LWN.net Weekly Edition for July 22, 2004

Debian debates amd64 port

The discussion over whether to put AMD64 processor support into the Sarge and Sid releases of the Debian distribution has heated up. The discussion has been brewing for some time, particularly since Chris Cheney's post to the debian-devel-announce list on July 1:

After much discussion on Cheney's post, Josselin Mouette proposed a General Resolution (GR) that would require "amd64," based on the pure 64-bit port, to be included immediately in Sid and the auto-building infrastructure, and that Sarge include the amd64 port. The GR also gives amd64 a pass on Linux Standard Base (LSB) compliance, so that non-compliance with the LSB would not be considered a release-critical bug.

The discussion on the debian-devel has largely conflagrated into a flame-fest of near-epic proportions -- mostly unrelated to the merits of including amd64 in Sid or Sarge.

One can understand why Debian users and developers may be frustrated at the lack of progress in an official AMD64 port. It is not unreasonable to expect a response on such an important issue within a two-week period. Even a terse reply is better than silence.

However, it is probably a bad idea to rush the process excessively as well. As Thomas Bushnell states:

Goswin von Brederlow suggests an alternative draft that might make the GR more acceptable. This draft would "overturn the decision (made through inaction) to block amd64 from sid by the ftp-master team," unless amd64 is added to sid, or the ftp-masters team steps up to explain why amd64 should not be added to sid, or there is a change in the ftp-masters team that would "facilitate better communications."

At this time, the GR to force AMD64 into Sarge and Sid is waiting on a fifth sponsor to move its status to discussion. Cheney had originally signed on as a sponsor for the GR, but has apparently withdrawn his support for the GR. It is probably for the best that this GR does not come to a vote, in order to allow everyone some cooling-off time on the issue.

It is a shame to see something as desirable as an official amd64 port becoming the victim of poor communication (or no communication) and/or personality conflicts. Though there are indeed technical issues to be sorted through to make an official amd64 port happen, it seems that they have taken a back seat.

There is little doubt, at least in this writer's mind, that 64-bit extensions to the x86 architecture are likely to become the standard over time -- and sooner than the next stable release of Debian after Sarge. If the amd64 port is delayed until after the Sarge release, it seems likely that Debian will lose a number of users who are unwilling to wait until that time to make use of their 64-bit hardware or stay on the 32-bit path.

Comments (15 posted)

The Grumpy Editor, graphical mail clients, and GPG

This article is part of the LWN Grumpy Editor series.

Your editor's review of graphical email clients drew a couple of complaints for having neglected to look at how those clients handle message encryption and authentication. There is a confession to be made here: your editor, despite having been an enthusiastic cypherpunks participant many years ago, despite believing that email should be encrypted whenever possible ("why communicate via postcards" and all that), and despite having pulled down copies of PGP back in the days when it really was important to get as many copies in circulation as possible, has made very little use of tools like PGP and (later) GPG. The need has not been pressing, and the hassle factor has been just a little too high.

Encrypted communications remain important, however. Perhaps, thinks your editor, the current crop of graphical email clients will have made life easier for those who want to use cryptographic technologies with mail. Thus this article, which examines the quality of crypto support in graphical email applications. Your editor has not forgotten his promise to look at non-graphical clients as well; that article will come before too long. Honest.

Email crypto overview

To properly set the context for a review of crypto support, it's necessary to cover some background material. Those experienced with using GPG with mail, and who don't feel inclined to heckle, can probably skip the following material.

There are two fundamental tasks which must be performed by a mail client which supports crypto:

• Encryption: encoding the contents of a message so that only the designated recipient(s) can read it. Naturally, the client must also support decryption of incoming encrypted messages.

• Authentication: confirming that a given message was really sent by the person it claims to be from. On the sending side, the client must be able to "sign" a message with an encrypted hash of its contents; the recipient must be able to decrypt the hash, confirm that it matches the message's contents and that it was encrypted with the sender's private key. If everything checks out, the recipient can have a high degree of confidence that the message was sent by the owner of the private key, and that it was not modified in transit.

These two functions are completely independent of each other. Plain-text messages can be (and often are) signed for authentication, while encrypted messages need not carry a signature.

There are various other functions the client can provide to help with cryptographic communications. At the top of the list, perhaps, is making it easy to send a public key to a correspondent, and to add a key received from elsewhere to the key ring.

There is another issue which must be kept in mind when dealing with cryptography and email: how the mail is to be formatted. There are two mechanisms in common use:

• Inline "ascii armor" encoding. In this mode, GPG formats the message with some surrounding header information and the whole assembly is transmitted as a simple, text/plain message. This is how PGP did things back in the day when you had to download your copy from the bleeding-edge FIDO network; some mail clients still do things that way now.

• MIME format, as described in RFC 3156. This format creates a multipart message, one of which contains the entire encrypted message (which can be a multipart MIME message in its own right).

In the modern world, one would think that the MIME format would be the way to go. As it turns out, however, different clients support different formats, and they do not all support both. As a result, you need to know which format your recipient expects if you want to exchange cryptographic messages. The more helpful mail clients can track that information for you.

Finally, it is worth mentioning the S/MIME specification, as found in RFC 2633. S/MIME uses X.509 PKIX certificates for key management; it does not use GPG. There is a certain amount of commercial pressure behind S/MIME; certainly the companies in the digital certificate business like the idea. In the free software community, at least, GPG usage appears to exceed S/MIME usage in a big way. This review will not concern itself with S/MIME other than mentioning it in passing.

Thunderbird

Thunderbird 0.7, out of the box, supports only S/MIME. The user who digs through the menus in search of GPG options will come up empty-handed.

When dealing with missing features in Thunderbird, the first response should always be "look for an extension." The relevant extension in this case is Enigmail; it provides what is, arguably, the best crypto support found in any free graphical application.

By default, Enigmail uses inline encoding for outgoing messages (except for those carrying attachments); that behavior can be changed on a per-message or permanent basis, however. Per-recipient preferences are supported; indeed, Enigmail can be configured to automatically sign and/or encrypt messages to specific recipients, and to use specific keys and formats. Keys can be obtained from public keyservers if desired. There is an operation for including a public key in an outgoing message. In general, Enigmail makes sending encrypted mail easy.

On the receiving side, things work just as nicely. Signed messages are automatically validated and marked as such. Decryption works as expected, though (by default), the user often has to explicitly ask it to download a full message from an IMAP server so that decryption can take place. Public keys can be extracted from incoming mail and saved to the keyring. The "import key" functionality is a little brittle, however; if the message containing the key has been signed, Enigmail will not be able to import it.

Enigmail will optionally remember a passphrase for a configurable period of time, and can be told to forget the passphrase. It also has an operation for the generation of keys within the client; this operation may make life easier for users who are completely unfamiliar with GPG, but, perhaps, it goes a little beyond what a mail client should be providing. There is a "view console" operation for advanced users who want to see exactly what GPG is saying.

Overall, Thunderbird with the Enigmail provides outstanding cryptographic support. One wonders why Thunderbird comes with S/MIME support built in, when the (presumably much more heavily used) GPG support must be added separately.

Sylpheed

Sylpheed has GPG support, though some distributions (e.g. Fedora) do not enable that support. The essential functionality is there, but the edges are rougher than with some other clients.

By default, Sylpheed will send in MIME format. It can be configured to use the inline format on a per-account basis, but there is no way to specify the encoding for an individual message, or on a per-user basis. Sylpheed encrypts outgoing mail for the recipient only; most other mail clients also encrypt for the sender, so that people can read their own mail.

