel Orlando)Orlando, FL
April 14 - 17, 2004	ACCU Spring Conference 2004	(Randolph Hotel)Oxford, England

Comments (none posted)

Web sites

new Linux Portal and the Linux E-Magazine

The Linuxhotbox E-Magazine is a new Linux portal and online magazine. "The magazine will focus on issues interesting to Linux users and professionals, with Linux news and articles and information regarding to Linux software and distributions."

Full Story (comments: none)

PostgreSQLFr.org launched

PostgreSQLFr.org is new French language web site that is devoted to coverage of the PostgreSQL database.

Full Story (comments: none)

Software announcements

This week's software announcements

Here are the software announcements, courtesy of Freshmeat.net. They are available in two formats:

• Sorted alphabetically,
• Sorted by license.

Comments (none posted)

Page editor: Forrest Cook

Letters to the editor

Firefox browser review -- missing features?

From:		Charles Cazabon <web-letters-lwn.net-AT-discworld.dyndns.org>
To:		LWN Letters <letters-AT-lwn.net>
Subject:		Firefox browser review -- missing features?
Date:		Thu, 12 Feb 2004 07:52:52 -0600

Greetings,
 
I appreciated your front-page review of the various Free web browsers in the
February 12 edition of LWN. I too gave Firefox a try this week, but I think I
must have spent a few more minutes reading the accompanying documentation,
because the various limitations and quirks you mentioned posed no problems for
me.
 
Firefox is intended to be lean and mean -- by your own admission, the
developers have accomplished that, as it is the fastest of the browsers you
tested. To get there, one presumes, they left out some of the features that
bloated the traditional Mozilla browser. However, they made sure that it
would be easy to add specific features back in using lightweight,
user-installable extension modules.
 
Your listed concerns were:
 
> [...] some things are missing. At the top of your editor's list is the
> ability to control image animation.
 
This is the very first control provided by the "Things They Left Out"
extension. It provides a lot of useful preferences settings:
http://extensionroom.mozdev.org/more-info/ttlo
 
> The download manager is a little strange; it provides no way to place a file
> in an arbitrary directory at download time.
 
The regular preferences/options screen includes an "Ask me where to save every
file" option. It's just not the default.
 
> Control-T creates a new tab, as one might expect, but it comes up blank;
> Galeon's practice of bringing up the home page in new tabs seems preferable.
 
The "Tabbrowser Extensions" provides this preference plus a ton of other
tab-related features. I previously hated tabs and disabled them as soon as I
installed any browser, but Firefox (with this extension) has converted me into
a tab user. It's here:
http://extensionroom.mozdev.org/more-info/tbe
 
There are lots of other extensions available, some useful, some less so. I
think it would be safe to say that if you can think of a feature missing from
Firefox, someone else has already thought of it and implemented it as an
extension. Just check
http://extensionroom.mozdev.org/
before complaining :).
 
Charles
--
-----------------------------------------------------------------------
Charles Cazabon <web-letters-lwn.net@discworld.dyndns.org>
-----------------------------------------------------------------------

Comments (none posted)

MSFT Code and BugTraq

From:		Robert J Taylor <rjamestaylor-AT-cox.net>
To:		lwn-AT-lwn.net
Subject:		MSFT Code and BugTraq
Date:		Mon, 16 Feb 2004 11:40:19 -0800

Jonathan,
 
Like you I had and have no desire to see the stolen and revealed Windows
source code. Actually, it makes me ill that this has occurred. But
today I realized that it will be very difficult *not* to see the code --
in snipits, anyway. The reason is that I subscribe to BugTraq.
 
Revelations of vulnerabilities usually are accompanied with proofs of
concept and, when available, analysis of the code in question. Today's
revelation of a bug in bitmap handling (!) in Internet Explorer 5.0 was
accompanied by a supposed (supposedly, because how could I know for
sure?) portion of Internet Explorer's source code.
 
Thus, from illegitimate means surely, begins the cultural assimilation
of Windows source code. Not by me, not by the vigilant, but by the
general programming population.
 
How far do those not wishing to be tainted with knowledge of illicit
code have to go to remain pure? Will BugTraq subscribers now be banned
from Open Source development?
 
This is disastrous and puts Microsoft in a strong position to challenge
everyone involved in every Microsoft-competing project, Open or Closed.
 
Worried,
 
Robert J Taylor

Comments (3 posted)

Please take down or alter this page

From:		Leon Brooks <leon-AT-cyberknights.com.au>
To:		The Meat in the Sandwich <webmaster-AT-sco.com>
Subject:		Please take down or alter this page
Date:		Fri, 13 Feb 2004 08:42:04 +0800
Cc:		Linux Weekly News <letters-AT-lwn.net>, Linux Australia <linux-aus-AT-linux.org.au>

The following page contains a false claim, and several misleading ones:
 
    http://www.thescogroup.com/5reasons/
 
Point 5, "SCO UNIX® is Legally Unencumbered", is a false claim for two
reasons.
 
The first is that Novell actually owns significant portions of it, which
The SCO Group (TSG) are using only under license. Novell group is
currently in litigation with TSG on one hand, and supporting IBM who
are in litigation with TSG on the other.
 
The second is that a number of device drivers from SuSE Enterprise Linux
8 appear to have turned up in UnixWare recently.
 
Point 1, "SCO UNIX® is a Proven, Stable and Reliable Platform" and point
4, "SCO UNIX® is Secure" are misleading in that they tell lies of
omission. It would be less so if the page title were not "5 reasons to
choose UNIX instead of Linux".
 
Linux is proven, stable and reliable: in use in spacecraft, military
applications, testing of jet engines and so on ad infinitum around the
world.
 
One significant feature which contributes to this is that anyone can do
an audit for themselves to verify what has been said, whereas with
TSG's UNIX offerings, one either has to take TSG's word for it, or hope
to negotiate access to code which may or may not be exactly the same as
the code you'd be running day-to-day.
 
Linux is also secure, in fact it can be considerably more secure than
either UnixWare or OpenServer can ever dream. As well as minor security
advantages built into the base system, and options like GRSecurity,
there are significant security benefits to be had in SELinux which are
simply not available in any form on any TSG Unix product.
 
Since I'm speaking to the page anyway, I think it's worth mentioning
that the remaining two points are actually significant disadvantages.
 
"SCO UNIX® is backed by a single, experienced vendor" is slightly
misleading as well, since TSG is not the Santa Cruz Operation which has
accumulated all of the experience in question.
 
That aside, a single vendor is a major disadvantage for two major
reasons, the first being that you open yourself to control by that
vendor, and the second being that when IBM's lawyers have finished
turning TSG into a greasy spot on the corporate bitumen, where does one
turn for UnixWare support?
 
"SCO UNIX® has a Committed, Well-Defined Roadmap" implies that TSG have
their own ideas about where they're taking their Unix, whereas a
product without a rigid roadmap is much more open to control (as "our
Unix") and customisation by the purchasers.
 
In other words, an inflexible roadmap locks customers out of the
development cycle to some degree, which is likely to result in a
product less well suited to their needs.
 
Cheers; Leon
 
--
http://cyberknights.com.au/ Modern tools; traditional dedication
http://plug.linux.org.au/ Vice President, Perth Linux User Group
http://slpwa.asn.au/ Committee Member, Linux Professionals WA
http://linux.org.au/ Past Committee Member, Linux Australia

Comments (2 posted)

Page editor: Jonathan Corbet