LWN.net Weekly Edition for May 6, 2004

The Grumpy Editor's guide to diagram editors

Let it be said up front: your editor is not an artist. He is, however, given to the creation of simple diagrams for the explanation of data structures, algorithms, etc. See, for example, the diagram to the right, which comes from the kobject introduction in the Driver Porting Series. These images can be a useful form of hand waving when complex subjects are being discussed.

Back in the Golden Age of Proprietary Unix (around SunOS 3 or 4, say), there weren't a whole lot of tools available for image editing. If you youngsters out there want to get a feel for how desperate those times could be, consider this: we often had to resort to tools like the LaTeX picture mode to create drawings in digital form. Happily, things have gotten better since then.

Things aren't enough better, however, that your editor has stopped keeping an eye out for a better tool. This article is an attempt at summarizing the current state of the art in free drawing editors. The emphasis here is very much on the creation of diagrams and technical drawings; we'll not be looking for the best tool for the creation of birthday party invitations, pneumatic science fiction art, obnoxious animated banner ads, or beautiful but incomprehensible icons. Your editor is trying to get some work done and needs a diagram editor which doesn't drive him nuts.

idraw

For the first stop, we might as well complete the history lesson. Back in the early days of X11, there were many efforts to produce The One Toolkit which would unify the desktop. Actually, that situation hasn't changed a whole lot in 15 years. One of the early efforts was a C++ framework called InterViews. InterViews failed to change the world directly, though many of its ideas and lessons have lived on in the design patterns community and in projects like Fresco.

InterViews did, however, produce a drawing tool named idraw, which, for years, was the definitive free drawing package. It combined full functionality (for the time) with a well-thought-out interface and a nice set of keyboard shortcuts. Creating drawings with idraw was a quick and painless process. idraw stored its output as PostScript files, making the drawings easy to print and the quality relatively good.

One might think that idraw's day has passed, given that the InterViews team has not produced a release in over ten years. As it turns out, however, there is a project (called ivtools) which is dedicated to the maintenance and improvement of the InterViews toolkit and associated tools. Releases are rare, but ivtools-1.0.4 came out last February. That said, the simple fact is that idraw's time has passed. This program has had little in the way of development for over a decade, it can't export to interesting image file formats, it has no concept of layers, it depends on a large toolkit that nobody uses, and it is a major unpleasant pain to install. InterViews was an important step toward where we are today, but even a grumpy editor sees the need to move beyond the 1980's and look at what is being hacked on now.

XFig

Another tool with a long history is XFig. It shows many of the distinguishing characteristics of an early X11 program (though it actually had its start with SunView): home-brewed widgets, unique keyboard and mouse conventions, etc. It is, however, a highly capable tool. XFig supports most of the features one would expect from this sort of utility, though they can sometimes be hard to find. It has a sort of layer support (it works by assigning a numeric "depth" to every object), can export to any format one could imagine, allows the creation of libraries of customized objects, etc. XFig understands attachment points: when told to, it will stretch lines which connect objects to each other to keep those connections when an object is moved.

On the down side, XFig can only undo the most recent operation. Its keyboard shortcuts are like those of no other application, and will take some getting used to. The interface is highly modal; XFig's window includes an area saying what the three mouse buttons will do at any given time for a reason. Grouping objects, for example, requires selecting the group "tool," selecting individual objects with the left button or picking the corners of rectangles with middle button, then completing the operation with the right button. Your editor's biggest problem with XFig, however, is the quality of its image output. He might not be an artist, but he would still rather see his work rendered with nice fonts and antialiased lines. XFig's output prints nicely, but does not work as well on the web; given that XFig is oriented toward tasks like the production of complicated circuit diagrams, that is not entirely surprising.

Tgif

Tgif boasts a release history going back to 1990; recent releases appear to be coming about once per year. This tool resembles XFig in a number of ways; it, too, features home-brew widgets and a unique interface. Tgif does have a more conventional set of keyboard bindings, at least; Control-S will save the current file, for example. Tgif's interface includes a sort of control panel where one can spend a long time cycling through the various options (font sizes, colors, fill patterns, etc.); fortunately, the menus provide a quicker way of setting these attributes. Attachments are supported, making the rearranging of diagrams easy.

Tgif does not support layers, which is a major disadvantage. Actually, that is not quite true: it does have a "color layers" mode where each color is rendered into a separate layer. This mode may be useful for certain types of printed output, or for certain types of drawings (schematic diagrams, perhaps) where objects in different colors really should be separated. Tgif also allows drawings to have multiple pages; among other things, these can be used to create animated GIF images. Your editor would gladly trade both capabilities for a decent layering mechanism.

Tgif has a set of image editing functions that might have been better left to the Gimp. What it does not have, alas, is antialiased image output. Actually, exporting to images is strange in general; one must set the "print format" to the desired image format, then "print" the diagram. The image will be created without prompting for a name, and without regard to any file which may have already existed with the chosen name. Documentation for Tgif is sparse as well.

OpenOffice.org

OpenOffice.org comes with a drawing tool which has been getting more capable over time. As one might expect, it has almost every function imaginable, including 3D effects, a library of tiled background images, attachments, etc. OpenOffice may well be the only free drawing editor which performs spell-checking. It supports layers, though the interface to layers is clunky at best. Your editor must confess that OpenOffice tends to drive him nuts. It can reset drawing attributes at unexpected times, it never remembers what image format you exported to, and it is generally not the fastest application on the processor. OpenOffice is a sort of Swiss Army Knife; it can perform almost any function, but, for any given function, it tends not to perform as well as a more focused tool.

OpenOffice will export to an unbelievable number of formats, including (perhaps uniquely) PDF. When your editor exported to PNG, however, he got the same old jagged lines. OpenOffice also exports a full page image, while most other drawing editors will create an image which fits the drawing.

All of the above notwithstanding, OpenOffice.org's editor is a worthwhile addition to the Linux desktop.

Karbon14

Once upon a time, KDE had a program called Killustrator. The name ran into trademark problems, which were circumvented by renaming the tool "Kontour." But then the developers stopped working on Kontour, and that problem proved harder to get around. So now, instead, the KDE project is pushing a tool called Karbon14; it can be found in KDE 3.2.

Karbon14 appears to be aimed at more artistic uses; it thus lacks some of the features (snap to grid, attachments, arrow drawing) which are useful for diagram creation. On the other hand, it has tools for drawing gradients and drop shadows, as well as more dubious features like the "star" and "spiral" tools. Karbon supports layers, but seems to want to put every object into its own layer. It has a multi-level undo feature. There is also a plugin mechanism for the addition of special effects.

Unfortunately, what Karbon14 also has is lots of bugs. Your editor, who tried both the Fedora Core 2 Test 3 and Debian unstable builds, found the tool easy to crash. The "zoom tool" can put it into an infinite loop. Drawing polylines can produce hallucinogenic results. Text drawing was never seen to work on either system. An attempt to export to PNG yielded a solid black image - that is one way to get rid of aliasing problems, but the results are not very helpful for web publication.

In all fairness, one should note that Karbon14 is currently at version 0.1. This tool has the potential to evolve into a capable, highly-featured drawing editor. But it's not yet ready for a grumpy editor's desktop.

Dia

GNOME's entry in the diagram editor category is dia. This tool, currently at version 0.93 (released without fanfare on May 1), has been no stranger to obnoxious bugs in the past, but it has stabilized nicely over the last year or so. It is, at the moment, your editor's diagram editor of choice.

Dia is clearly oriented toward the creation of diagrams. It has snap-to-grid, layers, attachments, and several libraries of objects for schematics, flowcharts, UML diagrams, etc. On the other hand, it lacks gradient editors, 3D swirl generators, shadows, and fancy background clip-art. Dia does beautiful antialiasing, both on-screen and in image exports. On the other hand, control of object attributes is inconsistent and sometimes hard to find. Rectangle filling is controlled by double-clicking on the rectangle tool icon; control of arrowhead dimensions is, instead, obtained by selecting "details" at the end of a long list of possible arrow types. Alignment and grouping operations require navigating through a series of cascading menus; some keyboard shortcuts would be nice here.

Dia also has a reasonably comprehensive set of configuration options, which is always a nice surprise in a GNOME application. For example, it is possible to turn off the "switch back to the select tool after every operation" mode that seems to be so popular in modern interfaces, but which your editor finds obnoxious. Dia features a Gimp-style right-button menu which provides access to everything, but that menu can be replaced with a toolbar by tweaking the appropriate preference.

In conclusion...

A few other packages are worth a quick mention:

• Xdraft looks like an attempt to make a serious free drafting application. Unfortunately, it also looks like it has gone idle over the last year.

• Sodipodi is a well-advanced vector drawing package. It is aimed more at artists than creators of cheap diagrams, however, so it has not been reviewed in detail here.

• If you wander deeply enough into the Gimp's menus, you'll find GFig, which appears to be an attempt to graft some vector drawing operations into that utility. GFig may work for adding certain effects to images, but it still doesn't turn the Gimp into a drawing editor; the Gimp has many strengths, but this is not one of them.

As this survey shows, the free software community offers a wealth of diagram editing tools. Many of them have reached a reasonable level of maturity though, like people, they are aging in different ways. These applications are seeing substantial development and are evolving quickly. Before long, the community should have some of the best tools available anywhere. Grumpy creators of hand-waving diagrams everywhere should rejoice.

Comments (58 posted)

Fighting software patents: a report from Brussels

"Power to the Parliament" is not a typical slogan for any demonstration, but when the demonstrators are predominantly young businessmen and programmers, you can be sure something new is happening. In response to legislation concerning software patents, hackers and entrepreneurs across the EU, and in nations just joining the EU, have come together first to convince Parliament of their cause, and now to defend Parliament against the European Commission and Council. Last week saw a demonstration and a series of conferences that mark a watershed in the political organization and awareness among the members of this new movement; GNU/Linux user groups, hackers from MPlayer, consultants from MySQL, activists from the FFII, UKCDR, APRIL, FSF Europe and more hackers, journalists and bemused bystanders met to talk not about code but about politics, and without any trolls in sight.

First, a little background for context. Last year saw the Foundation for a Free Information Infrastructure's (FFII) campaign against software patents take center stage in the hacker world as the European Parliament began to debate the issue. After frenzied lobbying in late August and September, an amended piece of legislation was passed, explicitly banning software patents.

But the victory was short-lived, as the European Council and Commission took the bill and published their interpretation, removing all of the amendments the anti-software patent activists fought so hard for. A lot of EU legislation goes through this sort of complex procedure, known as "co-decision", where the legislative and executive branches both develop the legislation.

On the morning of Wednesday, April 14, a demonstration launched two days of protests and discussion to counter the Council and Commission's position. The demonstration itself was a visual but low-key event, with between 500 and 800 people marching around Brussels with yellow balloons, banners and a few sandwich boards. The march culminated with a pantomime outside the European Commission, satirizing the Commission's tendency to listen to big business (principally Nokia) rather than Small and Medium Enterprises and individuals; there was also a human chain and an en-mass balloon release.

Almost as soon as it had finished, we entered the European Parliament for the conference on software patents, organized by the FFII and the International Institute of Infonomics. The purpose of the conference was to bring key activists, MEPs and experts together to continue the discussion of software patents in Europe, and to try to measure the effects of the two competing legislations (Parliament's and the Council's).

The first panel, discussing "Recent Developments in Granting and Use of ICT Patents", gave software patent experts, business owners and activists a chance to clarify the extent of patent granting and the effects it has already had on business in Europe. The presentations were informative, though not controversial for the majority of the participants; they indicated that approximately 20,000 software patents have been granted in Europe, and that, though unenforceable, they have already done considerable damage to many small businesses. Most of the problems seemed to be caused by companies needing to file software patents as a means of defense against litigation, and to counter other companies' patent portfolios.

The second panel, discussing "EU Legislation Benchmarking: Parliament's vs Council's version of Software Patent Directive" was perhaps more interesting. Sitting next to anti-software patent law scholars and activists were representatives from the European Commission and the European Patent Office (EPO). The law scholars and activists described, from an academic rather than a pragmatic point of view, why software is un-patentable, and why the software industry doesn't even need them. Then we listened to the EPO claim that they didn't file any software patents, and that they saw the legislation as a clarifying exercise, and the Commission claim, with little substantial argument or empirical evidence, that their legislation would help the industry. Commission representatives also implied, amazingly, that the legislative process in this case ought to aim to settle the issue soon rather than take the time to approach the problem more carefully.

The third and final panel discussed "Competitivity of Knowledge Economies", and gave MEPs and economists the chance to present their views on where software patents lie in the broader picture of Europe's "ICT economy". Moving away from arguments about software patents per se, they presented various analyses of how European industry might lose out in the future if software patents were introduced.

The next day, we attended a second conference, organized by the FFII and the Green-EFA Alliance, focusing on the place of free software in Europe in general. The day opened at 9am with a series of presentations from GNU/Linux User Groups (G/LUGs) from around Europe, explaining to the many MEPs, Parliamentary assistants and other outsiders what G/LUGs are, what they do, what free software is, and how the free software community works. In contrast to the previous day's conference, there was a good opportunity for discussion, and many activists got the opportunity to discuss how G/LUGs can improve their relationships with each other, and with the EU.

Following this, there was a rather anarchic installfest. Various MEPs had Mandrake Linux installed on their PCs, while the rest of the conference's participants milled around talking to each other, and in my case, phoning more MEPs for meetings.

The conference reconvened after lunch, for three more panels. The first was on "Fair Use / Copie Privée, and proved, for the geeks in the room, far more familiar. A lawyer from the EFF, Jon Lech Johansen (DeCSS) and a lawyer from Test-Achat, a Belgian civil rights group, discussed with the floor the state of "fair use" law within the EU, touching on DVDs, audio CDs and DRM in general. Aside from general discussion, we were treated to a brief exchange between the EFF and a person defending Blizzard's case against bnetd.

The second and third panels continued in much the same vein, discussing free and open source software in Europe. The afternoon produced a growing consensus that we ought to be pushing for Free Software in the public sector across Europe far harder, and seemed to bolster the support from MEPs. By the end of the conference, most seemed considerably more excited by the future than before.

But aside from the many discussions, it is important to ask: what did the two days achieve? We cannot defeat the European Commission and Council over software patents, and place Free Software at the heart of Europe's ICT economy, with words alone. Fortunately, though no major tangible breakthroughs were made, the community came away with a lot of substantial work done, and some good plans for the future.

G/LUGs across Europe, through Eurolinux and the FFII's mailing lists, will be drafting strategies to work together to promote Free Software more effectively, drawing on each others' successes. A first draft of such a document was written during the conference, and translated into two or three languages by willing hackers. The FFII is now leading a project tentatively called the MEP Toolbox, to develop a comprehensive database of MEP's positions on important digital rights issues, and an accompanying lobbying guide for inexperienced hackers. And, as a personal measure of its success, during the recent Linux User & Developer Expo in London, the FFII-UK, the UKCDR and the AFFS got their heads together (one of which being mine) to work out a more effective strategy of cooperation and campaigning.

So long as the enthusiasm can be maintained, and promises and ideas developed in Brussels can be turned into concrete deeds, the future in Europe certainly looks a lot brighter than it did a few weeks ago. We may have the beginnings of a Europe-wide movement that can effectively tackle digital rights issues, and push Free Software. We just need to ensure we don't renege on our promises.