On the receiving side, Sylpheed only understands MIME-format messages. If you send an inline-encoded, encrypted message to yourself with Sylpheed, it will be unable to read its own output. Sylpheed verifies signatures automatically, but does not make the result immediately apparent; see the screen shot for an example of what Sylpheed does when the signature does not check out. This client can be configured to pop up a window with result of each signature validation; it does make these results more evident, but requires the user to be forever dismissing popups. If you receive an encrypted message, the only way to know will be the passphrase prompt which pops up - Sylpheed does not mark the message as having been encrypted.

Sylpheed does not remember passphrases by default, but can be configured to do so, with a configurable timeout. It lacks a "forget the passphrase" operation, however. There is no provision for sending keys, or for importing keys from an incoming message.

In summary: Sylpheed has the features needed for cryptographic communications, but they could be a little better developed. The biggest shortcoming, probably, is the inability to receive inline-encoded messages from correspondents.

KMail

KMail has reasonably good GPG support built into it, with (as of version 1.6.2) one glaring omission: it cannot create or understand MIME-encoded, encrypted mail. When it receives such a message, it recognizes the problem and tells the user about it, but that is not entirely satisfying. KMail does have a special plugin mechanism for cryptographic plugins, and a PGP/MIME plugin does exist. The procedure for installing that plugin is seriously daunting, however, and one would guess that relatively few users go to that degree of trouble. Grabbing, configuring, and building half a dozen new libraries and reconfiguring GPG is an entirely different process than installing a Thunderbird extension. So, for the time being, for the majority of users, it must be said that KMail does not support PGP/MIME. KMail does, however, have support for old versions of PGP (as opposed to GPG), should that still be useful for anybody.

The composition interface works well, with the usual "encrypt" and "sign" options available from the toolbar. KMail has a nice option to "encrypt whenever possible," which means anytime it can find keys corresponding to the recipients. It is not quite as nice as per-recipient preferences, but probably does the right thing most of the time. Since KMail does not support PGP/MIME, it sends attachments in the clear - even if the message itself is supposed to be encrypted.

The receiving side works as it should. Signed and encrypted messages are marked in an impressively garish manner (see the screenshot); fortunately, it is possible to change the colors used.

If configured to do so, KMail will remember passphrases, but with no timeout and no "forget" operation. There is no mechanism to send or import keys. Your editor was also able to crash KMail several times while exercising the crypto operations, which is not a generally good thing. In general, KMail's GPG support gives the impression of being a work in progress. Once things stabilize and the new MIME code is integrated, KMail should have crypto support which is second to none.

Evolution

Evolution 1.5.9 comes with GPG support, though one has to dig a bit to set it up. The "settings" dialog makes no mention of it; one has to go into the edit screen for an individual mail account. S/MIME support can also be turned on in this way. Unlike the other mail clients reviewed here, Evolution requires the user to explicitly supply a key ID before it will work with GPG, and there is no nice widget for the selection of that ID.

Evolution only works with MIME-encoded messages; it cannot create or understand the inline format. Composition works as expected; there is no provision for per-recipient preferences or automatic encryption. Received mail is automatically verified and decrypted, and the results displayed prominently. There is also a button for obtaining detailed information, including the output from gpg (shown in the screenshot).

Evolution will, when told to do so, remember a passphrase "until the end of the session." Selecting "forget passwords" on the "Actions" menu will cause it to forget the passphrase. There is no provision for sending or importing public keys. All told, Evolution has all of the features one really needs to use GPG with email, and not a whole lot more.

Balsa

Balsa comes with reasonably complete GPG support. It understands both MIME and inline format; it creates encrypted and signed mail in MIME format by default, but that can be changed on a per-message basis. There is no provision for per-recipient preferences.

Composition works as usual. If you attempt to send an encrypted message with attachments in inline format, Balsa will warn you that the attachments will be sent in the clear. There is an "always encrypt" option which causes the send to fail if no public key exists in the keyring for the recipient; there is no keyserver capability.

Decryption and signature verification are performed automatically. Encrypted messages are not marked as such. Signature information, instead, is appended to the text of the message. If signature verification fails, a popup window alerts the user to the fact.

Balsa does not remember passphrases, so the user must get used to typing it in often.

Overall, Balsa provides the functionality that one really needs. As is generally the case with Balsa, it feels less slick than with some of the other graphical mailers, but the necessary capabilities are there.

Summary

Moreso than some other subjects reviewed by your editor, this one boils down well to a summary table. So, here it is:

Client	Send		Receive		Recip.	Import	Auto	Passphrase
	Inline	MIME	Inline	MIME	prefs	key	encrypt	Keep	Forget	S/MIME
Balsa	Y	Y	Y	Y	n	n	Y	n	n	n
Evolution	n	Y	n	Y	n	n	n	Y	Y	Y
KMail	Y	n	Y	n	n	n	Y	Y	n	n
Sylpheed	Y	Y	n	Y	n	n	n	Y	n	n
Thunderbird	Y	Y	Y	Y	Y	Y	Y	Y	Y	Y

Looking at the table, it is evident that all of the graphical mail clients reviewed have implemented support for GPG-encrypted and signed messages. That is a good start. The sad thing is that, due the the existence of two different standards, these clients cannot all interoperate with each other. Given the history of the old format, and the clear superiority of the new format (which is more flexible, less dependent on GPG in particular, and can encrypt attachments), it really seems that a proper client should, at this time, support both.

These issues will eventually be worked out. Even before then, however, relatively transparent and easy encryption and authentication have been put into the hands of millions of users worldwide. That can only be a good thing.

Comments (16 posted)

What's new in PHP 5?

A little more than a year since the first beta was released, the final release of PHP 5 was announced last Tuesday. As is to be expected with a major version release, this release brings with it a slew of new features and improvements.

Most noteworthy in the new release is the Zend Engine 2.0, what one might call the core of PHP. The Zend Engine is responsible for parsing and executing PHP code, implements PHP's data structures, memory and resource management and more. With the 5.0 release, there are quite a few changes in the Zend Engine. No major version release would be complete without performance tweaks, and PHP 5 is no exception. This release includes a new memory manager, designed with muli-threaded environments in mind.

Naturally, PHP 5 includes some language changes. One interesting addition is the introduction of private and protected member variables. This allows PHP developers to decide whether or not they wish to make a variable visible to a class that extends a class the variable is extended in (protected) or set variables to be visible only to the class that they are declared in (private).

PHP 5 also introduces destructors for objects, something that was missing in PHP 4. (Constructors were present in PHP 4, but behaved differently.) This allows developers to define a destructor for an object that can perform a task when the last reference to an object is destroyed.

XML support has been beefed up in PHP 5. The XML extensions in PHP 5 are based on the Libxml2 library from the GNOME project. PHP 5 supports SAX, which was present in PHP 4, and adds support for the W3C DOM standard, XSLT and SOAP. The changes are covered in some detail in this article. There is also the SimpleXML extension.

Developers who use PHP in conjunction with MySQL will be interested in the MySQLi extension. This extension gives developers access to functions in MySQL 4.1.2 and above. This version supports prepared statements, SSL, transaction control and a number of other features present in MySQL 4.1 and above.

If MySQL isn't to your tastes, the SQLite extension is bundled with PHP 5. SQLite is a C library that implements a SQL database engine which does not require a separate SQL server. For lightweight installations or situations (such as shared hosting) where a PHP developer does not have access to MySQL or another SQL server, this may be of great interest. SQLite requires no configuration, implements much of SQL92 and supports databases up to 2 terabytes.

There are also quite a few new functions in PHP 5 that are worth looking into for PHP developers. The ChangeLog lists the new functions added in PHP 5, most of which (if not all) are already documented in the PHP Manual.