Comments (12 posted)

Page editor: Jonathan Corbet

Security

82% of email is spam

According to this eSecurity Planet article, 82% of all email which was sent in April was spam. That is the highest level ever measured - so far. Informal measurements here at LWN suggest that the 82% figure could even be a little low; some of our accounts here are receiving well over 1200 spams per day.

The cost of this endless stream of garbage is eventually going to push some part of the system to the breaking point. And the results may not be good. As the spam problem gets worse, most email users will be willing to accept almost anything from their ISPs or legislators which promises to improve things. It would not be surprising to see power grabs coming from several directions as the usual cynical forces try to take advantage of the situation. Are we ready for a world of centralized email systems, proprietary protocols which limit bulk mailing to "authorized" merchants, and new laws giving governments power to monitor and restrict email content?

If we're not ready for those things, we're going to have to think again about how to fight this problem. Filtering can be highly effective, but it does little for many of the costs of spam, including bandwidth usage and compromised servers. Filtering also does not work for all users. Somehow, a way must be found to keep spammers and their output off the net. If we can't come up with a way to do that which preserves the freedoms that have made the net what it is, we're likely to see rather less palatable attempted solutions imposed by others.

Comments (54 posted)

New vulnerabilities

eterm: command execution

Package(s):	eterm	CVE #(s):	CAN-2003-0068
Created:	April 29, 2004	Updated:	May 5, 2004
Description:	eterm has a vulnerability in which escape codes can be inserted by an attacker to cause the user to execute malicious commands.
Alerts:	Debian DSA-496-1 2004-04-29

Comments (none posted)

flim: insecure file creation

Package(s):	flim	CVE #(s):	CAN-2004-0422
Created:	May 5, 2004	Updated:	December 16, 2004
Description:	The emacs "flim" mode creates temporary files in an insecure fashion, possibly allowing a local attacker to overwrite files.
Alerts:	Fedora FEDORA-2004-546 2004-12-15 Red Hat RHSA-2004:344-01 2004-08-18 Debian DSA-500-1 2004-05-01

Comments (none posted)

kolab: password disclosure

Package(s):	kolab	CVE #(s):
Created:	May 5, 2004	Updated:	May 27, 2004
Description:	Kolab stores passwords in plain text format, and these passwords can read from the underlying LDAP database. See this advisory for more information.
Alerts:	Mandrake MDKSA-2004:052 2004-05-26 OpenPKG OpenPKG-SA-2004.019 2004-05-05

Comments (3 posted)

LHA: stack buffer overflows and directory traversal flaws

Package(s):	LHA	CVE #(s):	CAN-2004-0234 CAN-2004-0235
Created:	April 30, 2004	Updated:	June 11, 2004
Description:	LHA is an archiving and compression utility for LHarc format archives. Ulf Harnhammar discovered two stack buffer overflows and two directory traversal flaws in LHA. See this advisory+patch for more details. CAN-2004-0234: An attacker could exploit the buffer overflows by creating a carefully crafted LHA archive in such a way that arbitrary code would be executed when the archive is tested or extracted by a victim. CAN-2004-0235: An attacker could exploit the directory traversal issues to create files as the victim outside of the expected directory.
Alerts:	Whitebox WBSA-2004:178-01 2004-06-10 Debian DSA-515-1 2004-06-05 Red Hat RHSA-2004:178-01 2004-05-26 Fedora FEDORA-2004-119 2004-05-11 Gentoo 200405-02 2004-05-09 Conectiva CLA-2004:840 2004-05-06 Slackware SSA:2004-125-01 2004-05-04 Red Hat RHSA-2004:179-01 2004-04-30

Comments (2 posted)

libpng: denial of service vulnerability.

Package(s):	libpng	CVE #(s):	CAN-2004-0421
Created:	April 29, 2004	Updated:	June 11, 2004
Description:	The PNG library can accesses memory that is out of bounds when creating an error message, this can be exploited by a malformed PNG image file.
Alerts:	Whitebox WBSA-2004:180-01 2004-06-10 Red Hat RHSA-2004:180-01 2004-05-19 Gentoo 200405-06 2004-05-14 Fedora FEDORA-2004-106 2004-05-05 Fedora FEDORA-2004-105 2004-05-05 Slackware SSA:2004-124-04 2004-05-02 Red Hat RHSA-2004:181-01 2004-04-30 Trustix TSLSA-2004-0025 2004-04-30 Debian DSA-498-1 2004-04-30 Mandrake MDKSA-2004:040 2004-04-29 OpenPKG OpenPKG-SA-2004.017 2004-04-29

Comments (none posted)

mc: multiple vulnerabilities

Package(s):	mc	CVE #(s):	CAN-2004-0226 CAN-2004-0231 CAN-2004-0232
Created:	April 29, 2004	Updated:	May 26, 2004
Description:	Midnight Commander has multiple vulnerabilities including buffer overflows, insecure temp files, and format string problems.
Alerts:	Gentoo 200405-21 2004-05-26 Red Hat RHSA-2004:172-01 2004-05-19 Slackware SSA:2004-136-01 2004-05-14 SuSE SuSE-SA:2004:012 2004-05-14 Red Hat RHSA-2004:173-01 2004-04-30 Mandrake MDKSA-2004:039 2004-04-29 Debian DSA-497-1 2004-04-29

Comments (none posted)

proftpd privilege escalation

Package(s):	proftpd	CVE #(s):
Created:	April 30, 2004	Updated:	May 19, 2004
Description:	A portability workaround was applied in version 1.2.9 of the FTP server ProFTPD. As a side-effect, CIDR based (aaa.bbb.ccc.ddd/NN) ACL entries in "Allow" and "Deny" directives act like an "AllowAll" directive and so FTP clients are granted access to files and directories although the server configuration might explicitly deny this. See this bug report.
Alerts:	Gentoo 200405-09 2004-05-19 Mandrake MDKSA-2004:041 2004-04-30 OpenPKG OpenPKG-SA-2004.018 2004-04-30

Comments (none posted)

rsync remote file write attack

Package(s):	rsync	CVE #(s):	CAN-2004-0426
Created:	April 30, 2004	Updated:	July 12, 2004
Description:	See the rsync homepage for the April 2004 advisory: "There is a security problem in all versions prior to 2.6.1 that affects only people running a read/write daemon WITHOUT using chroot. If the user privs that such an rsync daemon is using is anything above "nobody", you are at risk of someone crafting an attack that could write a file outside of the module's "path" setting (where all its files should be stored). Please either enable chroot or upgrade to 2.6.1. People not running a daemon, running a read-only daemon, or running a chrooted daemon are totally unaffected."
Alerts:	Gentoo 200407-10 2004-07-12 Fedora FEDORA-2004-116 2004-07-01 Whitebox WBSA-2004:192-01 2004-06-10 Debian DSA-499-2 2004-06-02 OpenPKG OpenPKG-SA-2004.025 2004-05-21 Red Hat RHSA-2004:192-01 2004-05-19 Mandrake MDKSA-2004:042 2004-05-10 Slackware SSA:2004-124-01 2004-05-02 Debian DSA-499-1 2004-05-01 Trustix TSLSA-2004-0024 2004-04-29

Comments (none posted)

samba: local root and symlink vulnerabilities

Package(s):	samba	CVE #(s):
Created:	April 29, 2004	Updated:	May 5, 2004
Description:	Two vulnerabilities in Samba have been found. Smbfs has a setuid root exploit problem, and smbprint has a tempfile symlink vulnerability.
Alerts:	Netwosix NW-2004-0013 2004-05-01 Gentoo 200404-21 2004-04-29

Comments (none posted)

sysklogd: heap overflow

Package(s):	sysklogd	CVE #(s):
Created:	April 29, 2004	Updated:	May 5, 2004
Description:	Sysklogd has a memory allocation vulnerability that can allow a malicious attacker to write to unallocated memory and crash sysklogd.
Alerts:	Slackware SSA:2004-124-02 2004-05-02 Mandrake MDKSA-2004:038 2004-04-28

Comments (none posted)

xine-lib: malicious code execution

Package(s):	xine-lib	CVE #(s):	CAN-2004-0433
Created:	May 3, 2004	Updated:	May 28, 2004
Description:	A vulnerability exists in xine-lib where playing a specially crafted Real RTSP stream could run malicious code as the user playing the stream. More details can be found in this advisory. The problem has been fixed in xine-lib 1-rc4.
Alerts:	Gentoo 200405-24 2004-05-28 Slackware SSA:2004-124-03 2004-05-02

Comments (none posted)

Updated vulnerabilities

apache - denial of service in mod_ssl

Package(s):	apache	CVE #(s):	CAN-2004-0113
Created:	April 13, 2004	Updated:	May 25, 2004
Description:	A memory leak has been discovered in mod_ssl that may be triggered by sending normal HTTP requests to the Apache HTTPS port. An attacker can exploit this vulnerability to consume all memory available in the server, thus causing a denial of service condition. This problem has been fixed in Apache 2.0.49.
Alerts:	Fedora FEDORA-2004-117 2004-05-25 Mandrake MDKSA-2004:043 2004-05-10 Red Hat RHSA-2004:182-01 2004-04-30 Conectiva CLA-2004:839 2004-04-13

Comments (none posted)

cvs: client-side file overwrite vulnerability

Package(s):	cvs	CVE #(s):	CAN-2004-0180
Created:	April 14, 2004	Updated:	May 18, 2004
Description:	The cvs client is vulnerable to a pathname vulnerability which can allow a hostile server to overwrite files on the local system. The cvs server is subject to a similar vulnerability which allows the checkout of RCS archives anywhere on the server system. Versions 1.11.15 and 1.12.7 fix the problem.
Alerts:	Fedora FEDORA-2004-110 2004-04-22 Whitebox WBSA-2004:153-01 2004-04-19 Slackware SSA:2004-108-02 2004-04-17 Netwosix NW-2004-0011 2004-04-18 Debian DSA-486-1 2004-04-16 Gentoo 200404-13 2004-04-14 OpenPKG OpenPKG-SA-2004.013 2004-04-14 Red Hat RHSA-2004:153-01 2004-04-14 Red Hat RHSA-2004:154-01 2004-04-14 SuSE SuSE-SA:2004:008 2004-04-14 Mandrake MDKSA-2004:028 2004-04-14

Comments (none posted)

ethereal - multiple vulnerabilities

Package(s):	ethereal	CVE #(s):	CAN-2004-0176 CAN-2004-0365 CAN-2004-0367
Created:	March 29, 2004	Updated:	June 2, 2004
Description:	There are multiple vulnerabilities in versions of Ethereal earlier than 0.10.3. More information can be found in this advisory from ethereal.com and in this Eye on Security advisory.
Alerts:	Debian DSA-511-1 2004-05-30 OpenPKG OpenPKG-SA-2004.015 2004-04-16 Red Hat RHSA-2004:137-01 2004-03-31 Mandrake MDKSA-2004:024 2004-03-30 Conectiva CLA-2004:835 2004-03-31 Red Hat RHSA-2004:136-01 2004-03-30 Netwosix NW-2004-0007 2004-03-29 Gentoo 200403-07 2004-03-28

Comments (none posted)

Filename disclosure vulnerability in fam

Package(s):	fam	CVE #(s):	CAN-2002-0875
Created:	August 19, 2002	Updated:	January 5, 2005
Description:	"fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible.
Alerts:	Red Hat RHSA-2005:005-01 2005-01-05 Debian DSA-154-1 2002-08-15

Comments (none posted)

gtkhtml: malformed messages cause crash

Package(s):	gtkhtml	CVE #(s):	CAN-2003-0133 CAN-2003-0541
Created:	April 14, 2003	Updated:	April 18, 2005
Description:	GtkHTML is the HTML rendering widget used by the Evolution mail reader. GtkHTML supplied with versions of Evolution prior to 1.2.4 contain a bug when handling HTML messages. Alan Cox discovered that certain malformed messages could cause the Evolution mail component to crash.
Alerts:	Debian DSA-710-1 2005-04-18 Mandrake MDKSA-2003:093 2003-09-18 Conectiva CLA-2003:737 2003-09-12 Red Hat RHSA-2003:264-01 2003-09-09 Mandrake MDKSA-2003:046 2003-04-15 Red Hat RHSA-2003:126-01 2003-04-14

Comments (none posted)

ident2 buffer overflow

Package(s):	ident2	CVE #(s):	CAN-2004-0408
Created:	April 22, 2004	Updated:	April 28, 2004
Description:	Jack <jack -AT- rapturesecurity.org> discovered a buffer overflow in ident2, an implementation of the ident protocol (RFC1413), where a buffer in the child_service function was slightly too small to hold all of the data which could be written into it. This vulnerability could be exploited by a remote attacker to execute arbitrary code with the privileges of the ident2 daemon (by default, the "identd" user).
Alerts:	Debian DSA-494-1 2004-04-21

Comments (none posted)

iproute: local denial of service

Package(s):	iproute net-tools	CVE #(s):	CAN-2003-0856
Created:	November 25, 2003	Updated:	December 14, 2004
Description:	The iproute utility is susceptible to spoofed netlink messages sent by local users, with the result that denial of service attacks are possible.
Alerts:	Mandrake MDKSA-2004:148 2004-12-13 Fedora FEDORA-2004-154 2004-06-03 Fedora FEDORA-2004-115 2004-05-11 Debian DSA-492-1 2004-04-18 Gentoo 200404-10 2004-04-09 Red Hat RHSA-2003:316-01 2003-11-24

Comments (none posted)

racoon: failure to verify signatures

Package(s):	ipsec-tools racoon	CVE #(s):	CAN-2004-0155
Created:	April 7, 2004	Updated:	August 19, 2004
Description:	Versions of ipsec-tools prior to 0.2.5 contain a vulnerability wherein the racoon utility fails to verify digital signatures on some packets. This hole can lead to unauthorized connections or man-in-the-middle attacks. See this advisory for details.
Alerts:	Whitebox WBSA-2004:308-01 2004-08-19 Mandrake MDKSA-2004:027 2004-04-08 Gentoo 200404-05 2004-04-07

Comments (none posted)

racoon: denial of service vulnerability

Package(s):	ipsec-tools racoon iputils	CVE #(s):	CAN-2004-0403
Created:	April 26, 2004	Updated:	July 29, 2004
Description:	racoon does not check the length of ISAKMP headers. Attackers may be able to craft an ISAKMP header of sufficient length to consume all available system resources, causing a Denial of Service. This advisory contains additional details.
Alerts:	Red Hat RHSA-2004:308-01 2004-07-29 Mandrake MDKSA-2004:069 2004-07-14 Fedora FEDORA-2004-197 2004-06-28 Whitebox WBSA-2004:165-01 2004-06-10 Fedora FEDORA-2004-132 2004-05-19 Red Hat RHSA-2004:165-01 2004-05-11 Gentoo 200404-17 2004-04-24

Comments (none posted)

kdelibs: cookie disclosure

Package(s):	kdelibs	CVE #(s):	CAN-2003-0592
Created:	March 10, 2004	Updated:	August 24, 2004
Description:	kdelibs (and, thus, Konqueror) has a vulnerability where a hostile server can force the disclosure of cookies that should not be presented to it. KDE versions 3.1.3 and later contain a fix.
Alerts:	Gentoo 200408-23 2004-08-24 Red Hat RHSA-2004:074-01 2004-03-10 Red Hat RHSA-2004:075-01 2004-03-10 Mandrake MDKSA-2004:022 2004-03-10 Debian DSA-459-1 2004-03-10