For more cautious PHP developers and users, PHP 4.3.8 was also released last Tuesday to address several security problems that have come to light since the release of PHP 4.3.7. If not upgrading to 5.0, users should be sure to upgrade to the 4.3.8 release.

In all, the PHP 5 release looks like a nice step forward for the PHP project. The changes to PHP 5 should inflict minimal, if any, pain on developers who have been developing on PHP 4.

Comments (5 posted)

Page editor: Rebecca Sobol

Security

Brief items

Kernel Summit: Security

The Kernel Summit had a session on security which should be interest to readers of this page, even if you don't usually follow the kernel page. James Morris led the session and noted that a great many security features have found their way into 2.6; including the Linux security module mechanism, the crypto API, the dm-crypt target, IPSec, SELinux, NX bit support, the audit framework, and more.

Comments (none posted)

July CRYPTO-GRAM newsletter

Bruce Scheier's CRYPTO-GRAM newsletter for July is out; this month's topics include due process and security, cryptographers and U.S. immigration, threatening Coca-Cola cans, the CLEAR act, and the threat of portable storage devices. "Regarding the former, banning iPods and USB devices doesn't do any good...because the thief will ignore the ban. USB thumb drives are tiny. What are you going to do, strip search everyone who goes in and out of the building? The ban is a silly countermeasure that annoys all your innocent employees and doesn't faze the potentially guilty ones."

Full Story (comments: none)

Novell Previews Liberty-based Identity Federation Solution

Novell, Inc. has announced a new Liberty-certified technology, code-named "Odyssey," that will enable organizations to federate identity information among business partners while maintaining users' privacy.

Comments (none posted)

New vulnerabilities

apache mod_ssl format string vulnerability

Package(s):	apache mod_ssl	CVE #(s):
Created:	July 16, 2004	Updated:	August 6, 2004
Description:	Triggered by a report to Packet Storm from Virulent, a format string vulnerability was found in mod_ssl, the Apache SSL/TLS interface to OpenSSL, version (up to and including) 2.8.18 for Apache 1.3. The mod_ssl in Apache 2.x is not affected. The vulnerability could be exploitable if Apache is used as a proxy for HTTPS URLs and the attacker established a own specially prepared DNS and origin server environment.
Alerts:	Conectiva CLA-2004:857 2004-08-06 Mandrake MDKSA-2004:075 2004-07-27 Slackware SSA:2004-207-02 2004-07-25 Gentoo 200407-18 2004-07-22 OpenPKG OpenPKG-SA-2004.032 2004-07-16

Comments (none posted)

l2tpd buffer overflow

Package(s):	l2tpd	CVE #(s):	CAN-2004-0649
Created:	July 19, 2004	Updated:	July 22, 2004
Description:	Thomas Walpuski reported a buffer overflow in l2tpd, an implementation of the layer 2 tunneling protocol, whereby a remote attacker could potentially cause arbitrary code to be executed by transmitting a specially crafted packet. The exploitability of this vulnerability has not been verified.
Alerts:	Gentoo 200407-17 2004-07-22 Debian DSA-530-1 2004-07-17

Comments (none posted)

netkit-telnet-ssl format string vulnerability

Package(s):	netkit-telnet-ssl	CVE #(s):	CAN-2004-0640
Created:	July 19, 2004	Updated:	July 21, 2004
Description:	b0f discovered a format string vulnerability in netkit-telnet-ssl which could potentially allow a remote attacker to cause the execution of arbitrary code with the privileges of the telnet daemon (the 'telnetd' user by default).
Alerts:	Debian DSA-529-1 2004-07-17

Comments (none posted)

Opera: Multiple spoofing vulnerabilities

Package(s):	opera	CVE #(s):
Created:	July 20, 2004	Updated:	July 21, 2004
Description:	Opera fails to remove illegal characters from an URI of a link and to check that the target frame of a link belongs to the same website as the link. Opera also updates the address bar before loading a page. Additionally, Opera contains a certificate verification problem. These vulnerabilities could allow an attacker to impersonate legitimate websites to steal sensitive information from users. This could be done by obfuscating the real URI of a link or by injecting a malicious frame into an arbitrary frame of another browser window.
Alerts:	Gentoo 200407-15 2004-07-20

Comments (none posted)

Updated vulnerabilities

ut2003: Unreal Tournament 2003/2004 buffer overflow in 'secure' queries

Package(s):	ut2003	CVE #(s):
Created:	July 19, 2004	Updated:	July 21, 2004
Description:	The Unreal-based game servers support a specific type of query called 'secure'. Part of the Gamespy protocol, this query is used to ask if the game server is able to calculate an exact response using a provided string. Luigi Auriemma found that sending a long 'secure' query triggers a buffer overflow in the game server. By sending a malicious UDP-based 'secure' query, an attacker could execute arbitrary code on the game server.
Alerts:	Gentoo 200407-14 2004-07-19

Comments (none posted)

Apache mod_proxy: denial of service

Package(s):	apache	CVE #(s):	CAN-2004-0492
Created:	June 11, 2004	Updated:	October 14, 2004
Description:	A buffer overflow vulnerability in the apache mod_proxy module can be exploited to create a denial of service.
Alerts:	Fedora-Legacy FLSA:1737 2004-10-13 Mandrake MDKSA-2004:065 2004-06-29 Debian DSA-525-1 2004-06-24 Gentoo 200406-16 2004-06-21 OpenPKG OpenPKG-SA-2004.029 2004-06-11

Comments (none posted)

apache2: stack-based buffer overflow in ssl_util.c

Package(s):	apache2	CVE #(s):	CAN-2004-0488
Created:	June 1, 2004	Updated:	October 14, 2004
Description:	A stack-based buffer overflow exists in the ssl_util_uuencode_binary function in ssl_util.c in Apache. When mod_ssl is configured to trust the issuing CA, a remote attacker may be able to execute arbitrary code via a client certificate with a long subject DN.
Alerts:	Fedora-Legacy FLSA:1888 2004-10-13 Debian DSA-532-2 2004-07-27 Debian DSA-532-1 2004-07-22 Red Hat RHSA-2004:245-01 2004-06-14 Gentoo 200406-05 2004-06-09 Slackware SSA:2004-154-01 2004-06-02 OpenPKG OpenPKG-SA-2004.026 2004-05-27 Trustix TSLSA-2004-0031 2004-06-02 Mandrake MDKSA-2004:054 2004-06-01 Mandrake MDKSA-2004:055 2004-06-01

Comments (none posted)

Apache: denial of service

Package(s):	apache2	CVE #(s):	CAN-2004-0493
Created:	June 30, 2004	Updated:	July 19, 2004
Description:	Versions of apache 2.0 through 2.0.49 fail to defend against arbitrarily long header lines; this bug can be exploited to cause the server to use arbitrarily large amounts of memory. See this advisory from Georgi Guninski for details.
Alerts:	Fedora FEDORA-2004-204 2004-07-19 Fedora FEDORA-2004-203 2004-07-19 Red Hat RHSA-2004:342-01 2004-07-06 Gentoo 200407-03 2004-07-04 tinysofa TSSA-2004-012 2004-06-29 Mandrake MDKSA-2004:064 2004-06-29

Comments (none posted)

aspell: bounds checking problem

Package(s):	aspell	CVE #(s):	CAN-2004-0548
Created:	June 17, 2004	Updated:	December 20, 2004
Description:	Aspell's word-list-compress utility fails to properly check bounds when dealing with words that are more than 256 bytes long. This can lead to arbitrary code execution by an attacker.
Alerts:	Mandrake MDKSA-2004:153 2004-12-20 OpenPKG OpenPKG-SA-2004.042 2004-09-15 Gentoo 200406-14 2004-06-17

Comments (none posted)

dhcp: buffer overflows

Package(s):	dhcp	CVE #(s):	CAN-2004-0460 CAN-2004-0461
Created:	June 23, 2004	Updated:	July 14, 2004
Description:	Two separate buffer overflows have been found in versions 3.0.1rc12 and 3.0.1rc13 of the ISC DHCP server. These overflows can be exploited by a remote attacker to cause a denial of service, or, potentially, to execute arbitrary code. DHCP servers should not be exposed to the Internet, but this problem is worth fixing regardless. See this CERT advisory for more information.
Alerts:	OpenPKG OpenPKG-SA-2004.031 2004-07-08 Fedora FEDORA-2004-190 2004-06-23 SuSE SuSE-SA:2004:019 2004-06-22 Mandrake MDKSA-2004:061 2004-06-22

Comments (none posted)

Ethereal: Multiple security problems

Package(s):	ethereal	CVE #(s):	CAN-2004-0633 CAN-2004-0634 CAN-2004-0635
Created:	July 9, 2004	Updated:	August 19, 2004
Description:	There are multiple vulnerabilities in versions of Ethereal earlier than 0.10.5, including: * In some cases the iSNS dissector could cause Ethereal to abort. * If there was no policy name for a handle for SMB SID snooping it could cause a crash. * A malformed or missing community string could cause the SNMP dissector to crash. See this advisory for more information.
Alerts:	Whitebox WBSA-2004:378-01 2004-08-19 Red Hat RHSA-2004:378-01 2004-08-05 Netwosix NW-2004-0016 2004-07-23 Fedora FEDORA-2004-234 2004-07-22 Debian DSA-528-1 2004-07-17 Fedora FEDORA-2004-220 2004-07-14 Fedora FEDORA-2004-219 2004-07-14 Mandrake MDKSA-2004:067 2004-07-09 Gentoo 200407-08 2004-07-09

Comments (none posted)

Filename disclosure vulnerability in fam

Package(s):	fam	CVE #(s):	CAN-2002-0875
Created:	August 19, 2002	Updated:	January 5, 2005
Description:	"fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible.
Alerts:	Red Hat RHSA-2005:005-01 2005-01-05 Debian DSA-154-1 2002-08-15

Comments (none posted)

flim: insecure file creation

Package(s):	flim	CVE #(s):	CAN-2004-0422
Created:	May 5, 2004	Updated:	December 16, 2004
Description:	The emacs "flim" mode creates temporary files in an insecure fashion, possibly allowing a local attacker to overwrite files.
Alerts:	Fedora FEDORA-2004-546 2004-12-15 Red Hat RHSA-2004:344-01 2004-08-18 Debian DSA-500-1 2004-05-01

Comments (none posted)

FreeS/WAN, Openswan, strongSwan: Vulnerabilities in certificate handling

Package(s):	freeswan	CVE #(s):
Created:	June 26, 2004	Updated:	July 15, 2004
Description:	FreeS/WAN, Openswan, strongSwan and Super-FreeS/WAN contain two bugs when authenticating PKCS#7 certificates. This could allow an attacker to authenticate with a fake certificate. All these IPsec implementations have several bugs in the verify_x509cert() function, which performs certificate validation, that make them vulnerable to malicious PKCS#7 wrapped objects. With a carefully crafted certificate payload an attacker can successfully authenticate against FreeS/WAN, Openswan, strongSwan or Super-FreeS/WAN, or make the daemon go into an endless loop.
Alerts:	Mandrake MDKSA-2004:070 2004-07-14 Gentoo 200406-20 2004-06-25

Comments (none posted)

gtkhtml: malformed messages cause crash

Package(s):	gtkhtml	CVE #(s):	CAN-2003-0133 CAN-2003-0541
Created:	April 14, 2003	Updated:	April 18, 2005
Description:	GtkHTML is the HTML rendering widget used by the Evolution mail reader. GtkHTML supplied with versions of Evolution prior to 1.2.4 contain a bug when handling HTML messages. Alan Cox discovered that certain malformed messages could cause the Evolution mail component to crash.
Alerts:	Debian DSA-710-1 2005-04-18 Mandrake MDKSA-2003:093 2003-09-18 Conectiva CLA-2003:737 2003-09-12 Red Hat RHSA-2003:264-01 2003-09-09 Mandrake MDKSA-2003:046 2003-04-15 Red Hat RHSA-2003:126-01 2003-04-14

Comments (none posted)

Horde-IMP: improper input validation

Package(s):	Horde-IMP	CVE #(s):
Created:	June 16, 2004	Updated:	August 10, 2004
Description:	An input validation error exists in Horde-IMP through version 3.2.4; a specially crafted message could be used to run scripts in the context of the target's browser.
Alerts:	Gentoo 200408-07 2004-08-10 Gentoo 200406-11 2004-06-16

Comments (none posted)

iproute: local denial of service

Package(s):	iproute net-tools	CVE #(s):	CAN-2003-0856
Created:	November 25, 2003	Updated:	December 14, 2004
Description:	The iproute utility is susceptible to spoofed netlink messages sent by local users, with the result that denial of service attacks are possible.
Alerts:	Mandrake MDKSA-2004:148 2004-12-13 Fedora FEDORA-2004-154 2004-06-03 Fedora FEDORA-2004-115 2004-05-11 Debian DSA-492-1 2004-04-18 Gentoo 200404-10 2004-04-09 Red Hat RHSA-2003:316-01 2003-11-24

Comments (none posted)

racoon: failure to verify signatures

Package(s):	ipsec-tools racoon	CVE #(s):	CAN-2004-0155
Created:	April 7, 2004	Updated:	August 19, 2004
Description:	Versions of ipsec-tools prior to 0.2.5 contain a vulnerability wherein the racoon utility fails to verify digital signatures on some packets. This hole can lead to unauthorized connections or man-in-the-middle attacks. See this advisory for details.
Alerts:	Whitebox WBSA-2004:308-01 2004-08-19 Mandrake MDKSA-2004:027 2004-04-08 Gentoo 200404-05 2004-04-07

Comments (none posted)

racoon: denial of service vulnerability

Package(s):	ipsec-tools racoon iputils	CVE #(s):	CAN-2004-0403
Created:	April 26, 2004	Updated:	July 29, 2004
Description:	racoon does not check the length of ISAKMP headers. Attackers may be able to craft an ISAKMP header of sufficient length to consume all available system resources, causing a Denial of Service. This advisory contains additional details.
Alerts:	Red Hat RHSA-2004:308-01 2004-07-29 Mandrake MDKSA-2004:069 2004-07-14 Fedora FEDORA-2004-197 2004-06-28 Whitebox WBSA-2004:165-01 2004-06-10 Fedora FEDORA-2004-132 2004-05-19 Red Hat RHSA-2004:165-01 2004-05-11 Gentoo 200404-17 2004-04-24

Comments (none posted)

kdelibs: cookie disclosure

Package(s):	kdelibs	CVE #(s):	CAN-2003-0592
Created:	March 10, 2004	Updated:	August 24, 2004
Description:	kdelibs (and, thus, Konqueror) has a vulnerability where a hostile server can force the disclosure of cookies that should not be presented to it. KDE versions 3.1.3 and later contain a fix.
Alerts:	Gentoo 200408-23 2004-08-24 Red Hat RHSA-2004:074-01 2004-03-10 Red Hat RHSA-2004:075-01 2004-03-10 Mandrake MDKSA-2004:022 2004-03-10 Debian DSA-459-1 2004-03-10