Comments (none posted)

kdepim: VCF file information reader vulnerability

Package(s):	kdepim	CVE #(s):	CAN-2003-0988
Created:	January 15, 2004	Updated:	May 26, 2004
Description:	KDE has issued a security advisory for all versions of kdepim as distributed with KDE versions 3.1.0 through 3.1.4 inclusive. A carefully crafted .VCF file potentially enables local attackers to compromise the privacy of a victim's data or execute arbitrary commands with the victim's privileges. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0988 to this issue.
Alerts:	Fedora FEDORA-2004-133 2004-05-19 Gentoo 200404-02 2004-04-06 Whitebox WBSA-2004:005-01 2004-02-12 Conectiva CLA-2004:810 2004-01-20 Slackware SSA:2004-014-01 2004-01-14 Mandrake MDKSA-2004:003 2004-01-14 Red Hat RHSA-2004:006-01 2004-01-07

Comments (none posted)

kernel: symlink overflow in the iso9660 filessytem

Package(s):	kernel	CVE #(s):	CAN-2004-0109
Created:	April 14, 2004	Updated:	July 15, 2004
Description:	The 2.4 and 2.6 kernels contain a vulnerability in the iso9660 (CDROM) filesystem which can be used by a local attacker to obtain root privileges. The exploit requires creating a specially-crafted filesystem and getting the kernel to mount it. Many systems are configured to automatically mount CDs on insertion, however, so the possibility of this vulnerability being exploited by users with physical access to the system is real. The 2.4.26 kernel contains the fix, which will also be merged into the upcoming 2.6.6 release.
Alerts:	Conectiva CLA-2004:846 2004-07-15 Red Hat RHSA-2004:106-01 2004-04-21 Red Hat RHSA-2004:105-01 2004-04-21 Debian DSA-489-1 2004-04-17 Debian DSA-491-1 2004-04-17 Debian DSA-479-2 2004-04-14 SuSE SuSE-SA:2004:009 2004-04-14 Mandrake MDKSA-2004:029 2004-04-14 Fedora FEDORA-2004-101 2004-04-14 Debian DSA-482-1 2004-04-14 Debian DSA-481-1 2004-04-14 Debian DSA-480-1 2004-04-14 Debian DSA-479-1 2004-04-14

Comments (none posted)

kernel - root exploit in MCAST_MSFILTER

Package(s):	kernel	CVE #(s):	CAN-2004-0424
Created:	April 22, 2004	Updated:	June 11, 2004
Description:	A locally exploitable integer overflow has been found the multicast code of the Linux kernel versions 2.4.22 to 2.4.25 and 2.6.1 - 2.6.3. A successful exploit could lead to full superuser privileges.
Alerts:	Whitebox WBSA-2004:183-01 2004-06-10 SuSE SuSE-SA:2004:010 2004-05-05 Slackware SSA:2004-119-01 2004-04-28 Mandrake MDKSA-2004:037 2004-04-27 Red Hat RHSA-2004:183-01 2004-04-22 Fedora FEDORA-2004-111 2004-04-22 Trustix TSLSA-2004-0022 2004-04-21

Comments (1 posted)

Linux kernel 2.2.10 failing function and TLB flush vulnerability

Package(s):	kernel-source-2.2.10	CVE #(s):	CAN-2004-0077
Created:	March 18, 2004	Updated:	June 4, 2004
Description:	A local root exploit is possible due to early flushing of the TLB.
Alerts:	Debian DSA-514-1 2004-06-04 Debian DSA-466-1 2004-03-18

Comments (none posted)

kernel-utils: setuid vulnerability

Package(s):	kernel-utils	CVE #(s):	CAN-2003-0019
Created:	February 7, 2003	Updated:	January 21, 2005
Description:	The kernel-utils package contains several utilities that can be used to control the kernel or machine hardware. In Red Hat Linux 8.0 this package contains user mode linux (UML) utilities. The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was incorrectly shipped setuid root. This could allow local users to control certain network interfaces, add and remove arp entries and routes, and put interfaces in and out of promiscuous mode. All users of the kernel-utils package should update to these packages that contain a version of uml_net that is not setuid root. Alternatively, as a work-around to this vulnerability issue the following command as root: chmod -s /usr/bin/uml_net
Alerts:	Red Hat RHSA-2003:056-08 2003-02-07

Comments (none posted)

LCDproc: Buffer overflows and format string vulnerabilities

Package(s):	LCDproc	CVE #(s):
Created:	April 27, 2004	Updated:	April 28, 2004
Description:	Due to insufficient checking of client-supplied data, the LCDd server is susceptible to two buffer overflows and one string buffer vulnerability. If the server is configured to listen on all network interfaces (see the Bind parameter in LCDproc configuration), these vulnerabilities can be triggered remotely.
Alerts:	Gentoo 200404-19 2004-04-27

Comments (none posted)

libpng, libpng3: buffer overflow

Package(s):	libpng, libpng3	CVE #(s):	CAN-2002-1363
Created:	December 19, 2002	Updated:	July 14, 2004
Description:	Glenn Randers-Pehrson discovered a problem in connection with 16-bit samples from libpng, an interface for reading and writing PNG (Portable Network Graphics) format files. The starting offsets for the loops are calculated incorrectly which causes a buffer overrun beyond the beginning of the row buffer.
Alerts:	Gentoo 200407-06 2004-07-08 OpenPKG OpenPKG-SA-2004.030 2004-07-06 Mandrake MDKSA-2004:063 2004-06-29 Whitebox WBSA-2004:249-01 2004-06-21 Fedora FEDORA-2004-176 2004-06-18 Fedora FEDORA-2004-174 2004-06-18 Fedora FEDORA-2004-175 2004-06-18 Fedora FEDORA-2004-173 2004-06-18 Red Hat RHSA-2004:249-01 2004-06-18 Conectiva CLA-2003:564 2003-01-23 Mandrake MDKSA-2003:008 2003-01-20 OpenPKG OpenPKG-SA-2003.001 2003-01-15 Yellow Dog YDU-20030114-2 2002-01-14 SuSE SuSE-SA:2003:0004 2003-01-14 Red Hat RHSA-2003:006-06 2003-01-09 Debian DSA-213-1 2002-12-19

Comments (none posted)

libxml2 - arbitrary code execution

Package(s):	libxml2	CVE #(s):	CAN-2004-0110
Created:	February 26, 2004	Updated:	August 19, 2009
Description:	Yuuichi Teranishi discovered a flaw in libxml2 versions prior to 2.6.6. When fetching a remote resource via FTP or HTTP, libxml2 uses special parsing routines. These routines can overflow a buffer if passed a very long URL. If an attacker is able to find an application using libxml2 that parses remote resources and allows them to influence the URL, then this flaw could be used to execute arbitrary code.
Alerts:	Fedora FEDORA-2009-8594 2009-08-15 Fedora FEDORA-2009-8582 2009-08-15 Fedora-Legacy FLSA:1324 2004-07-19 Conectiva CLA-2004:836 2004-03-31 Gentoo 200403-01 2004-03-06 Trustix TSLSA-2004-0010 2004-03-05 OpenPKG OpenPKG-SA-2004.003 2004-03-05 Netwosix NW-2004-0004 2004-03-04 Debian DSA-455-1 2004-03-03 Mandrake MDKSA-2004:018 2004-03-03 Red Hat RHSA-2004:091-02 2004-03-03 Whitebox WBSA-2004:090-01 2004-03-01 Red Hat RHSA-2004:090-01 2004-02-26 Fedora FEDORA-2004-087 2004-02-25 Red Hat RHSA-2004:091-01 2004-02-26

Comments (none posted)

logcheck: symlink vulnerability

Package(s):	logcheck	CVE #(s):	CAN-2004-0404
Created:	April 21, 2004	Updated:	December 22, 2004
Description:	The logcheck utility handles temporary files in an unsafe way, possibly allowing local attackers to overwrite files.
Alerts:	Mandrake MDKSA-2004:155 2004-12-22 Debian DSA-488-1 2004-04-16

Comments (none posted)

mailman denial of service

Package(s):	mailman	CVE #(s):	CAN-2003-0991
Created:	February 9, 2004	Updated:	May 25, 2004
Description:	Matthew Galgoci of Red Hat discovered a Denial of Service (DoS) vulnerability in versions of Mailman prior to 2.1. An attacker could send a carefully-crafted message causing mailman to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0991 to this issue.
Alerts:	Conectiva CLA-2004:842 2004-05-25 Red Hat RHSA-2004:156-01 2004-04-14 Mandrake MDKSA-2004:013 2004-02-13 Red Hat RHSA-2004:019-01 2004-02-09

Comments (1 posted)

metamail: integer and buffer overflows

Package(s):	metamail	CVE #(s):	CAN-2004-0104 CAN-2004-0105
Created:	February 18, 2004	Updated:	May 21, 2004
Description:	Versions of metamail through 2.7 contain a set of integer and buffer overflows which are remotely exploitable via a properly crafted message.
Alerts:	Gentoo 200405-17 2004-05-21 Debian DSA-449-1 2004-02-24 Mandrake MDKSA-2004:014 2004-02-18 Slackware SSA:2004-049-02 2004-02-18 Red Hat RHSA-2004:073-01 2004-02-18

Comments (none posted)

mikmod: buffer overflow

Package(s):	mikmod	CVE #(s):	CAN-2003-0427
Created:	June 16, 2003	Updated:	June 16, 2005
Description:	Ingo Saitz discovered a bug in mikmod whereby a long filename inside an archive file can overflow a buffer when the archive is being read by mikmod.
Alerts:	Fedora FEDORA-2005-405 2005-06-16 Red Hat RHSA-2005:506-01 2005-06-13 Fedora FEDORA-2005-404 2005-06-09 Gentoo 200307-01 2003-07-02 Debian DSA-320-1 2003-06-13

Comments (none posted)

mod_python: denial of service vulnerability

Package(s):	mod_python	CVE #(s):	CAN-2003-0973
Created:	January 27, 2004	Updated:	October 4, 2004
Description:	Apache's mod_python module could crash the httpd process if a specific, malformed query string was sent. The Apache Foundation has reported that mod_python may be prone to Denial of Service attacks when handling a malformed query. Mod_python 2.7.9 was released to fix the vulnerability, however, because the vulnerability has not been fully fixed, version 2.7.10 has been released. Users of mod_python 3.0.4 are not affected by this vulnerability.
Alerts:	Fedora-Legacy FLSA:1325 2004-10-03 Conectiva CLA-2004:837 2004-04-12 Whitebox WBSA-2004:058-01 2004-03-01 Debian DSA-452-1 2004-02-29 Red Hat RHSA-2004:058-01 2004-02-26 Red Hat RHSA-2004:063-01 2004-02-26 Gentoo 200401-03 2004-01-27

Comments (none posted)

mozilla: multiple vulnerabilties

Package(s):	mozilla	CVE #(s):	CAN-2003-0594 CAN-2003-0564
Created:	March 10, 2004	Updated:	August 19, 2004
Description:	Mozilla 1.4 contains a few vulnerabilities, including disclosure of cookies to the wrong server, a scripting vulnerability which can allow an attacker to run arbitrary code, and an S/MIME vulnerability which can lead to remote denial of service or code execution attacks.
Alerts:	Whitebox WBSA-2004:421-01 2004-08-19 Whitebox WBSA-2004:110-01 2004-03-29 Red Hat RHSA-2004:112-01 2004-03-17 Mandrake MDKSA-2004:021 2004-03-10

Comments (none posted)

mpg321: format string vulnerability

Package(s):	mpg321	CVE #(s):	CAN-2003-0969
Created:	January 6, 2004	Updated:	March 28, 2005
Description:	A vulnerability was discovered in mpg321, a command-line mp3 player, whereby user-supplied strings were passed to printf(3) unsafely. This vulnerability could be exploited by a remote attacker to overwrite memory, and possibly execute arbitrary code. In order for this vulnerability to be exploited, mpg321 would need to play a malicious mp3 file (including via HTTP streaming).
Alerts:	Gentoo 200503-34 2005-03-28 Debian DSA-411-1 2004-01-05

Comments (none posted)

MySQL: temporary file vulnerabilities

Package(s):	mysql	CVE #(s):	CAN-2004-0381 CAN-2004-0388
Created:	April 14, 2004	Updated:	August 18, 2004
Description:	The mysqlbug and mysqld_multi scripts contain temporary file vulnerabilities which could be used by a local attacker to overwrite files on the system.
Alerts:	Gentoo 200405-20 2004-05-25 Mandrake MDKSA-2004:034 2004-04-19 OpenPKG OpenPKG-SA-2004.014 2004-04-14 Debian DSA-483-1 2004-04-14

Comments (none posted)

neon: format string vulnerabilities

Package(s):	neon	CVE #(s):	CAN-2004-0179
Created:	April 14, 2004	Updated:	May 18, 2004
Description:	The neon WebDAV library contains format string vulnerabilities which may be exploited by a hostile DAV server. This vulnerability exists in utilities which use neon, including cadaver and OpenOffice.org.
Alerts:	Fedora FEDORA-2004-103 2004-04-14 Gentoo 200405-04 2004-05-11 Gentoo 200405-01 2004-05-09 Red Hat RHSA-2004:163-01 2004-04-30 Whitebox WBSA-2004:160-01 2004-04-19 Mandrake MDKSA-2004:032 2004-04-19 Gentoo 200404-14 2004-04-19 OpenPKG OpenPKG-SA-2004.016 2004-04-16 Netwosix NW-2004-0012 2004-04-18 Debian DSA-487-1 2004-04-16 Red Hat RHSA-2004:159-01 2004-04-15 Red Hat RHSA-2004:160-01 2004-04-14 Red Hat RHSA-2004:157-01 2004-04-14 Red Hat RHSA-2004:158-01 2004-04-14

Comments (none posted)

Nessus NASL scripting engine security issues

Package(s):	nessus	CVE #(s):
Created:	May 27, 2003	Updated:	August 12, 2004
Description:	Some some vulnerabilities exsist in the Nessus NASL scripting engine. To exploit these flaws, an attacker would need to have a valid Nessus account as well as the ability to upload arbitrary Nessus plugins in the Nessus server (this option is disabled by default) or he/she would need to trick a user somehow into running a specially crafted nasl script. Read the full advisory for additional information.
Alerts:	Gentoo 200305-10 2003-05-27

Comments (none posted)

netpbm: insecure temporary files

Package(s):	netpbm	CVE #(s):	CAN-2003-0924
Created:	January 19, 2004	Updated:	December 29, 2004
Description:	netpbm is graphics conversion toolkit made up of a large number of single-purpose programs. Many of these programs were found to create temporary files in an insecure manner, which could allow a local attacker to overwrite files with the privileges of the user invoking a vulnerable netpbm tool.
Alerts:	Conectiva CLA-2004:909 2004-12-29 Gentoo 200410-02 2004-10-04 Mandrake MDKSA-2004:011-1 2004-09-27 Whitebox WBSA-2004:031-01 2004-02-12 Mandrake MDKSA-2004:011 2004-02-11 Red Hat RHSA-2004:030-01 2004-02-05 Fedora FEDORA-2004-068 2004-02-06 Red Hat RHSA-2004:031-01 2004-01-22 Debian DSA-426-1 2004-01-18

Comments (1 posted)

openssh: timing attack leads to information disclosure

Package(s):	openssh	CVE #(s):	CAN-2003-0190
Created:	May 2, 2003	Updated:	November 30, 2004
Description:	From the advisory: "During a pen-test we stumbled across a nasty bug in OpenSSH-portable with PAM support enabled (via the --with-pam configure script switch). This bug allows a remote attacker to identify valid users on vulnerable systems, through a simple timing attack. The vulnerability is easy to exploit and may have high severity, if combined with poor password policies and other security problems that allow local privilege escalation."
Alerts:	Ubuntu USN-34-1 2004-11-30 OpenPKG OpenPKG-SA-2003.035 2003-08-06 Red Hat RHSA-2003:222-01 2003-07-29 Gentoo 200305-02 2003-05-13 Gentoo 200305-01 2002-03-05

Comments (1 posted)

OpenSSL: denial of service vulnerabilities

Package(s):	OpenSSL	CVE #(s):	CAN-2004-0081 CAN-2003-0851
Created:	March 17, 2004	Updated:	November 2, 2005
Description:	Versions 0.9.7a-c of the OpenSSL library suffer from two denial of service vulnerabilities; see the version 0.9.7d release announcement for details.
Alerts:	Red Hat RHSA-2005:830-00 2005-11-02 Red Hat RHSA-2005:829-00 2005-11-02 Fedora FEDORA-2005-1042 2005-10-31 Fedora-Legacy FLSA:1395 2004-05-08 Conectiva CLA-2004:834 2004-03-31 Whitebox WBSA-2004:084-01 2004-03-23 Red Hat RHSA-2004:084-01 2004-03-23 Fedora FEDORA-2004-095 2004-03-19 Whitebox WBSA-2004:120-01 2004-03-22 Trustix TSLSA-2004-0012 2004-03-17 Slackware SSA:2004-077-01 2004-03-17 Red Hat RHSA-2004:121-01 2004-03-17 OpenPKG OpenPKG-SA-2004.007 2004-03-18 Gentoo 200403-03 2004-03-17 Debian DSA-465-1 2004-03-17 Netwosix NW-2004-0005 2004-03-17 Mandrake MDKSA-2004:023 2004-03-17 SuSE SuSE-SA:2004:007 2004-03-17 Red Hat RHSA-2004:120-01 2004-03-17 Red Hat RHSA-2004:119-01 2004-03-17 EnGarde ESA-20040317-003 2004-03-17

Comments (1 posted)

postfix: denial of service vulnerabilities

Package(s):	postfix	CVE #(s):	CAN-2003-0468 CAN-2003-0540
Created:	August 5, 2003	Updated:	May 27, 2004
Description:	The postfix MTA, versions through 1.1.12 (but not 2.0) is subject to two remotely exploitable denial of service vulnerabilities; see this advisory from Michal Zalewski for details.
Alerts:	Mandrake MDKA-2004:028 2004-05-26 Trustix 2003-0029 2003-08-04 Mandrake MDKSA-2003:081 2003-08-04 EnGarde ESA-20030804-019 2003-08-04 Conectiva CLA-2003:717 2003-08-04 SuSE SuSE-SA:2003:033 2003-08-04 Red Hat RHSA-2003:251-01 2003-08-04 Debian DSA-363-1 2003-08-03

Comments (none posted)

python: buffer overflow

Package(s):	python	CVE #(s):	CAN-2004-0150
Created:	March 10, 2004	Updated:	October 11, 2004
Description:	Python (versions 2.2 and 2.2.1 only) has a buffer overflow in the getaddrinfo() function which can be exploited by a malformed IPv6 address.
Alerts:	Debian DSA-458-3 2004-10-10 Gentoo 200409-03 2004-09-02 Debian DSA-458-2 2004-08-31 Mandrake MDKSA-2004:019 2004-03-09 Debian DSA-458-1 2004-03-09

Comments (none posted)

ssmtp format string vulnerability

Package(s):	ssmtp	CVE #(s):	CAN-2004-0156
Created:	April 15, 2004	Updated:	May 7, 2004
Description:	Max Vozeler discovered two format string vulnerabilities in ssmtp, a simple mail transport agent. Untrusted values in the functions die() and log_event() were passed to printf-like functions as format strings. These vulnerabilities could potentially be exploited by a remote mail relay to gain the privileges of the ssmtp process (including potentially root).
Alerts:	OpenPKG OpenPKG-SA-2004.020 2004-05-07 Gentoo 200404-18 2004-04-26 Debian DSA-485-1 2004-04-14

Comments (none posted)

sysstat: temporary file vulnerability

Package(s):	sysstat	CVE #(s):	CAN-2004-0107 CAN-2004-0108
Created:	March 10, 2004	Updated:	October 4, 2004
Description:	The sysstat utility has a temporary file vulnerability which can be exploited by a local attacker to overwrite system files.
Alerts:	Fedora-Legacy FLSA:1372 2004-10-03 Gentoo 200404-04 2004-04-06 Debian DSA-460-2 2004-04-03 Trustix TSLSA-2004-0011 2004-03-16 Whitebox WBSA-2004:053-01 2004-03-10 Red Hat RHSA-2004:053-01 2004-03-10 Red Hat RHSA-2004:093-01 2004-03-10 Debian DSA-460-1 2004-03-10

Comments (none posted)

File overwrite vulnerability in tar and unzip

Package(s):	tar unzip	CVE #(s):	CAN-2001-1267 CAN-2001-1268 CAN-2001-1269 CAN-2002-0399
Created:	October 1, 2002	Updated:	April 10, 2006
Description:	The tar utility does not properly filter file names containing "../", meaning that a hostile archive can, if unpacked by an unsuspecting user, overwrite any file that is writable by that user. GNU tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42 has the same vulnerability.
Alerts:	Fedora-Legacy FLSA:183571-1 2006-04-04 Red Hat RHSA-2006:0195-01 2006-02-21 Conectiva CLA-2002:538 2002-10-29 Mandrake MDKSA-2002:066 2002-10-10 Mandrake MDKSA-2002:065 2002-10-10 EnGarde ESA-20021003-022 2002-10-03 Gentoo unzip-20021001 2002-10-01 Gentoo tar-20021001 2002-10-01 Red Hat RHSA-2002:096-24 2002-09-18

Comments (1 posted)

tcpdump: ISAKMP payload handling denial-of-service vulnerabilities

Package(s):	tcpdump	CVE #(s):	CAN-2004-0183 CAN-2004-0184
Created:	March 30, 2004	Updated:	September 30, 2004
Description:	TCPDUMP v3.8.1 and earlier versions contain multiple flaws in the packet display functions for the ISAKMP protocol. Upon receiving specially crafted ISAKMP packets, TCPDUMP will try to read beyond the end of the packet capture buffer and crash. More information is available in this Rapid7 advisory.
Alerts:	Fedora-Legacy FLSA:1468 2004-09-29 Whitebox WBSA-2004:219-01 2004-06-10 Red Hat RHSA-2004:219-01 2004-05-26 Fedora FEDORA-2004-120 2004-05-13 Slackware SSA:2004-108-01 2004-04-17 Mandrake MDKSA-2004:030 2004-04-14 OpenPKG OpenPKG-SA-2004.010 2004-04-07 Debian DSA-478-1 2004-04-06 Trustix TSLSA-2004-0015 2004-03-30

Comments (none posted)

Multiple vendor telnetd vulnerability

Package(s):	telnet Telnet netkit-telnet-ssl kerberos telnetd netkit-telnet nkitb/nkitserv/telnetd krb5	CVE #(s):
Created:	May 21, 2002	Updated:	October 5, 2004
Description:	This vulnerability, originally thought to be confined to BSD-derived systems, was first covered in the July 26th Security Summary. It is now known that Linux telnet daemons are vulnerable as well.
Alerts:	Gentoo 200410-03 2004-10-05 Yellow Dog YDU-20010810-2 2001-08-10 Yellow Dog YDU-20010810-1 2001-08-10 SuSE SuSE-SA:2001:029 2001-09-03 Slackware sl-997726350 2001-08-09 Red Hat RHSA-2001:100-02 2001-08-09 Red Hat RHSA-2001:099-09 2002-02-07 Red Hat RHSA-2001:099-06 2001-08-09 Progeny PROGENY-SA-2001-27 2001-08-14 Mandrake MDKSA-2001:093 2001-12-17 Mandrake MDKSA-2001:068 2001-08-13 HP HPSBTL0202-023 2002-02-12 Debian DSA-075-2 2001-08-14 Debian DSA-075-1 2001-08-14 Conectiva CLA-2001:413 2001-08-24 SCO Group CSSA-2001-030.0 2001-08-10

Comments (none posted)

utempter problems with symlink and strncpy

Package(s):	utempter	CVE #(s):	CAN-2004-0233
Created:	April 19, 2004	Updated:	June 11, 2004
Description:	Steve Grubb discovered two potential issues in the utempter program: If the path to the device contained /../ or /./ or //, the program was not exiting as it should. It would be possible to use something like /dev/../tmp/tty0, and then if /tmp/tty0 were deleted and symlinked to another important file, programs that have root privileges that do no further validation can then overwrite whatever the symlink pointed to. Several calls to strncpy without a manual termination of the string. This would most likely crash utempter.
Alerts:	Whitebox WBSA-2004:174-01 2004-06-10 Red Hat RHSA-2004:174-01 2004-05-26 Fedora-Legacy FLSA:1546 2004-05-18 Gentoo 200405-05 2004-05-13 Red Hat RHSA-2004:175-01 2004-04-30 Mandrake MDKSA-2004:031-1 2004-04-21 Fedora FEDORA-2004-108 2004-04-21 Slackware SSA:2004-110-01 2004-04-19 Mandrake MDKSA-2004:031 2004-04-19

Comments (none posted)

XChat 2.0.x SOCKS5 Vulnerability

Package(s):	xchat	CVE #(s):	CAN-2004-0409
Created:	April 19, 2004	Updated:	November 15, 2005
Description:	XChat is vulnerable to a stack overflow that may allow a remote attacker to run arbitrary code. The SOCKS 5 proxy code in XChat is vulnerable to a remote exploit. Users would have to be using XChat through a SOCKS 5 server, enable SOCKS 5 traversal which is disabled by default and also connect to an attacker's custom proxy server. This vulnerability may allow an attacker to run arbitrary code within the context of the user ID of the XChat client.
Alerts:	Fedora-Legacy FLSA:123013 2005-11-14 Red Hat RHSA-2004:585-01 2004-10-27 Netwosix NW-2004-0014 2004-05-01 Red Hat RHSA-2004:177-01 2004-04-30 Mandrake MDKSA-2004:036 2004-04-21 Debian DSA-493-1 2004-04-21 Gentoo 200404-15 2004-04-19

Comments (none posted)

XFree86 minor DoS vulnerability

Package(s):	XFree86	CVE #(s):	CAN-2004-0093 CAN-2004-0094
Created:	April 22, 2004	Updated:	April 28, 2004
Description:	XFree86 is an implementation of the X Window System, providing the core graphical user interface and video drivers. Flaws in XFree86 4.1.0 allow local or remote attackers who are able to connect to the X server to cause a denial of service via an out-of-bounds array index or integer signedness error when using the GLX extension and Direct Rendering Infrastructure (DRI).
Alerts:	Red Hat RHSA-2004:152-01 2004-04-21

Comments (1 posted)

xine-ui - insecure temporary file creation

Package(s):	xine-ui	CVE #(s):	CAN-2004-0372
Created:	April 6, 2004	Updated:	April 27, 2006
Description:	Shaun Colley discovered a problem in xine-ui, the xine video player user interface. A script contained in the package to possibly remedy a problem or report a bug does not create temporary files in a secure fashion. This could allow a local attacker to overwrite files with the privileges of the user invoking xine.
Alerts:	Gentoo 200404-20 2004-04-27 Slackware SSA:2004-111-01 2004-04-20 Mandrake MDKSA-2004:033 2004-04-19 Debian DSA-477-1 2004-04-06

Comments (none posted)

Events

SummerCon 2004 - Official Announcement

SummerCon 2004 is happening June 11 to 13 in Pittsburgh, PA. The call for papers is out; submissions are due by May 15.

Full Story (comments: none)

Page editor: Jonathan Corbet

Kernel development

Brief items

Kernel release status

The current 2.6 prepatch is 2.6.6-rc3, unchanged from last week.

Linus's BitKeeper tree contains, as of this writing, an important workqueue fix (it seems nobody had actually tried to use cancel_delayed_work() until now...), an updated MTD concatenating driver, several architecture updates, and lots of fixes.

The current tree from Andrew Morton is 2.6.6-rc3-mm2. Recent additions to the -mm tree include another set of reverse mapping VM patches from Hugh Dickins, a new ia_64 hotplug CPU patch set, a patch to enable interrupts while waiting on spinlocks, the permanent abolition of 8K stacks on the x86 architecture, a new /proc/sys/kernel/vermagic file to enable package installers to figure out how the kernel was built, filtered sleeps and wakeups (see below), a new NUMA API, and, of course, lots of fixes.

Andrew indicates that the scheduling domains patches are being fixed up and prepared for merging once 2.6.6 is released. He also plans to merge a number of the reverse mapping VM patches, including the anonmm work, even though the final decision on whether to go that way or with the rival anon_vma technique has not yet been made.

The current 2.4 prepatch is 2.4.27-pre2, which was released by Marcelo on May 3. Changes this time include some crypto updates, some XFS fixes, various networking updates, and a handful of other fixes.

Comments (1 posted)

Kernel development news

Quote of the week

-- Alexander Viro's alternative for a less alarming replacement for the term "tainted," applied to kernels which have had non-free modules loaded into them.

Comments (none posted)

2.6 swapping behavior

There has, recently, been a new round of complaints about how the 2.6 kernel swaps out memory. Some users have been very vocal in their belief that, if they have sufficient physical memory, their applications should never be swapped out. These people get annoyed when they sit down at their display in the morning and find that their office suite or web browser is unresponsive, and stays that way for some time. They get even more annoyed when they look and see how much memory the kernel is using for caching file contents rather than process memory. The obvious question to ask is: couldn't the kernel cut back a bit on the file caches and keep applications in memory?

The answer is that the kernel can be made to behave that way by tweaking a runtime parameter, but it is not necessarily a good idea. Before getting into that, however, it's worth noting that recent 2.6 kernels have a memory management problem which can cause serious problems after an application which reads through entire filesystems (updatedb, say, or a backup) has run. The problem is the slab cache's tendency to request allocations of multiple, contiguous pages; these allocations, when done at the behest of filesystem code, can bring the system to a halt. A patch has been merged which fixes this particular problem for 2.6.6.

The bigger issue remains, however: should the kernel swap out user applications in order to cache more file contents? There are plenty of arguments in favor of this behavior. Quite a few large applications set up big areas of memory which they rarely, if ever use. If application memory is occasionally forced to disk, the unused parts will remain there, and that much physical memory will be freed for more useful contents. Without swapping application memory to disk and seeing what gets faulted back in, it is almost impossible to figure out which pages are not really needed. A large file cache is also a performance enhancer. The speedups that come from having frequently-accessed data in memory are harder to see than the slowdowns caused by having to fault in a large application, but they can lead to better system throughput overall.