Comments (none posted)

kernel: symlink overflow in the iso9660 filessytem

Package(s):	kernel	CVE #(s):	CAN-2004-0109
Created:	April 14, 2004	Updated:	July 15, 2004
Description:	The 2.4 and 2.6 kernels contain a vulnerability in the iso9660 (CDROM) filesystem which can be used by a local attacker to obtain root privileges. The exploit requires creating a specially-crafted filesystem and getting the kernel to mount it. Many systems are configured to automatically mount CDs on insertion, however, so the possibility of this vulnerability being exploited by users with physical access to the system is real. The 2.4.26 kernel contains the fix, which will also be merged into the upcoming 2.6.6 release.
Alerts:	Conectiva CLA-2004:846 2004-07-15 Red Hat RHSA-2004:106-01 2004-04-21 Red Hat RHSA-2004:105-01 2004-04-21 Debian DSA-489-1 2004-04-17 Debian DSA-491-1 2004-04-17 Debian DSA-479-2 2004-04-14 SuSE SuSE-SA:2004:009 2004-04-14 Mandrake MDKSA-2004:029 2004-04-14 Fedora FEDORA-2004-101 2004-04-14 Debian DSA-482-1 2004-04-14 Debian DSA-481-1 2004-04-14 Debian DSA-480-1 2004-04-14 Debian DSA-479-1 2004-04-14

Comments (none posted)

kernel allows unauthorized changes to the group ID

Package(s):	kernel	CVE #(s):	CAN-2004-0497
Created:	July 2, 2004	Updated:	September 27, 2004
Description:	During an audit of the Linux kernel, SUSE discovered a flaw that allowed a user to make unauthorized changes to the group ID of files in certain circumstances - such as when the files are exported via NFS.
Alerts:	Conectiva CLA-2004:869 2004-09-27 Gentoo 200407-16 2004-07-22 Whitebox WBSA-2004:360-01 2004-07-07 Mandrake MDKSA-2004:066 2004-07-06 SuSE SUSE-SA:2004:020 2004-07-02 Fedora FEDORA-2004-206 2004-07-02 Fedora FEDORA-2004-205 2004-07-02 Red Hat RHSA-2004:354-01 2004-07-02 Red Hat RHSA-2004:360-01 2004-07-02

Comments (none posted)

kernel: netfilter denial of service

Package(s):	kernel	CVE #(s):
Created:	June 30, 2004	Updated:	July 28, 2004
Description:	The netfilter code in 2.6 kernels through 2.6.7 is vulnerable to a remote denial of service attack - but only if filtering on the TCP options field has been enabled. See this advisory for details.
Alerts:	Conectiva CLA-2004:852 2004-07-28 Gentoo 200407-12 2004-07-14 Fedora FEDORA-2004-202 2004-06-30

Comments (none posted)

kernel-utils: setuid vulnerability

Package(s):	kernel-utils	CVE #(s):	CAN-2003-0019
Created:	February 7, 2003	Updated:	January 21, 2005
Description:	The kernel-utils package contains several utilities that can be used to control the kernel or machine hardware. In Red Hat Linux 8.0 this package contains user mode linux (UML) utilities. The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was incorrectly shipped setuid root. This could allow local users to control certain network interfaces, add and remove arp entries and routes, and put interfaces in and out of promiscuous mode. All users of the kernel-utils package should update to these packages that contain a version of uml_net that is not setuid root. Alternatively, as a work-around to this vulnerability issue the following command as root: chmod -s /usr/bin/uml_net
Alerts:	Red Hat RHSA-2003:056-08 2003-02-07

Comments (none posted)

libpng, libpng3: buffer overflow

Package(s):	libpng, libpng3	CVE #(s):	CAN-2002-1363
Created:	December 19, 2002	Updated:	July 14, 2004
Description:	Glenn Randers-Pehrson discovered a problem in connection with 16-bit samples from libpng, an interface for reading and writing PNG (Portable Network Graphics) format files. The starting offsets for the loops are calculated incorrectly which causes a buffer overrun beyond the beginning of the row buffer.
Alerts:	Gentoo 200407-06 2004-07-08 OpenPKG OpenPKG-SA-2004.030 2004-07-06 Mandrake MDKSA-2004:063 2004-06-29 Whitebox WBSA-2004:249-01 2004-06-21 Fedora FEDORA-2004-176 2004-06-18 Fedora FEDORA-2004-174 2004-06-18 Fedora FEDORA-2004-175 2004-06-18 Fedora FEDORA-2004-173 2004-06-18 Red Hat RHSA-2004:249-01 2004-06-18 Conectiva CLA-2003:564 2003-01-23 Mandrake MDKSA-2003:008 2003-01-20 OpenPKG OpenPKG-SA-2003.001 2003-01-15 Yellow Dog YDU-20030114-2 2002-01-14 SuSE SuSE-SA:2003:0004 2003-01-14 Red Hat RHSA-2003:006-06 2003-01-09 Debian DSA-213-1 2002-12-19

Comments (none posted)

libxml2 - arbitrary code execution

Package(s):	libxml2	CVE #(s):	CAN-2004-0110
Created:	February 26, 2004	Updated:	August 19, 2009
Description:	Yuuichi Teranishi discovered a flaw in libxml2 versions prior to 2.6.6. When fetching a remote resource via FTP or HTTP, libxml2 uses special parsing routines. These routines can overflow a buffer if passed a very long URL. If an attacker is able to find an application using libxml2 that parses remote resources and allows them to influence the URL, then this flaw could be used to execute arbitrary code.
Alerts:	Fedora FEDORA-2009-8594 2009-08-15 Fedora FEDORA-2009-8582 2009-08-15 Fedora-Legacy FLSA:1324 2004-07-19 Conectiva CLA-2004:836 2004-03-31 Gentoo 200403-01 2004-03-06 Trustix TSLSA-2004-0010 2004-03-05 OpenPKG OpenPKG-SA-2004.003 2004-03-05 Netwosix NW-2004-0004 2004-03-04 Debian DSA-455-1 2004-03-03 Mandrake MDKSA-2004:018 2004-03-03 Red Hat RHSA-2004:091-02 2004-03-03 Whitebox WBSA-2004:090-01 2004-03-01 Red Hat RHSA-2004:090-01 2004-02-26 Fedora FEDORA-2004-087 2004-02-25 Red Hat RHSA-2004:091-01 2004-02-26

Comments (none posted)

logcheck: symlink vulnerability

Package(s):	logcheck	CVE #(s):	CAN-2004-0404
Created:	April 21, 2004	Updated:	December 22, 2004
Description:	The logcheck utility handles temporary files in an unsafe way, possibly allowing local attackers to overwrite files.
Alerts:	Mandrake MDKSA-2004:155 2004-12-22 Debian DSA-488-1 2004-04-16

Comments (none posted)

mailman: password disclosure

Package(s):	mailman	CVE #(s):	CAN-2004-0412
Created:	May 27, 2004	Updated:	July 20, 2004
Description:	In mailman versions above 2.1, third parties can retrieve member passwords from the server.
Alerts:	Fedora-Legacy FLSA:1734 2004-07-19 Fedora FEDORA-2004-168 2004-07-01 Fedora FEDORA-2004-167 2004-07-01 Gentoo 200406-04 2004-06-09 Mandrake MDKSA-2004:051 2004-05-26

Comments (none posted)

mikmod: buffer overflow

Package(s):	mikmod	CVE #(s):	CAN-2003-0427
Created:	June 16, 2003	Updated:	June 16, 2005
Description:	Ingo Saitz discovered a bug in mikmod whereby a long filename inside an archive file can overflow a buffer when the archive is being read by mikmod.
Alerts:	Fedora FEDORA-2005-405 2005-06-16 Red Hat RHSA-2005:506-01 2005-06-13 Fedora FEDORA-2005-404 2005-06-09 Gentoo 200307-01 2003-07-02 Debian DSA-320-1 2003-06-13