Still, there are users who insist that, for example, a system backup should never force OpenOffice out to disk. They don't care how quickly a system maintenance application runs at 3:00 in the morning, but they care a lot about how the system responds when they are at the keyboard. This wish was expressed repeatedly until Andrew Morton exclaimed:

This helped quiet the debate as the parties involved looked more closely at this particular parameter. Or, perhaps, it was just fear of Andrew's singing. Either way, it has become clear that most people are unaware of what the "swappiness" parameter does; the fact that it has never been documented may have something to do with that.

So... swappiness, which is exported to /proc/sys/vm/swappiness, is a parameter which sets the kernel's balance between reclaiming pages from the page cache and swapping out process memory. The reclaim code works (in a very simplified way) by calculating a few numbers:

• The "distress" value is a measure of how much trouble the kernel is having freeing memory. The first time the kernel decides it needs to start reclaiming pages, distress will be zero; if more attempts are required, that value goes up, approaching a high value of 100.

• mapped_ratio is an approximate percentage of how much of the system's total memory is mapped (i.e. is part of a process's address space) within a given memory zone.

• vm_swappiness is the swappiness parameter, which is set to 60 by default.

With those numbers in hand, the kernel calculates its "swap tendency":

	swap_tendency = mapped_ratio/2 + distress + vm_swappiness;

If swap_tendency is below 100, the kernel will only reclaim page cache pages. Once it goes above that value, however, pages which are part of some process's address space will also be considered for reclaim. So, if life is easy, swappiness is set to 60, and distress is zero, the system will not swap process memory until it reaches 80% of the total. Users who would like to never see application memory swapped out can set swappiness to zero; that setting will cause the kernel to ignore process memory until the distress value gets quite high.

The swappiness parameter should do what a lot of users want, but it does not solve the whole problem. Swappiness is a global parameter; it affects every process on the system in the same way. What a number of people would like to see, however, is a way to single out individual applications for special treatment. Possible approaches include using the process's "nice" value to control memory behavior; a low-priority process would not be able to push out significant amounts of a high-priority process's memory. Alternatively, the VM subsystem and the scheduler could become more tightly integrated. The scheduler already makes an effort to detect "interactive" processes; those processes could be given the benefit of a larger working set in memory. That sort of thing is 2.7 work, however; in the mean time, people who are unhappy with the kernel's swap behavior may want to try playing with the knobs which have been provided.

Comments (23 posted)

Filtered wakeups

Kernel code often finds itself having to wait for a particular physical page; if, for example, a page is currently under I/O, prospective users must wait until that operation has completed. In the early days of 2.4 (and before), the struct page structure (which the kernel uses to track physical memory) contained a wait queue head for this purpose. This technique worked, but adding a wait queue for every page in the system was not a particularly efficient use of memory. At any given time, only a tiny percentage of those wait queues are actually in use.

To recover some of the memory used by wait queues, the kernel developers added the concept of hashed wait queues. The per-page queues were replaced with a much smaller number of shared queues; when a thread needs to wait on a particular page, it hashes the page address to pick the appropriate queue. When the page becomes available, all processes waiting on that queue will be awakened. The use of this technique has since been extended to other parts of the kernel as well.

Hashed wait queues have achieved the desired space savings, but, as it turns out, at a certain computational cost. William Lee Irwin did some research, and found that hash queue collisions are fairly common. So, when a wakeup is performed on one of the hashed wait queues, it is likely that unrelated processes are being awakened. Each of those processes must run, determine that the event they are waiting for has not yet occurred, and go back to sleep. This variant on the "thundering herd" problem can hurt performance.

One possible solution to this problem would be to expand the number of wait queues to make collisions less likely. That approach is simple, but it also would bring back the original problem by expanding the amount of memory dedicated to wait queues. So William came up with another approach, which he calls "filtered wakeups."

The idea behind a filtered wakeup is fairly simple. When a process goes to sleep on a (shared) filtered wait queue, it provides a "key" value, which will typically be the address of the resource being waited for. The wakeup call is made with a key value as well; as the wait queue is traversed, only the processes waiting for the given key are awakened.

The patch which implements filtered waits is fairly simple, and includes an example of their use. It creates a new filtered_wait_queue structure:

	struct filtered_wait_queue {
		void *key;
		wait_queue_t wait;
	};

A process which is about to go into a filtered wait will use code which looks something like the following to create an use a filtered queue entry:

	DEFINE_FILTERED_WAIT(wait, key);

	do {
		prepare_to_wait(queue, &wait.wait, TASK_INTERRUPTIBLE);
		if (not_ready_yet(key))
			schedule();
	} while(not_ready_yet(key));
	finish_wait_(queue, &wait.wait);

Awakening a process in this sort of sleep is a simple matter of calling:

    void wake_up_filtered(wait_queue_head_t *queue, void *key);

William claims some significant performance improvements from his changes, including large reductions in CPU usage and a near tripling of the peak I/O rates in some situations.

Comments (1 posted)

Patches and updates

Kernel trees

• Andrew Morton: 2.6.6-rc3-mm1. (April 30, 2004)

• Andrew Morton: 2.6.6-rc3-mm2. (May 5, 2004)

• Martin J. Bligh: 2.6.5-mjb2. (April 30, 2004)

• Marcelo Tosatti: Linux 2.4.27-pre2. (May 4, 2004)

Core kernel code

• Shailabh Nagar: Revised CKRM release. (April 29, 2004)

• Shailabh Nagar: CKRM test package available. (May 5, 2004)

• William Lee Irwin III: scheduler caller profiling. (May 3, 2004)

• William Lee Irwin III: filtered buffer_head wakeups. (May 3, 2004)

• William Lee Irwin III: filtered wakeups respun. (May 5, 2004)

• William Lee Irwin III: filtered wakeups respun. (May 5, 2004)

• William Lee Irwin III: filtered buffer_head wakeups. (May 5, 2004)

• William Lee Irwin III: wake-one PG_locked/BH_Lock semantics. (May 5, 2004)

• Guillaume Thouvenin: Enhanced Linux System Accounting. (May 5, 2004)

Device drivers

• Sean Young: USB: add new USB PhidgetServo driver. (April 29, 2004)

• Russell King: 1/4 MMC layer. (April 29, 2004)

• Russell King: 2/4 MMC layer: configuration + makefiles. (April 29, 2004)

• Russell King: 3/4 MMC layer: ARM MMCI driver. (April 29, 2004)

• Russell King: 4/4 MMC layer: PXA MCI driver. (April 29, 2004)

• Daniel Ritz: new USB HID driver: eGalax Touchscreens. (May 2, 2004)

• Len Brown: ACPI for 2.6. (May 4, 2004)

• James Ketrenos: Intel PRO/Wireless 2200BG 802.11bg project. (May 4, 2004)

• Mikael Pettersson: perfctr-2.7.0 released. (May 5, 2004)

• Juergen Stuber: [PATCH] LEGO USB Tower driver v0.95. (May 5, 2004)

Filesystems and block I/O

• Chris Mason: reiserfs data logging support. (April 29, 2004)

• Maneesh Soni: sysfs backing store ver 0.5. (May 5, 2004)

• Nikita Danilov: code for raceless /sys/fs/foofs/*. (May 5, 2004)

Memory management

• Hugh Dickins: rmap 20 i_mmap_shared into i_mmap. (May 5, 2004)

• Hugh Dickins: rmap 21 try_to_unmap_one mapcount. (May 5, 2004)

• Hugh Dickins: rmap 22 flush_dcache_mmap_lock. (May 5, 2004)

• Hugh Dickins: rmap 23 empty flush_dcache_mmap_lock. (May 5, 2004)

Architecture-specific

• Jeff Dike: UML/x86_64. (May 2, 2004)

• Zwane Mwaikambo: Allow i386 to reenable interrupts on lock contention. (May 2, 2004)

Miscellaneous

• Ulrich Drepper: NUMA API. (April 30, 2004)

• Mariusz Mazur: linux-libc-headers 2.6.5.1. (May 3, 2004)

• Selbak, Rolla N: Open POSIX Test Suite 1.4.1 release. (May 4, 2004)

• Douglas Gilbert: sg3_utils-1.06 released. (May 5, 2004)

Page editor: Jonathan Corbet

Distributions

News and Editorials

OpenBSD 3.5: a peek at another free Unix

After reading LWN's recent coverage of SELinux and its implementation in the development releases of Fedora Core 2, several readers expressed disappointment about the complexity associated with this new security model: "SELinux may give administrators extra flexibility, and add some extra 'layers' of protection for critical files, but security pros usually consider complexity to be the enemy of good security - and this system is nothing if not complex," wrote one reader. Still, with several attacks on high-profile Linux servers during 2003, many system administrators are evaluating various security solutions for their mission-critical servers and firewalls. Those of them who are prepared to look beyond Linux might find that OpenBSD is exactly what they need.

Initiated by Theo de Raadt back in 1996, OpenBSD's primary goal is to build a free and highly secure operating system. The developers pride themselves for a remarkable achievement of eight years with only a single remote hole in the default install. Although OpenBSD doesn't support nearly as many processor architectures as NetBSD, its original parent, the latest release of OpenBSD is available for 13 platforms, including Alpha, AMD64, PowerPC, SPARC, as well as i386. But despite fundamental technical differences between Linux and BSD, a system administrator familiar with Linux will find it relatively easy to administer an OpenBSD box, especially after reading the project's online manual (which includes a section about migrating from Linux to OpenBSD), or the superb Absolute OpenBSD by Michael W. Lucas.

How is security in OpenBSD better than in other UNIXes? Let's take a look at some of the more interesting features found this BSD flavor: file flags, securelevels and systrace.

• File flags. File flags are an OpenBSD concept enhancing the traditional UNIX file system permissions. Once applied to a file, the flag will either prevent a user, including root, from removing or modifying the file in any way (the schg flag), or will only allow appending new lines to the file (the sappnd flag). A good example of the effectiveness of this concept is making the the entire /bin directory recursively immutable with the schg flag; once applied, it will be very hard for an attacker to place a trojan into the directory. On the other hand, the append-only sappnd flag is often used on log files to prevent potential intruders from covering their tracks. Besides system-level flags available to root only, similarly structured user-level flags allow users to set append-only or immutable flags on files they own.

• Securelevels. The concept of file flags works in conjunction with OpenBSD's securelevels, of which there are four: -1, 0, 1 and 2. As soon as a file flag is set, it cannot be removed unless the system is in securelevel 0 or -1. To extend the example from the previous paragraph about making the /bin directory immutable, what happens if an executable file in the same directory needs to get a security patch, but the system is in securelevel 1 or 2? In this case, the system administrator will have to lower the securelevel in the BSD kernel by rebooting the system (while the system is running, the securelevel can be raised, but not lowered). As this example illustrates, the introduction of securelevels can prevent some common security exploits, but as a trade-off, it makes the system less flexible, especially when it comes to patching or upgrading applications.

• Systrace. OpenBSD's systrace, a policy-based system call access manager, is conceptually similar to SELinux. Like SELinux policies, the systrace policies define which users and programs can access which files and devices in a manner completely independent of UNIX permissions. Proper use of systrace can greatly reduce risks associated with poorly written or exploitable applications. While defining systrace policies is not a simple task, it has been made more palatable by the fact that systrace has been around for a long time and there are many online repositories with systrace sample policies (see the interestingly named Project Hairy Eyeball as an example). Also, systrace includes a policy-generation tool listing every system call available to the application for which the policy is being generated. Although an experienced system administrator could probably still tighten the security of the system by refining the default policy generated by the tool, the defaults are often secure enough for most uses.

OpenBSD 3.5 was released last weekend, following a predictable twice-a-year release pattern. As always, the complete ISO image sets of OpenBSD releases are only available from the project's online store ($40), but the operating system can be installed directly from FTP servers, after booting from a downloadable boot CD or floppy disk. Unlike the FreeBSD installer, OpenBSD does not provide any recommended partitioning scheme, so it is up to the users to set up disk partitions according to their needs. Needless to say, the installer is all text mode, but OpenBSD can serve as a full graphical desktop system as well; besides the rich ports collection available for our compiling pleasure, it also comes with over 2,300 binary applications, including XFree86 4.4, GNOME 2.4 and KDE 3.2, just to name a few desktop components, among the usual range of server software for every purpose.

In many ways, OpenBSD is one of the most remarkable projects in the history of UNIX. With support for 13 architectures and its emphasis on security and integrated cryptography, any system administrator that overlooks OpenBSD where server security is of paramount importance is not doing a proper job. Even if most of us prefer to run Linux on our servers and desktop, there is no doubt that OpenBSD has a rightful place in the OS ecosystem, and a rightful place in every UNIX sysadmin's toolbox.

Comments (17 posted)

Distribution News

OpenBSD 3.5 released

OpenBSD 3.5 is available; click below for the release announcement. This version includes, of course, more security work, along with x86_64 support, ARM support, a number of new device drivers, a reworked packet filter, and much more; see the announcement for details.

Full Story (comments: 7)

Mandrake Linux

MandrakeSoft has announced the release of Mandrakelinux 10.0 for the x86_64 architecture. "Mandrakelinux 10.0 for AMD64 delivers all the features and robustness of Mandrakelinux 10.0 Official to the 64-bit platform from AMD, with an average performance gain of 20% compared to the IA32 version."

Mandrakelinux 10.0 update advisories:

• rpmdrake: When MandrakeUpdate was unable to retrieve the hdlist or the synthesis file from an update medium, it used to continue without alerting the user. Now MandrakeUpdate will alert the user and indicate to them to retry the operation later or to delete and re-add the medium in case the directory layout has changed.
• shorewall: This new version of shorewall provides updated RFC1918 and bogons files that are needed for proper operation of the firewall.

Comments (2 posted)

Debian GNU/Linux

The Debian Weekly News for May 4, 2004 is out. This week's topics include the discussions about releasing sarge in light of recent editorial changes to the social contract and the proposed amendments that have followed; a short howto on installing Debian stable using Knoppix; and several others.

The Debian-Installer team has announced the fourth beta release of the Debian sarge installer. Improvements in this release include support for arm, hppa, and mipsel architectures bringing the total up to nine supported architectures; experimental support for the 2.6 kernel on i386; detection of existing operating systems; new translations; plus many bug fixes and user interface improvements.

This Bits from the DPL (Debian and OASIS) features a report from Mark Johnson, Debian's representative at OASIS (Organization for the Advancement of Structured Information Standards). "Through our membership we have direct influence into the process of standards development. This benefit has proved particularly beneficial in the development of the XML Catalogs specification. During a key period of work on this specification, two of the seven committee members were from the Debian project. As a result, the final specification will be more easily implementable on Debian than it otherwise might've been."

A DebConf4 schedule has been posted. A small budget was found to provide needy Debian developers with some help for their DebConf travel expenses.

Here's a brief guide on Migrating to Linux Kernel 2.6 in Debian. (Found on Debian Planet)

Comments (none posted)

Security Takes Lead in Red Hat Enterprise Linux

Red Hat, Inc. has announced a two-year roadmap for security in Red Hat Enterprise Linux. This press release highlights the work done by Red Hat to achieve government security standards, security certifications and with the NSA-developed SELinux.