Comments (none posted)

mod_python: denial of service vulnerability

Package(s):	mod_python	CVE #(s):	CAN-2003-0973
Created:	January 27, 2004	Updated:	October 4, 2004
Description:	Apache's mod_python module could crash the httpd process if a specific, malformed query string was sent. The Apache Foundation has reported that mod_python may be prone to Denial of Service attacks when handling a malformed query. Mod_python 2.7.9 was released to fix the vulnerability, however, because the vulnerability has not been fully fixed, version 2.7.10 has been released. Users of mod_python 3.0.4 are not affected by this vulnerability.
Alerts:	Fedora-Legacy FLSA:1325 2004-10-03 Conectiva CLA-2004:837 2004-04-12 Whitebox WBSA-2004:058-01 2004-03-01 Debian DSA-452-1 2004-02-29 Red Hat RHSA-2004:058-01 2004-02-26 Red Hat RHSA-2004:063-01 2004-02-26 Gentoo 200401-03 2004-01-27

Comments (none posted)

MoinMoin Group ACL Bypass

Package(s):	moinmoin	CVE #(s):
Created:	July 12, 2004	Updated:	August 26, 2004
Description:	MoinMoin contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is triggered when an attacker creates a user with the same name as an administrative group. This flaw may lead to a loss of integrity. See this osvdb entry for additional information.
Alerts:	Gentoo 200407-09 2004-07-11

Comments (none posted)

mozilla: multiple vulnerabilties

Package(s):	mozilla	CVE #(s):	CAN-2003-0594 CAN-2003-0564
Created:	March 10, 2004	Updated:	August 19, 2004
Description:	Mozilla 1.4 contains a few vulnerabilities, including disclosure of cookies to the wrong server, a scripting vulnerability which can allow an attacker to run arbitrary code, and an S/MIME vulnerability which can lead to remote denial of service or code execution attacks.
Alerts:	Whitebox WBSA-2004:421-01 2004-08-19 Whitebox WBSA-2004:110-01 2004-03-29 Red Hat RHSA-2004:112-01 2004-03-17 Mandrake MDKSA-2004:021 2004-03-10

Comments (none posted)

mpg321: format string vulnerability

Package(s):	mpg321	CVE #(s):	CAN-2003-0969
Created:	January 6, 2004	Updated:	March 28, 2005
Description:	A vulnerability was discovered in mpg321, a command-line mp3 player, whereby user-supplied strings were passed to printf(3) unsafely. This vulnerability could be exploited by a remote attacker to overwrite memory, and possibly execute arbitrary code. In order for this vulnerability to be exploited, mpg321 would need to play a malicious mp3 file (including via HTTP streaming).
Alerts:	Gentoo 200503-34 2005-03-28 Debian DSA-411-1 2004-01-05

Comments (none posted)

MySQL: temporary file vulnerabilities

Package(s):	mysql	CVE #(s):	CAN-2004-0381 CAN-2004-0388
Created:	April 14, 2004	Updated:	August 18, 2004
Description:	The mysqlbug and mysqld_multi scripts contain temporary file vulnerabilities which could be used by a local attacker to overwrite files on the system.
Alerts:	Gentoo 200405-20 2004-05-25 Mandrake MDKSA-2004:034 2004-04-19 OpenPKG OpenPKG-SA-2004.014 2004-04-14 Debian DSA-483-1 2004-04-14

Comments (none posted)

neon: buffer overflow

Package(s):	neon	CVE #(s):	CAN-2004-0398
Created:	May 19, 2004	Updated:	September 30, 2004
Description:	The neon library (through version 0.24.5) contains a buffer overflow in its date parsing code, allowing arbitrary code execution when connecting to a hostile server. See this advisory for details. This vulnerability also affects related applications (such as cadaver).
Alerts:	Fedora-Legacy FLSA:1552 2004-09-29 Mandrake MDKSA-2004:078 2004-07-29 Gentoo 200406-03 2004-06-05 Gentoo 200405-25b 2004-06-02 Gentoo 200405-25 2004-05-30 Conectiva CLA-2004:841 2004-05-25 Gentoo 200405-15 2004-05-20 Gentoo 200405-13 2004-05-20 OpenPKG OpenPKG-SA-2004.024 2004-05-19 Mandrake MDKSA-2004:049 2004-05-19 Fedora FEDORA-2004-130 2004-05-19 Fedora FEDORA-2004-129 2004-05-19 Red Hat RHSA-2004:191-01 2004-05-19 Debian DSA-507-1 2004-05-19 Debian DSA-506-1 2004-05-19

Comments (none posted)

Nessus NASL scripting engine security issues

Package(s):	nessus	CVE #(s):
Created:	May 27, 2003	Updated:	August 12, 2004
Description:	Some some vulnerabilities exsist in the Nessus NASL scripting engine. To exploit these flaws, an attacker would need to have a valid Nessus account as well as the ability to upload arbitrary Nessus plugins in the Nessus server (this option is disabled by default) or he/she would need to trick a user somehow into running a specially crafted nasl script. Read the full advisory for additional information.
Alerts:	Gentoo 200305-10 2003-05-27

Comments (none posted)

netpbm: insecure temporary files

Package(s):	netpbm	CVE #(s):	CAN-2003-0924
Created:	January 19, 2004	Updated:	December 29, 2004
Description:	netpbm is graphics conversion toolkit made up of a large number of single-purpose programs. Many of these programs were found to create temporary files in an insecure manner, which could allow a local attacker to overwrite files with the privileges of the user invoking a vulnerable netpbm tool.
Alerts:	Conectiva CLA-2004:909 2004-12-29 Gentoo 200410-02 2004-10-04 Mandrake MDKSA-2004:011-1 2004-09-27 Whitebox WBSA-2004:031-01 2004-02-12 Mandrake MDKSA-2004:011 2004-02-11 Red Hat RHSA-2004:030-01 2004-02-05 Fedora FEDORA-2004-068 2004-02-06 Red Hat RHSA-2004:031-01 2004-01-22 Debian DSA-426-1 2004-01-18

Comments (1 posted)

openssh: timing attack leads to information disclosure

Package(s):	openssh	CVE #(s):	CAN-2003-0190
Created:	May 2, 2003	Updated:	November 30, 2004
Description:	From the advisory: "During a pen-test we stumbled across a nasty bug in OpenSSH-portable with PAM support enabled (via the --with-pam configure script switch). This bug allows a remote attacker to identify valid users on vulnerable systems, through a simple timing attack. The vulnerability is easy to exploit and may have high severity, if combined with poor password policies and other security problems that allow local privilege escalation."
Alerts:	Ubuntu USN-34-1 2004-11-30 OpenPKG OpenPKG-SA-2003.035 2003-08-06 Red Hat RHSA-2003:222-01 2003-07-29 Gentoo 200305-02 2003-05-13 Gentoo 200305-01 2002-03-05

Comments (1 posted)

OpenSSL: denial of service vulnerabilities

Package(s):	OpenSSL	CVE #(s):	CAN-2004-0081 CAN-2003-0851
Created:	March 17, 2004	Updated:	November 2, 2005
Description:	Versions 0.9.7a-c of the OpenSSL library suffer from two denial of service vulnerabilities; see the version 0.9.7d release announcement for details.
Alerts:	Red Hat RHSA-2005:830-00 2005-11-02 Red Hat RHSA-2005:829-00 2005-11-02 Fedora FEDORA-2005-1042 2005-10-31 Fedora-Legacy FLSA:1395 2004-05-08 Conectiva CLA-2004:834 2004-03-31 Whitebox WBSA-2004:084-01 2004-03-23 Red Hat RHSA-2004:084-01 2004-03-23 Fedora FEDORA-2004-095 2004-03-19 Whitebox WBSA-2004:120-01 2004-03-22 Trustix TSLSA-2004-0012 2004-03-17 Slackware SSA:2004-077-01 2004-03-17 Red Hat RHSA-2004:121-01 2004-03-17 OpenPKG OpenPKG-SA-2004.007 2004-03-18 Gentoo 200403-03 2004-03-17 Debian DSA-465-1 2004-03-17 Netwosix NW-2004-0005 2004-03-17 Mandrake MDKSA-2004:023 2004-03-17 SuSE SuSE-SA:2004:007 2004-03-17 Red Hat RHSA-2004:120-01 2004-03-17 Red Hat RHSA-2004:119-01 2004-03-17 EnGarde ESA-20040317-003 2004-03-17