Comments (none posted)

Revealed: how Fedora and the community interact

Since the announcement of the Fedora project, many developers in the community have wondered just how they can participate in this project and influence its direction. For the most part they are still wondering. For your amusement, we recommend reading the following transcript, unearthed by Konstantin Ryabitsev and posted to fedora-devel, which describes those interactions in detail.

Full Story (comments: 50)

Gentoo Weekly Newsletter - Volume 3, Issue 18

The Gentoo Weekly Newsletter for the week of May 3, 2004 is out. This week's topics include an article by Grant Goodyear on Daniel Robbins' contribution to Gentoo, an article by Bryan Ostergaard on the tenth BugDay, and more.

Full Story (comments: none)

Slackware Linux

Slackware current has upgraded Xrender to 0.8.4 and Xcursor to 1.1.2 in XFree86 4.4.0, and qt-3.3.2 and x11-devel-6.7.0 are now in testing. There were also several security issues fixed in both -stable and -current.

Comments (none posted)

New Distributions

APAWS Linux with Gallery

APAWS Linux with Gallery is a customized mini Linux distribution that runs mostly in RAM and includes everything you need to run a personal photo repository using Gallery. It is about 40MB in size and is configured with defaults to let you upload photos straight after booting it. A demo version of APAWS 1.0.0, that runs on Windows 2000 or XP, became available May 4, 2004.

Comments (none posted)

ariane

ariane is a console-only Linux system. It boots from CD-ROM into RAM and does not require a hard disk. It can also be booted from PXE or USB. It can be used for everything a minimal Linux system could be used for. ariane joins the list at version 434/51, released May 1, 2004.

Comments (none posted)

Ewrt

Ewrt is a Linux distribution for the Linksys WRT54G that was forked from the Linksys and Sveasoft code bases. It is designed to meet the needs of open wireless network operators by providing a captive portal based on NoCatSplash and large-scale management functionality on a stable and low-cost platform. The first public release, version 0.2 beta1, became available April 27, 2004.

Comments (none posted)

tinysofa

tinysofa is an enterprise grade operating system based on the Linux kernel. Optimized for i586 and up, tinysofa aims to be stable, secure, well-supported, easily managed and free. Trustix Secure Linux was used as a base for tinysofa. Version 1.0 was released April 29, 2004. (Thanks to Joe Klemmer)

Comments (none posted)

Tkfp Live ISO! Uploaded to Sourceforge (LinuxMedNews)

LinuxMedNews reports the release of a Tkfp Live! .iso image file. This bootable CD contains a configured and working copy of Tkfp running on Slackware 9.0 using WindowMaker as the window manager. Tkfp is an electronic medical record information system suitable for a solo or small group Physician's office for storing clinical information on patients.

Comments (none posted)

Minor distribution updates

Astaro Security Linux

Astaro Security Linux has released v5.004 with major bugfixes. "Changes: This Up2Date added functionality to configure the WebAdmin packetfilter logging. It also fixed a DHCP client issue, a DSL reconnect problem, and a POP3 mail retrieving/deleting issue with Outlook Express 6, and corrected problems where the WebAdmin clock always showed GMT, the HTTP proxy restarted too often, and that WebAdmin needed a lot of RAM for large packetfilter rulesets."

Comments (none posted)

Aurox Linux

Aurox Linux has released v9.3.1 with minor bugfixes. "Changes: This version is an update release. Some bugs that were found in 9.3 were fixed. The distribution is contained in only two CDs, and it lacks localizations in languages other than English and Polish. The packages of this release are also available via FTP (yum and apt-get)."

Comments (none posted)

BasicLinux

BasicLinux has released v3.20 with major feature enhancements. "Changes: Several enhancements for old laptops, including PCMCIA capability and MagicPoint (similar to PowerPoint)."

Comments (none posted)

Buffalo Linux

Buffalo Linux has released v1.2.1 with minor feature enhancements. "Changes: Ximian Evolution (in the GNOME bundle), GIMP 2.0.1, MySQL 4.0.18, and a Buffalo version of 'swaret-1.6.2' are included. This release includes 55 minor package upgrades to synchronize with Slackware-Current (as of 24 Apr 2004). A 56MB upgrade (upgrade-1.2.1-buff-1.bz2) from 1.2.0 to 1.2.1 is available."

Comments (none posted)

Feather Linux

Feather Linux has released v0.4.1 with major feature enhancements. "Changes: The list of documentation was updated, and the scripts were organized. bcrypt and xmms-cdread were added. Scripts were added to download Audacity and to remove the dpkg structure. A serial mouse option was added to X setup. Monkey was updated to 0.8.2, and the daemon script was changed accordingly. Memory checks were added to some scripts. An error with /opt on bootup was fixed. The dillo homepage was changed. The "xdef" boot option was added. XCDRoast was replaced with Gcombust. libpcap and tcpdump were added. wdict was updated."

Comments (none posted)

Fli4l

Fli4l (Floppy ISDN/DSL) has released v2.1.7 with minor feature enhancements. "Changes: Kernel 2.4.26 and uClibc 0.9.26 are now used. The RAM disks were replaced by tmpfs. The SSHD now supports TCP forwarding once again. Multiple W-LAN cards are supported, and WEP keys can be entered in a Windows-compatible form. raw-up/raw-down scripts similar to ip-up/ip-down were provided for raw ISDN circuits, and some minor fixes and changes were made."

Comments (none posted)

Franki/Earlgrey Linux

Franki/Earlgrey Linux has released v0.4.11pre1 with minor feature enhancements. "Changes: This disk release is built with latest Scripts (0.4.11) and previews changes in the forthcoming release's init scripts (in particular, a mount point for UMSDOS-formatted floppies in addition to VFAT)."

Comments (none posted)

Linux From Scratch

Linux From Scratch has released v5.1-pre2.

Comments (none posted)

Linux LiveCD

Linux LiveCD has released v1.9.3 with minor bugfixes. "Changes: This release has a new Webmin Web interface (version 1.140), new Web modules for network configuration and log rotation, and an ndiswrapper driver to use wifi Windows drivers in /opt/drivers. There are minor dbdif config bugfixes."

Comments (none posted)

Linux Netwosix Call for participation

Linux Netwosix is seeking additional developers to help maintain and improve its security oriented distribution.

Full Story (comments: none)

Sentry Firewall

Sentry Firewall has released v1.5.0-rc12 with major security fixes. "Changes: The Linux kernel was updated to version 2.4.26-ow1. The vsftp and SUSE Proxy-Suite (ftp-proxy) packages were added, and Snort was updated to version 2.1.2. There were also several changes to the rc.inet2 init script, and rc.inet2.conf was added."

Comments (none posted)

Trustix Secure Linux

Trustix Secure Linux has a bug fix advisory for apache, cyrus-imapd, fcron, libpcap, and squid. Updated packages are available for TSL 2.1 and TSEL 2.

Full Story (comments: none)

Distribution reviews

College Linux 2.5 Reviewed (Mad Penguin)

Here's a Mad Penguin review of College Linux 2.5. "With a simple setup of username/password at configuration time, Apache, MySQL, PHP, Webmin, SQLite, and phpmyadmin have been installed and configured. This is something that I always set up when I install a new distribution, and it always takes more time than I expect it to (and a lot more time than I'd like it to). College Linux did all the hard work for me, and it was clear sailing for development from that point. I can't stress enough how useful this is to me (and many others) - web development is a very common practice among people who use Linux, especially college students. This, coupled with the inclusion of Quanta Plus, makes a complete web development environment simple for anyone."

Comments (none posted)

Getting Linux into Windows (P2P.net)

P2P.net takes a look at Turbolinux 10 F, especially its ability to read Windows Media files its Apple iPod player support. "Among Linux distributors as Linspire (ex-Lindows) or Xandros Inc, Turbolinux emerges as the first to ship a media player that accepts proprietary formats."

Comments (none posted)

Page editor: Rebecca Sobol

Development

Eclipse brings WebTools back to life

With the great help of the Project Proposal Shepherds of Eclipse, the ObjectWeb Consortium has kicked off a new Web Tools Platform Project proposal. The goal of this proposal is to apply the Eclipse standards of technical excellence, functional innovation and overall extensibility to the Web/J2EE application-tooling domain. The full proposal is available online.

Following the Eclipse development process, based on the principles of openness and frequent review, the community is invited to join the discussions on the Eclipse Web Tools Platform Project Proposal. During the 30 calendar day review period, the community is invited to comment on, critique, contribute to, and join the project. At the end of the review period (May 27th, 2004), the feedback will be gathered and presented to the Board of Directors. A positive vote by the Eclipse Board will officially launch the project.

Web Standard Tools

The Web Standard Tools subproject aims to provide a common infrastructure to any Eclipse-based development environment, targeting Web-enabled applications. Within its scope will be tools for the development of three-tier (presentation, business and data logic), and server publication of corresponding system artifacts. Outside of its scope will be server-side Java technology, which will be left to the J2EE Web Tools subproject.

Tools provided will include editors, validators and document generators for artifacts developed in a wide range of standard languages (for example, HTML/xHMTL, Web services, XQueries, SQL, etc.) Supporting infrastructure will likely comprise a specialized workbench supporting actions such as publish, run, and start/stop of Web application code across target server environments.

By providing an integrated set of capabilities, the Web Standard Tools would support use cases such as:

• Developing and publishing a static HTML site.
• Deploying an applet on a given http server.
• Developing and publishing a WSDL schema on a UDDI registry.

J2EE Standard Tools

The initial goal of the J2EE Standard Tools subproject will be to provide a basic Eclipse plug-in for developing applications based on J2EE 1.4. The subproject will target J2EE-compliant application servers as well as a generic J2EE tooling infrastructure for other Eclipse-based development products.

The J2EE Standard Tools will include an integrated workbench that will provide a framework for developing, deploying, testing and debugging J2EE applications on standards-compliant server environments. It will also provide an exemplary implementation for an open source J2EE Server.

Included will be a range of tools for simplifying development with J2EE APIs, including EJB, Servlet, JSP, JCA, JDBC, JTA, JMS, JMX, JNDI, and Web Services. This infrastructure will be architected for extensibility of higher-level development constructs, providing architectural separations of concern and technical abstraction above the level of the J2EE specifications

The integrated workbench would support use cases such as:

• Developing a JSP page.
• Enhancing the "PetStore" blueprint application.
• Exposing a Session Bean as a Web Service.

Christophe Ney has submitted a Web Tools Platform Project Proposal that has more details, and includes instructions on getting involved in the project.

Comments (none posted)

System Applications

Audio Projects

ALSA 1.04 released

Version 1.04 of the ALSA Sound Driver has been released with this description: "mostly bug-fixes and cleanups".

Comments (none posted)

libfishsound 0.6.1 is out

Version 0.6.1 of libfishsound, a programming interface for the Vorbis and Speex audio codecs, is out. This release features new functions, new test features, and bug fixes.

Full Story (comments: none)

Planet CCRMA Changes

The latest changes from the Planet CCRMA audio utility packaging project include new versions of VCO Plugins, the Alsa Modular Synth, MCP Plugins, and Qjackctl.

Comments (none posted)

Database Software

PostgreSQL Weekly News

The PostgreSQL Weekly News for May 3, 2004 is available.

Full Story (comments: none)

Filesystem Utilities

libgsf 1.9.0 released

Version 1.9.0 of libgsf is out. "It's goal is to provide a simple i/o library that can read and write common file types and to handle structured formats that provide file-system-in-a-file semantics (Eg OLE2 or zip)." This high priority release fixes a corruption problem that happens when using gzip and bzip2.

Full Story (comments: none)

Interoperability

Samba 3.0.3 Available for Download

Stable version 3.0.3 of Samba has been released. "There have been several issues fixes since the 3.0.2a release and new features have been added as well."

Full Story (comments: none)

Networking Tools

Firestarter 0.9.3 announced

Version 0.9.3 of Firestarter, a visual firewall tool for GNOME, is available with lots of changes and bug fixes.

Full Story (comments: none)

Printing

gnome-u2ps 0.0.3 is available

Version 0.0.3 of gnome-u2ps, a text to postscript converter, is out. "It aims to handle modern codesets and mails that a2ps does not support, and more internationalized than ever."

Full Story (comments: none)

Web Site Development

Rapid Web Application Deployment with Maypole

Simon Cozens has written part two of his O'Reilly series on Maypole. "When we last left our intrepid web developer, he had successfully set up an online sales catalogue in 11 lines of code. Now, however, he has to move on to turning this into a sales site with a shopping cart and all the usual trimmings. It's time to see some of that flexibility we talked about last week; unfortunately this means we're going to have to write some more code, but we can't have everything."

You may want to start with part one first.

Comments (none posted)

MediaWiki 1.2.5 released (SourceForge)

Version 1.2.5 of MediaWiki is available, and features a number of bug fixes. "MediaWiki is the collaborative editing software that runs Wikipedia, the free encyclopedia, and other projects."

Comments (none posted)

Desktop Applications

Accessibility

gnopernicus 0.9.1

Version 0.91 of gnopernicus, a GNOME desktop screen reader for the blind and visually impaired, is out with a variety of new features.

Full Story (comments: none)

Audio Applications

Rhythmbox 0.8.2 is out

Version 0.8.2 of Rhythmbox, a music playing application, is available, here are the changes: "A number of bug fixes in this release. In particular if you're in a RTL locale you'll really want to upgrade. Also if you like the previous button to work in playlists :)"

Full Story (comments: none)

Sweep 0.8.3 Released

Version 0.8.3 of Sweep, an audio editor and playback tool, is out. "This is a maintainance release, including a new Spanish translation, various bugfixes and no new functionality."

Full Story (comments: none)

CAD

PythonCAD Release Number 13

Release number 13 of PythonCAD is available. "The thirteenth release of PythonCAD is the first release to offer undo/redo abilities. The undo/redo work is in its initial stage, and upcoming releases will enhance the robustness of the code. The long term goal with undo/redo work is to make both as unlimited as possible, but for the first release the functionality works best if only the last action is undone or redone."

Full Story (comments: none)

Data Visualization

JGraph Paris (v3.4) released (SourceForge)

Version 3.4 of JGraph, a cross-platform graph component for Java, has been released. JGraph is used for plotting networks of objects. "This release can handle overlapping edges, and has static inner handles for better subclassing. Among other minor API changes some control methods were moved to the handles."

Comments (none posted)

Desktop Environments

COnfigurator for Gnome 0.7.1

Version 0.7.1 of COnfigurator for Gnome is out with several minor improvements.

Full Story (comments: none)

KDE-CVS-Digest (KDE.News)

The April 30, 2004 edition of the KDE-CVS-Digest is available. Here's the content summary: "KDE Bluetooth improves Device Discovery Service. Kopete has a new history browser. Optimizations in K-menu drawing and Kmail POP fetching. Kdebindings adds a graphical tool with wizards for generating bindings. KMail adds support for Annoyance-Filter anti-spam tool."

Comments (none posted)

Kexi 0.1 Beta 3 Announcement

Version 0.1 beta 3 of Kexi, an integrated data management environment for KDE, has been announced. "New features include improved table designer and data table view, more consistent GUI features, and more."

Comments (none posted)

Games

GNOME Music Quiz 0.1 announced

Version 0.1 of GNOME Music Quiz is available. "GNOME Music Quiz is a game similar to the television show 'Name That Tune' where players hear part of a song from their Rhythmbox music library and have to identify it by title/artist or album. The faster they identify a song the more points they recieve."