Comments (1 posted)

pavuk: buffer overflow

Package(s):	pavuk	CVE #(s):	CAN-2004-0456
Created:	June 30, 2004	Updated:	November 11, 2004
Description:	Versions of the pavuk web spider through 0.9.28-r1 contain a buffer overflow which could be exploited by a hostile server.
Alerts:	Gentoo 200411-19 2004-11-10 Debian DSA-527-1 2004-07-03 Gentoo 200406-22 2004-06-30

Comments (none posted)

php: remotely exploitable memory errors

Package(s):	php	CVE #(s):	CAN-2004-0594
Created:	July 14, 2004	Updated:	February 7, 2005
Description:	Stefan Esser has issued an advisory regarding a remotely exploitable hole in PHP (through version 4.3.7). If the memory_limit feature is in use (as it should be, to prevent denial of service attacks), allocation failures can be forced at highly inopportune times, and those failures can be exploited to execute arbitrary code. The exploit is described as "quite easy," and it can be done regardless of whether Apache1 or Apache2 is in use. Upgrading to PHP 4.3.8 fixes the problem; yesterday's PHP 5.0 release also contains the fix (but the final release candidate did not).
Alerts:	Debian DSA-669-1 2005-02-07 Whitebox WBSA-2004:392-01 2004-08-19 Fedora FEDORA-2004-223 2004-07-23 Fedora FEDORA-2004-222 2004-07-23 OpenPKG OpenPKG-SA-2004.034 2004-07-22 Slackware SSA:2004-202-01 2004-07-20 Debian DSA-531-1 2004-07-20 Red Hat RHSA-2004:392-01 2004-07-19 Red Hat RHSA-2004:395-01 2004-07-19 Conectiva CLA-2004:847 2004-07-16 SuSE SUSE-SA:2004:021 2004-07-16 Mandrake MDKSA-2004:068 2004-07-14 Gentoo 200407-13 2004-07-15 tinysofa TSSA-2004-013 2004-07-14

Comments (none posted)

postgresql buffer overflow in ODBC driver

Package(s):	postgresql	CVE #(s):
Created:	June 7, 2004	Updated:	July 28, 2004
Description:	A buffer overflow has been discovered in the ODBC driver of PostgreSQL, an object-relational SQL database, descended from POSTGRES. It possible to exploit this problem and crash the surrounding application. Hence, a PHP script using php4-odbc can be utilized to crash the surrounding Apache webserver. Other parts of postgresql are not affected.
Alerts:	Mandrake MDKSA-2004:072 2004-07-27 Debian DSA-516-1 2004-06-07

Comments (none posted)

python: buffer overflow

Package(s):	python	CVE #(s):	CAN-2004-0150
Created:	March 10, 2004	Updated:	October 11, 2004
Description:	Python (versions 2.2 and 2.2.1 only) has a buffer overflow in the getaddrinfo() function which can be exploited by a malformed IPv6 address.
Alerts:	Debian DSA-458-3 2004-10-10 Gentoo 200409-03 2004-09-02 Debian DSA-458-2 2004-08-31 Mandrake MDKSA-2004:019 2004-03-09 Debian DSA-458-1 2004-03-09

Comments (none posted)

squid: buffer overflow

Package(s):	squid	CVE #(s):	CAN-2004-0541
Created:	June 9, 2004	Updated:	September 30, 2004
Description:	The NTLM authentication helper used by the squid proxy contains a buffer overflow vulnerability; an overly-long password may be used to run arbitrary code. Sites not using NTLM authentication are not vulnerable.
Alerts:	Red Hat RHSA-2004:462-01 2004-09-30 Mandrake MDKSA-2004:093 2004-09-15 Gentoo 200409-04 2004-09-02 Gentoo 200406-13 2004-06-17 Whitebox WBSA-2004:242-01 2004-06-10 Trustix TSLSA-2004-0033 2004-06-10 Mandrake MDKSA-2004:059 2004-06-09 SuSE SuSE-SA:2004:016 2004-06-09 Red Hat RHSA-2004:242-01 2004-06-09 Fedora FEDORA-2004-164 2004-06-09 Fedora FEDORA-2004-163 2004-06-09

Comments (none posted)

SquirrelMail cross site scripting vulnerabilities

Package(s):	squirrelmail	CVE #(s):	CAN-2004-0519 CAN-2004-0520 CAN-2004-0521
Created:	May 21, 2004	Updated:	October 4, 2004
Description:	Several unspecified cross-site scripting (XSS) vulnerabilities and a well hidden SQL injection vulnerability were found in SquirrelMail versions 1.4.2 and lower. An XSS attack allows an attacker to insert malicious code into a web-based application. SquirrelMail does not check for code when parsing variables received via the URL query string.
Alerts:	Fedora-Legacy FLSA:1733 2004-10-02 Conectiva CLA-2004:858 2004-08-12 Whitebox WBSA-2004:240-01 2004-06-21 Gentoo 200406-08 2004-06-15 Red Hat RHSA-2004:240-01 2004-06-14 Fedora FEDORA-2004-160 2004-06-09 Fedora FEDORA-2004-159 2004-06-09 Gentoo 200405-16:02 2004-05-25 Gentoo 200405-16 2004-05-21

Comments (none posted)

Subversion: Remote heap overflow

Package(s):	subversion	CVE #(s):	CAN-2004-0413
Created:	June 11, 2004	Updated:	March 7, 2005
Description:	Subversion has a remote Denial of Service vulnerability that may allow a server that runs svnserve to execute arbitrary code. See this advisory for more information.
Alerts:	Fedora-Legacy FLSA:1748 2005-03-07 SuSE SuSE-SA:2004:018 2004-06-17 Fedora FEDORA-2004-166 2004-06-11 Fedora FEDORA-2004-165 2004-06-11 OpenPKG OpenPKG-SA-2004.028 2004-06-11 Gentoo 200406-07 2004-06-10

Comments (none posted)

sysstat: temporary file vulnerability

Package(s):	sysstat	CVE #(s):	CAN-2004-0107 CAN-2004-0108
Created:	March 10, 2004	Updated:	October 4, 2004
Description:	The sysstat utility has a temporary file vulnerability which can be exploited by a local attacker to overwrite system files.
Alerts:	Fedora-Legacy FLSA:1372 2004-10-03 Gentoo 200404-04 2004-04-06 Debian DSA-460-2 2004-04-03 Trustix TSLSA-2004-0011 2004-03-16 Whitebox WBSA-2004:053-01 2004-03-10 Red Hat RHSA-2004:053-01 2004-03-10 Red Hat RHSA-2004:093-01 2004-03-10 Debian DSA-460-1 2004-03-10

Comments (none posted)