Full Story (comments: none)

GNOME War Pad 0.2.13 released

Version 0.2.13 of GNOME War Pad, a multi-player VGA Planets space strategy game client, is out.

Full Story (comments: none)

Graphics

Dia 0.93 released (GnomeDesktop)

Version 0.93 of Dia, the diagram creation program, has been announced. "Of major importance in this release are improvements in text rendering speed by caching PangoContexts, and the use of font-config on the Win32 side, allowing unified font handling across platforms and antialiases rendering on Win32."

Comments (none posted)

GUI Packages

gtkmm and glibmm 2.4.1 announced

Versions 2.4.1 of gtkmm and glibmm are available with support for gcc 3.4.0 and bug fixes.

Full Story (comments: none)

GTK+-2.4.1 released

Version 2.4.1 of GTK+, a toolkit for creating graphical user interfaces, is out. "This is a bug fix release and is source and binary compatible with 2.4.0. There are a considerable number of fixes in this release as compared to 2.4.0, especially in the areas of GtkFileChooser, GtkComboBox and GtkEntryCompletion."

Full Story (comments: none)

GLib-2.4.1 released

GLib version 2.4.1 is available. This release features bug fixes, new documentation, and updated translations.

Full Story (comments: none)

Glade 2.5.0 released

Version 2.5.0 of Glade, a gtk-based GUI generator, is available with bug fixes, initial support for gtkmm 2.4, and more.

Full Story (comments: none)

Bakery 2.3.3 announced

Version 2.3.3 of Bakery, a C++ Framework for creating document-based GNOME applications, is out with code cleanups and bug fixes.

Full Story (comments: none)

Imaging Applications

GIMP Animation Package version 2.0.1 Released

Version 2.0.1 of gimp-gap, the GIMP Animation Package, has been announced. "gimp-gap 2.0.1 is a bug-fix release of the GIMP Animation Package, a collection of plug-ins to extend GIMP with capabilities to edit and create animations."

Comments (none posted)

Instant Messaging

xchat-gnome-0.1 ''Doctors are Standing By'' (GnomeDesktop)

Version 0.1 of xchat-gnome-0.1, an IRC Client, has been announced. This is the first preview release. "xchat-gnome is a new branch of the xchat IRC client, aiming toward a revised and GNOME HIG-compliant UI while still taking advantage of robust and powerful xchat core. The most obvious change awaiting users familiar with the venerable Gtk+ frontend will be the new tree-based navigation".

Comments (none posted)

Mail Clients

Mozilla Thunderbird 0.6 RC2 Now Available (MozillaZine)

Release candidate 2 for Thunderbird 0.6 has been announced. "Our hopefully final set of Thunderbird 0.6 candidate builds are available for testing on all platforms. We could use help testing these bits to help find any last minute issues as we come down the final stretch for this release."

Comments (none posted)

Mozilla Thunderbird 0.6 Released (MozillaZine)

Version 0.6 of the Mozilla Thunderbird email and newsgroup application is available. "Thunderbird 0.6 has taken flight! Some of the more promiment features include a new Windows installer, Pinstripe theme for Mac OS X, new artwork, improved junk mail controls, new mail notification in the system dock for Mac OS X, server-wide news filters and a slew of other new features."

Comments (none posted)

Music Applications

MusE release 0.7pre2

Release 0.7pre2 of MusE, the Linux Music Editor, is out with lots of new features and some bug fixes.

Comments (none posted)

Office Applications

eGroupWare 1.0 RC5 released (SourceForge)

Version 1.0 RC5 of eGroupWare, a multi-user, web-based groupware suite, is available. "Currently available modules include: email, addressbook, calendar, infolog (notes, to-do's, phone calls), content management, forum, bookmarks, wiki. eGroupWare RC5 is the next step to the final 1.0 release. Many people wait for the upcoming 1.0. The developers work hard to fix the last bugs."

Comments (none posted)

Gnumeric 1.2.12 released

Gnumeric 1.2.12 has been released. The announcement describes 1.2.12 as a "high priority" release; it seems that earlier versions can create .xls files which crash Excel.

Full Story (comments: none)

Office Suites

KOffice 1.3.1 Released (KDE.News)

Version 1.3.1 of KOffice has been announced. "The KOffice team is happy to bring you the first bugfix package that builds upon the successful 1.3 version, adding even more enhanced OpenOffice.org import and export filters, improved spellchecking with ispell, fixes in hyphenation and many more."

Comments (none posted)

ooo-build 1.1.54 released

build 1.1.54 of OpenOffice.org is available. "This package contains the Gnome integration work for OpenOffice.org, and a much simplified build wrapper, making an OO.o build / install possible for the common man. It is a staging ground for up-streaming patches to OO.o. This release is mostly a snapshot of the (in-progress) merge of the SuSE patch-set, and adding a SuSE build target / distro etc."

Full Story (comments: none)

Web Browsers

Epiphany 1.2.5 Released

Version 1.2.5 of Epiphany, a browser for GNOME, is out. This release has bug fixes, more translations, and improved documentation.

Full Story (comments: none)

Mozilla Links Newsletter

The May 3, 2004 edition of the Mozilla Links Newsletter is available with the latest news of the Mozilla browser and related software.

Full Story (comments: none)

Miscellaneous

gnubiff 1.2.0 is out

Version 1.2.0 of the gnubiff mail notification program is out with bug fixes and support for multiple mail boxes.

Full Story (comments: none)

IMDbPY 1.2 released

Version 1.2 of IMDbPY, a Python package that can retrieve and manage information from the IMDb movie database, is out. "With this release it's possible to retrieve almost every available information about movies and persons. Many bugs where fixed. Introduced a test suite."

Full Story (comments: none)

Languages and Tools

C#

The first Mono beta release

The first beta version of Novell/Ximian's Mono .NET implementation is available; see the release notes for the details. There's a lot of stuff there, including a C# compiler, the runtime virtual machine, support for several architectures, various database adaptors, a "complete cryptography stack," Apache integration, and more. Regardless of whether one agrees with Mono's goals, it looks like an impressive body of work.

Comments (12 posted)

Caml

Caml Weekly News

The April 27 - May 4, 2004 Caml Weekly News is available for the week's roundup of Caml language discussions.

Full Story (comments: none)

Camlmix

A Caml language project called Camlmix has been launched. "Camlmix is a command-line tool for preprocessing any kind of file using Objective Caml as an embedded language for inline expansion."

Comments (none posted)

Java

Seven Low-Cost Ways to Improve Legacy Code (O'ReillyNet)

Robert Simmons, Jr. explains some techniques for dealing with legacy Java code on O'Reilly. "This article presents seven techniques I've developed and used in my consulting work that are designed to improve legacy code. You can apply some of these techniques using either freely available tools or with scripts. You'll apply the others manually, but they shouldn't represent a significant investment in time. Be forewarned, however, that all of these techniques may reveal other issues in the code base, such as hidden bugs, which could take a significant amount of time to fix."

Comments (none posted)

gnome-gcj 0.18.0 released

version 0.17.0 of Gnome-GCJ, an alternative set of Java bindings for GNOME, is available. "Gnome-GCJ 0.18.0 introduces a small demo application (to become extended) and both wrappers for libglade and gsf."

Full Story (comments: none)

Java authorization internals (IBM developerWorks)

Abhijit Belapurkar explains Java authorization on IBM's devloperWorks. "If you're the type who needs to know how a technology works from the inside out in order to use it effectively, you'll jump on this guided tour of the Java platform's authorization architectures. Follow along as Java architect Abhijit Belapurkar leads this detailed, behind-the-scenes introduction to two distinctly different (yet related) models of authorization: the code-centric model of the Java 2 platform security architecture and the user-centric model of the Java Authentication and Authorization Service."

Comments (none posted)

Lisp

SLIME project status report

A status report is available from the SLIME (Superior Lisp Interaction Mode for Emacs) project.

Full Story (comments: none)

Perl

This Week on perl5-porters (use Perl)

The April 26 - May 2, 2004 edition of This Week on perl5-porters is online. "This week, our p5p summary will describe a lot of little bugs, some of which were fixed, some of which weren't, in a lot of different areas of the perl interpreter."

Comments (none posted)

This Week on Perl 6 (O'Reilly)

The April 29, 2004 edition of This Week on Perl 6 has been published. "And we're back on a weekly schedule again (unless the Mayday bank holiday knocks me for six next week). As I expected, the Apocalypse has brought out a rash of prophets and prognosticators in perl6-language, but perl6-internals is still ahead on number of messages per week."

Comments (none posted)

Python

Dr. Dobb's Python-URL!

The May 3, 2004 edition of Dr. Dobb's Python-URL! is available with a new round of Python article links.

Full Story (comments: none)

Imagine Python (Dev Shed)

Mark Lee Smith explores image manipulation with Python in a Dev Shed article. "Quite a cryptic title, but if you haven’t guessed, were talking about Images. This being a Python article that’s what we're using! If you’ve never thought about it, or -- even better -- if you didn’t know it was possible then you’re in for a nice surprise; not only can Python do this but it’s pretty good at it, too. Actually, Python works well with graphics in general, but for now we’re sticking to the 2D kind."

Comments (none posted)

Tcl/Tk

Dr. Dobb's Tcl-URL!

The May 3, 2004 edition of Dr. Dobb's Tcl-URL! is available with more Tcl/Tk information and news.

Full Story (comments: none)

XML

Practical data binding: Get your feet wet in the real world (IBM developerWorks)

Brett McLaughlin discusses data binding on IBM's developerWorks. "Data binding, although commonplace in today's world of Java technology and XML programming, is still largely misunderstood. This column throws out all the theoretical claptrap and focuses on the concepts you need to get started with data binding. You will understand the differences between general data binding and data binding in the XML world, as well as round-tripping, semantic equivalence, and what to look for in a data binding package."

Comments (none posted)

UBL: A Lingua Franca for Common Business Information (O'Reilly)

Dale Waldt introduces UBL on O'Reilly. "The Universal Business Language ( UBL) is a language for capturing business information for use in integrating business systems and sharing data with trading partners. UBL was designed from the beginning to leverage the many vocabularies and experiences available in existing systems using EDI (Electronic Data Interchange), ebXML (Electronic Business XML), and other XML and Web-based e-commerce systems."

Comments (none posted)

Test Suites

STAF V2.6.2 is now available (SourceForge)

Version 2.6.2 of STAF, the Software Testing Automation Framework, is out with several bug fixes. Version 3.0.0 Beta 2 is also available. "The Software Testing Automation Framework (STAF) is a framework designed to improve the level of reuse and automation in test cases and test environments. The goal of STAF is to provide a complete end-to-end automation solution for testers."

Comments (none posted)

Miscellaneous

Do As They Need, Not As They Say (O'Reilly)

Jeff Lowery writes about software transition issues on O'Reilly. "In this article, I would like to address some of the difficulties involved in replacing an existing client system with a completely new one. Having gone through this process several times in my career, there are some lessons I have learned that can make this transition easier for the end user. The key is not to take an initial set of requirements at face value, but to work with the future users of the new system (in conjunction with their management) to make sure what's delivered is what's needed."

Comments (none posted)

Page editor: Forrest Cook

Linux in the news

Recommended Reading

Linux lacks testing methodologies (NewsForge)

NewsForge covers efforts at OSDL to get application vendors to test their products, and to share both methods and results. "OSDL lab manager and open source test-giver Tim Witham is on a mission to push Linux performance testing to higher-level, real-world applications, to produce reliable, retestable, comparable data that will let users compare the operating systems or open source applications in a transparent fashion."

Comments (1 posted)

Plugging the Linux holes (News.com)

News.com perceives a lack of applications for desktop Linux. "Linux applications are a "which came first, chicken or egg" situation for most major application sellers. There's not enough of a user base now to justify development of Linux products, but the absence of familiar applications slows growth of the Linux user base."

Comments (12 posted)

The Importance of Linux (linux.com)

Linux.com presents an article by the author of Advanced UNIX Programming. "Of course readers of a book learn from it, but authors learn from writing it, too. One of the most surprising things I learned from writing the second edition of Advanced UNIX Programming was how good Linux really is."

Comments (3 posted)

The SCO Problem

SCO's answer to IBM's second amended counterclaims (Groklaw)

Groklaw has a text version of SCO's answer to IBM's second amended counterclaims, along with some commentary from PJ. "This is the happy day that SCO acknowledges by its actions -- although it failed to put out a press release -- that the GPL isn't unconstitutional after all.... They do still claim the GPL is void or voidable, that it is unenforceable, and that the FSF selectively enforces it, so not all the silliness is gone. But they have tucked tail and begun to back down. They are getting their PhD in the GPL, and in time it will gradually dawn on them that they are wrong about all the rest too."

Comments (3 posted)

DaimlerChrysler's response to SCO (Groklaw)

Groklaw has posted a text version of DaimlerChrysler's response to SCO's complaint. It is short and sweet, as these things go. "Defendant DaimlerChrysler Corporation respectfully requests that this Court dismiss Plaintiff's Complaint with prejudice, award DCC its costs and attorney's fees as may be permitted by law, and grant such other relief as may be appropriate." (See also: this table which puts the complaint and the responses side by side).

Comments (1 posted)

SCO cuts jobs to reach product profit (News.com)

News.com reports that the SCO Group has laid off a batch of employees. "The cuts took place at the end of the company's second fiscal quarter and were part of its goal 'of trying to be profitable within our core business'--selling the UnixWare and OpenServer Unix products..."

Comments (7 posted)

Companies

Google files for unusual $2.7 billion IPO (News.com)

News.com takes a look at Google's IPO plans. "In an unusual provision for a technology company, Google will create two classes of shares with different voting rights, a move that aims to guarantee that founders Sergey Brin and Larry Page will maintain decision-making authority. Such structures have proved beneficial in media companies such as The New York Times, the filing states."

Comments (none posted)

Google Prepares Very Creatively to IPO (Groklaw)

Here's Groklaw's take on the Google IPO. "If you think they are dewy-eyed innocents, consider that last year, "Google made almost a billion dollars in revenues in 2003, and earned about $100 million on those revenues. It looks like the technology is yielding significant returns on investments that have gotten them to the point where they are sitting on almost half a billion dollars in cash.""

Comments (1 posted)

Microsoft's Ballmer: "Linux Requires Our Concentrated Focus and Attention" (LinuxWorld.com)

LinuxWorld.com reports on a memo sent to Microsoft employees by CEO Steve Ballmer. "In this environment of lean budgets and concerns about Microsoft's attention to customers, noncommercial software such as Linux and OpenOffice is seen as an interesting, 'good enough' or 'free' alternative."

Comments (14 posted)

Red Hat gains security certification (News.com)

News.com reports on the EAL2 security certification of Red Hat Enterprise Linux 3. "Version 3 of Red Hat Enterprise Linux has been certified to meet Evaluation Assurance Level 2 (EAL2) of the Common Criteria certification, Red Hat said Thursday. The internationally recognized Common Criteria certification is a typical requirement for government customers. However, Red Hat still lags its main rival, Novell, whose SuSE Linux has been certified to the more stringent EAL3. It also trails versions of Unix and Windows that have EAL4 certification."

Comments (8 posted)

Business

Red Hat Introduces Desktop Linux Competitor (eWeek)

eWeek looks forward to Red Hat's upcoming desktop announcement. "Pricing for the new desktop will take two forms: for $2,500 a year, customers will receive a Red Hat Network Proxy starter pack that contains a Red Hat Network Proxy server, including Red Hat Enterprise Linux Advanced Server Premium, and 10 kits each of desktops and desktop management modules. It will include 30 days of phone support and one year of Web-based support." There's also an expensive option.

Comments (3 posted)

Interviews

Analyst Stacey Quandt on the future of Linux (IBM)

The IBM Linux Portal has an interview with industry analyst Stacy Quandt. "Within the next three years I believe Linux will overtake Windows as the number one operating system based on new server shipments. Another milestone to watch for is when Linux gains enough momentum on the desktop to pull in more ISVs. There’s the potential for a lot of innovation that could take place in user space applications on Linux. The desktop is Microsoft’s last stronghold in the market. So there’s a lot of potential for Linux to become a much stronger play there."

Comments (23 posted)

Sun considers GPL license for Solaris (InfoWorld)

InfoWorld talks to Jonathan Schwartz, president and COO of Sun. "Though Sun executives have been cool on the GPL in the past, Schwartz said there was "not a lot" preventing Sun from releasing Solaris under the GPL. It would offer support contracts as an option, in a model similar to that of Red Hat Inc. "We view the GPL as a friend. Remember, (Sun) was built off of BSD and the BSD license," he said, referring to the open-source Berkeley Software Distribution license." (Thanks to Jingmin (Jimmy) Zhou)

Comments (7 posted)

Red Hat's Szulik sees desktop Linux take off (ComputerWorld)

ComputerWorld interviews Red Hat CEO Matthew Szulik. "And when you look at the computing you and I will be using over the next 10 years, we won't have software resident on our hard drive. You'll go to somebody -- it may well be Red Hat -- and you'll get an e-mail package, a calendaring function, and it will be a subscription-based Web service. It's not that far away; look at what people do with their cellular phones today."

Comments (7 posted)

Resources

Switching from Internet Explorer to Mozilla for Enterprises (MozillaZine)

MozillaZine points to an article on changing from Microsoft's IE browser to Mozilla. "Nigel McFarlane, SearchEnterpriseLinux.com's resident Mozilla specialist, offers advice on how to avoid potential pitfalls and discusses whether businesses should migrate to the Mozilla Application Suite or Mozilla Firefox and Mozilla Thunderbird."

Comments (none posted)

Zap Annoyances on the Web (Linux Journal)

Linux Journal takes a look at how to make web browsing more fun and less annoying in a two part article. Part 1 shows how to configure the Mozilla browser and set up squid as a proxy server to get rid of some annoyances. Then in part 2 see how AdZapper can be used to block many ads and Web bugs.

Comments (2 posted)

Reviews

CinePaint: The GIMP Goes Hollywood (O'ReillyNet)

O'ReillyNet examines CinePaint. "CinePaint started as a development version of The GIMP, sponsored by the film industry in 1998. The GIMP evolved in a different direction, though, and The GIMP team abandoned the code to languish in CVS. As an example of what CinePaint developers call the "Lazarus effect," useful open source projects never need to die. Though Film GIMP never saw a public release, the current CinePaint team came together, resurrecting and renaming the project. Development continues to this day."

Comments (4 posted)

coLinux: Linux for Windows Without Rebooting (O'ReillyNet)

O'ReillyNet explores coLinux. "What if you want to run GNU/Linux atop a Windows platform or try Linux without installing it on a partition itself, thereby preserving -- and not even rebooting -- your Windows system? Don't worry; VMware and Virtual PC are not your only choices. A new free software project called coLinux, or Cooperative Linux, lets you do nearly everything User-mode Linux does on Windows 2000 or XP."

Comments (3 posted)

Free Software's new audio heir apparent (NewsForge)

NewsForge takes a look at Rhythmbox. "Rhythmbox is comparable to Apple's iTunes in that it concentrates on organizing your music collection and making it easier to navigate through it. It is not intended to be an eye-candy skinnable player that goes hand in hand with dark rooms, black lights, and glow sticks. The program has advanced playlist functionality which reads the identification tags of MP3, OGG, and other formats playable by the up-and-coming GStreamer -- a powerful open source multimedia framework multimedia framework."

Comments (4 posted)

Star Office, Ready For the Big Time? (IT-Director)

IT-Director.com reviews version 7 of StarOffice. "Star Office is already very popular and has become something of a standard on Linux PCs often in the guise of Open Office, its open source brother. Sun acquired Star Division GmbH 5 years ago, with the clear intention of competing directly with Microsoft. It has taken time for Sun to establish a competitive position though. Star Office never got strong reviews until version 6, which debuted in early 2002. It is just now in version 7, which is attracting even more attention because of the quality of the release."

Comments (8 posted)

Cooking with Linux does SuperKaramba (Linux Journal)

Linux Journal's Cooking with Linux series looks at SuperKaramba. "Desktop wallpaper is interesting enough, but dynamic applications can be put on the desktop as well. For instance, imagine a monitor for CPU usage, disk space and network activity floating transparently on your desktop, constantly being updated. If this sounds interesting, get your hands on Adam Geitgey's SuperKaramba. " (Found on KDE.News)

Comments (none posted)

First Geronimo code released, cert tests set for May (NewsForge)

NewsForge covers the release of Geronimo Milestone 1.0, an open source J2EE project from Apache. "Geronimo's milestone release is a wakeup call for Java/J2EE devs who thought Geronimo's open source J2EE 1.4 stack was a far-off dream. The release is also a signal to J2EE CIOs/devs who are concerned about the high cost and complexity of commercial J2EE app servers, that open source options may be closer than they thought."

Comments (none posted)

Miscellaneous

Reboot Linux faster using kexec (developerWorks)

developerWorks looks at the kexec patch. "Kexec is a patch to the Linux kernel that allows you to boot directly to a new kernel from the currently running one. In the boot sequence described above, kexec skips the entire bootloader stage (the first part) and directly jumps into the kernel that we want to boot to. There is no hardware reset, no firmware operation, and no bootloader involved. The weakest link in the boot sequence -- that is, the firmware -- is completely avoided. The big gain from this feature is that system reboots are now extremely fast." (LWN also looked at kexec in November, 2002).

Comments (9 posted)

Page editor: Forrest Cook

Announcements

Non-Commercial announcements

Customize.org Invites the KDE Community (KDE.News)

KDE.News has announced an invitation for KDE to join Customize.org. "Recently Customize.org, one of the original desktop customization sites on the Web, has added some sections for KDE skins, themes and art such as cursors for general X11. We'd like to invite the KDE art community to submit their work to our site. By attempting to bring GNOME, KDE, and Windows artists together under one roof, we hope that we can increase porting and cooperation among all the communities."

Comments (none posted)

Free search engine software gains popularity

A press release promotes the Xapian search engine: "Xapian, licensed under the GNU General Public License (GPL), is free software originally developed at Brightstation PLC as a replacement for Muscat, the first commercial probabilistic search engine. When Brightstation ceased trading in 2001 some of the team that created Xapian decided to continue developing the software and it is available for free download at www.xapian.org. After three years of subsequent development Xapian is now available for Solaris, Unix, Linux and Windows platforms and is mature and stable with a highly active developer community."

Full Story (comments: none)

OpenEMR - An IBM Global Partner (LinuxMedNews)

OpenEMR, an open source electronic medical record and practice management application, has been accepted into IBM's Global Solutions Directory. "IBM's Global Solutions Directory is an online directory containing thousands of applications, tools and services from IBM and IBM Business Partners."

Comments (none posted)

Commercial announcements

Concurrent Announces iHawk Real-Time Linux Systems Powered By AMD Opteron Processor-Based Servers From Celestica

Concurrent Computer Corporation has announced the availability of 64 bit versions of its iHawk Series 870 systems running Linux.

Comments (none posted)

Green Hills Software strikes again

Green Hills Software continues its FUD campaign with a "white paper" entitled "Linux Security: Unfit for Retrofit." It's a piece of work. "Publishing the source code for the operating systems used in our most critical defense systems is analogous to publishing the wiring diagrams for our military base security systems. Our enemies will be able to study the vulnerabilites [sic] of the software controlling our defense systems at their leisure.... Many people argue that open source programs are inherently more secure than 'proprietary' programs because publishing the source code for the program enables many people to look at the source code and find any vulnerabilities in it. This is based on the misconception that looking at the source code is an effective means of finding vulnerabilities, which it is not."

Comments (27 posted)

National Retail Federation trashes SCO suit

The National Retail Federation, "the world's largest retail trade association," has put out a press release stating its belief that SCO's lawsuits are unfounded. "NRF expects that retailers who use Linux will survive the current litigation."

Comments (6 posted)

New Books

Python Success Stories, volume II

O'Reilly & Associates has agreed to print a second volume of Python Success Stories and the search is on for new stories.

Full Story (comments: none)

"Linux Unwired" Released by O'Reilly

O'Reilly has published the book Linux Unwired by Roger Weeks, Edd Dumbill, and Brian Jepson.

Full Story (comments: none)

"Learning Red Hat Enterprise Linux & Fedora, Fourth Edition" Released by O'Reilly

O'Reilly has published the fourth edition of Learning Red Hat Enterprise Linux and Fedora by Bill McCarty.

Full Story (comments: none)

Resources

2004 Posix 1003.1 Standard Published

The 2004 Posix 1003.1 Standard has been published. "This latest edition incorporates the recently published Technical Corrigendum 2. The specifications are freely available in html."

Full Story (comments: none)

Contests and Awards

LinuxUser & Developers Expo Awards Recognize Arkeia as Top Data Storage Solution

Arkeia Network Backup was selected Best Data Storage Solution at the prestigious LinuxUser & Developer Awards announced in London last week.

Full Story (comments: none)

Event Reports

open source and health informatics thinktank report (LinuxMedNews)

LinuxMedNews has announced the publication of a report from the Open Steps thinktank meeting that was held on February 2004 in Winchester, UK. "The main purpose of the Marwell Open Steps meeting was - to identify key issues, opportunities, obstacles, areas of work and research that may be needed, and other relevant aspects, around the potential for using open source software, solutions and approaches within health care, and in particular within health informatics, in the UK and Europe."

Comments (none posted)

X Developer's Meeting (GnomeDesktop)

Federico Mena-Quintero's web log has ongoing coverage of the X Developer's Meeting in Cambridge, Massachusetts. ( Found on GnomeDesktop.org.)

Comments (2 posted)

Upcoming Events

KDE Community World Summit Registration Now Opened! (KDE.News)

Registration has been announced for the KDE Community World Summit. The event will take place from August 21-19, 2004 in Ludwigsburg, Germany.

Comments (none posted)

LinuxWorld Conference & Expo Keynotes to Spotlight Customer Success Stories

IDG World Expo has announced the keynote line-up for LinuxWorld Conference & Expo, which will take place August 2-5, 2004 at the Moscone Center in San Francisco. Executives from Red Hat, HP, Oracle, IBM and BEA Systems will be joined by customers who will provide examples and describe the real-world benefits of Linux and open source.

Full Story (comments: 2)

Opensource Software in Health Care Symposium (LinuxMedNews)

Linux Med News has an announcement for the Opensource Software in Health Care Symposium. "On Tuesday morning May 11/2004 opensource developers and enthusiasts in health care will convene at the University of Toronto for a 1/2 day workshop on Opensource Systems in Health Care. The workshop is part of a 3-day conference entitled Opensource and Free Software: Concepts, Controversies and Solutions presented by the Knowledge Media Design Institute at the University."

Comments (none posted)

OLS early registration deadline

A reminder has been sent out from the folks at the Ottawa Linux Symposium, early registration discounts are ending soon.

Full Story (comments: none)

Software Patents in Europe - action week

The Free Software Foundation Europe and the Foundation for a Free Informational Infrastructure are endorsing an action week from May 10th to 14th to inform citizens, economy and politics about the harmful consequences of software patents.

Full Story (comments: none)

Events: May 6 - July 1, 2004

Date	Event	Location
May 6 - 8, 2004	TheServerSide Java Symposium	(The Venetian)Las Vegas, NV
May 6 - 8, 2004	Web.It 2004	Padova, Italy
May 9 - 11, 2004	Open Source Conference	(University of Toronto)Toronto, Canada
May 11 - 12, 2004	LinuxWorld Conference & Expo	(Hotel Istana)Kuala Lumpur, Malaysia
May 16 - 18, 2004	European Firebird Conference 2004	Fulda, Germany
May 17 - 20, 2004	Fifth LCI International Conference on Linux Clusters	(University of Texas)Austin, TX
May 17 - 19, 2004	Enterprise Software Summit	(The Palace Hotel)San Francisco, CA
May 17 - 20, 2004	Black Hat Briefings Europe 2004	(Grand Hotel Krasnapolsky)Amsterdam, the Netherlands
May 17 - 21, 2004	Apache Boot Camp	Atlanta, GA
May 20 - 22, 2004	Austrian Perl Workshop	Vienna, Austria
May 24 - 26, 2004	GridToday 2004	(Philadelphia Convention Center)Philadelphia, PA
May 25 - 26, 2004	LinuxWorld Conference & Expo	(Suntec)Singapore
May 26 - June 6, 2004	DebConf4	Porto Alegre, Brazil
May 26 - 29, 2004	2nd International Symposium on Computer Music Modeling and Retrieval	Esbjerg, Denmark
June 2 - 4, 2004	2004 GCC and GNU Toolchain Developer's Summit	(Ottawa Congress Centre)Ottawa, Canada
June 3 - 4, 2004	Web.It 2004	Milano, Italy
June 6 - 7, 2004	French Perl Workshop	Paris, France
June 7 - 9, 2004	EuroPython	(Chalmers University of Technology)Göteborg, Sweden
June 13, 2004	1st European Lisp and Scheme Workshop	Oslo, Norway
June 14 - 18, 2004	18th European Conference on Object-Oriented Programming(ECOOP-2004)	(The University of Oslo)Oslo, Norway
June 16 - 18, 2004	Yet Another Perl Conference(YAPC::NA::2004)	(University at Buffalo)Buffalo, NY
June 16 - 18, 2004	YAPC::NA 2004	(University at Buffalo)Buffalo, NY
June 28 - 30, 2004	GNOME User and Developer European Conference(GUADEC)	Kristiansand, Norway
June 29 - July 1, 2004	Perl Workshop 6.0	(Barbara-Künkelin-Halle)Schorndorf, Germany

Comments (none posted)

Web sites

MozillaZine Update (MozillaZine)

The folks at MozillaZine have posted a site update. "First, we're proud to announce that the forums, which are roughly a year and a half old, have now reached 40,000 members, and over 500,000 posts. They have become the main venue for users and developers alike, and have also become one of the more valuable support resources in the community."

Comments (none posted)

OldLinux.org

Here's a website for history buffs. OldLinux.org seeks to collect all the materials related to the ancient Linux for historic testimony and rebuild the oldest Linux systems. You'll also find an ebook (in Chinese), A Heavily Commented Linux kernel Source Code - (Kernel 0.11). [Thanks to Jingmin (Jimmy) Zhou]

Comments (none posted)

Software announcements

This week's software announcements

Here are the software announcements, courtesy of Freshmeat.net. They are available in two formats:

• Sorted alphabetically,
• Sorted by license.

Comments (none posted)

Page editor: Forrest Cook