File overwrite vulnerability in tar and unzip

Package(s):	tar unzip	CVE #(s):	CAN-2001-1267 CAN-2001-1268 CAN-2001-1269 CAN-2002-0399
Created:	October 1, 2002	Updated:	April 10, 2006
Description:	The tar utility does not properly filter file names containing "../", meaning that a hostile archive can, if unpacked by an unsuspecting user, overwrite any file that is writable by that user. GNU tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42 has the same vulnerability.
Alerts:	Fedora-Legacy FLSA:183571-1 2006-04-04 Red Hat RHSA-2006:0195-01 2006-02-21 Conectiva CLA-2002:538 2002-10-29 Mandrake MDKSA-2002:066 2002-10-10 Mandrake MDKSA-2002:065 2002-10-10 EnGarde ESA-20021003-022 2002-10-03 Gentoo unzip-20021001 2002-10-01 Gentoo tar-20021001 2002-10-01 Red Hat RHSA-2002:096-24 2002-09-18

Comments (1 posted)

tcpdump: ISAKMP payload handling denial-of-service vulnerabilities

Package(s):	tcpdump	CVE #(s):	CAN-2004-0183 CAN-2004-0184
Created:	March 30, 2004	Updated:	September 30, 2004
Description:	TCPDUMP v3.8.1 and earlier versions contain multiple flaws in the packet display functions for the ISAKMP protocol. Upon receiving specially crafted ISAKMP packets, TCPDUMP will try to read beyond the end of the packet capture buffer and crash. More information is available in this Rapid7 advisory.
Alerts:	Fedora-Legacy FLSA:1468 2004-09-29 Whitebox WBSA-2004:219-01 2004-06-10 Red Hat RHSA-2004:219-01 2004-05-26 Fedora FEDORA-2004-120 2004-05-13 Slackware SSA:2004-108-01 2004-04-17 Mandrake MDKSA-2004:030 2004-04-14 OpenPKG OpenPKG-SA-2004.010 2004-04-07 Debian DSA-478-1 2004-04-06 Trustix TSLSA-2004-0015 2004-03-30

Comments (none posted)

Multiple vendor telnetd vulnerability

Package(s):	telnet Telnet netkit-telnet-ssl kerberos telnetd netkit-telnet nkitb/nkitserv/telnetd krb5	CVE #(s):
Created:	May 21, 2002	Updated:	October 5, 2004
Description:	This vulnerability, originally thought to be confined to BSD-derived systems, was first covered in the July 26th Security Summary. It is now known that Linux telnet daemons are vulnerable as well.
Alerts:	Gentoo 200410-03 2004-10-05 Yellow Dog YDU-20010810-2 2001-08-10 Yellow Dog YDU-20010810-1 2001-08-10 SuSE SuSE-SA:2001:029 2001-09-03 Slackware sl-997726350 2001-08-09 Red Hat RHSA-2001:100-02 2001-08-09 Red Hat RHSA-2001:099-09 2002-02-07 Red Hat RHSA-2001:099-06 2001-08-09 Progeny PROGENY-SA-2001-27 2001-08-14 Mandrake MDKSA-2001:093 2001-12-17 Mandrake MDKSA-2001:068 2001-08-13 HP HPSBTL0202-023 2002-02-12 Debian DSA-075-2 2001-08-14 Debian DSA-075-1 2001-08-14 Conectiva CLA-2001:413 2001-08-24 SCO Group CSSA-2001-030.0 2001-08-10

Comments (none posted)

webmin: denial of service

Package(s):	webmin	CVE #(s):	CAN-2004-0582 CAN-2004-0583
Created:	June 16, 2004	Updated:	July 28, 2004
Description:	Versions of webmin prior to 1.150 suffer from denial of service and information disclosure vulnerabilities. See advisories for the disclosure and lockout problems for more information.
Alerts:	Mandrake MDKSA-2004:074 2004-07-27 Conectiva CLA-2004:848 2004-07-16 Debian DSA-526-1 2004-07-03 Gentoo 200406-12 2004-06-16

Comments (none posted)

wv: buffer overflow

Package(s):	wv	CVE #(s):	CAN-2004-0645
Created:	July 14, 2004	Updated:	February 10, 2005
Description:	wv, a viewer for MS Word files, contains a buffer overflow which may be exploited by a suitably-crafted file. Version 1.0.0-r1 fixes the problem.
Alerts:	Fedora-Legacy FLSA:1906 2005-02-08 Conectiva CLA-2004:902 2004-12-01 Debian DSA-579-1 2004-11-01 Debian DSA-550-1 2004-09-20 Conectiva CLA-2004:863 2004-09-10 Mandrake MDKSA-2004:077 2004-07-29 Fedora FEDORA-2004-225 2004-07-23 Fedora FEDORA-2004-224 2004-07-23 Gentoo 200407-11 2004-07-14

Comments (none posted)

XChat 2.0.x SOCKS5 Vulnerability

Package(s):	xchat	CVE #(s):	CAN-2004-0409
Created:	April 19, 2004	Updated:	November 15, 2005
Description:	XChat is vulnerable to a stack overflow that may allow a remote attacker to run arbitrary code. The SOCKS 5 proxy code in XChat is vulnerable to a remote exploit. Users would have to be using XChat through a SOCKS 5 server, enable SOCKS 5 traversal which is disabled by default and also connect to an attacker's custom proxy server. This vulnerability may allow an attacker to run arbitrary code within the context of the user ID of the XChat client.
Alerts:	Fedora-Legacy FLSA:123013 2005-11-14 Red Hat RHSA-2004:585-01 2004-10-27 Netwosix NW-2004-0014 2004-05-01 Red Hat RHSA-2004:177-01 2004-04-30 Mandrake MDKSA-2004:036 2004-04-21 Debian DSA-493-1 2004-04-21 Gentoo 200404-15 2004-04-19

Comments (none posted)

XFree86, X.org: XDM ignores requestPort setting

Package(s):	XFree86 X.org	CVE #(s):	CAN-2004-0419
Created:	July 5, 2004	Updated:	July 28, 2004
Description:	XDM will open TCP sockets for its chooser, even if the DisplayManager.requestPort setting is set to 0. This may allow authorized users to access a machine remotely via X, even if the administrator has configured XDM to refuse such connections. See this XFree86 bug report.
Alerts:	Mandrake MDKSA-2004:073 2004-07-27 Gentoo 200407-05 2004-07-05

Comments (none posted)

xine-ui - insecure temporary file creation

Package(s):	xine-ui	CVE #(s):	CAN-2004-0372
Created:	April 6, 2004	Updated:	April 27, 2006
Description:	Shaun Colley discovered a problem in xine-ui, the xine video player user interface. A script contained in the package to possibly remedy a problem or report a bug does not create temporary files in a secure fashion. This could allow a local attacker to overwrite files with the privileges of the user invoking xine.
Alerts:	Gentoo 200404-20 2004-04-27 Slackware SSA:2004-111-01 2004-04-20 Mandrake MDKSA-2004:033 2004-04-19 Debian DSA-477-1 2004-04-06

Comments (none posted)

Resources

Users Negligence is Biggest Threat to Security

Evans Data Corporation has announced the results of its new Security Development Survey. "A quarter of developers found social engineering and lack of adherence to policies to be the biggest problem, while another 15% cite lack of qualified personnel. However, only 11% of developers felt the solutions were too complex or difficult for users. "As with any other security concern, the best technology in the world can be undone by untrained or inattentive end users, the same holds true for the development of secure computing applications and projects," said Glenn MacEwen, an analyst with Evans Data. "Until the culture of computing security evolves to encompass regular security practices, businesses and people will remain vulnerable to attack and exploitation.""

The report also finds that developers believe that implementing security does not have a negative impact on computing performance. In this editor's experience, end users cite the hassle factor as the main reason they circumvent the policies.

Comments (none posted)

Securing Linux, Part 1 (IBM developerWorks)

IBM's developerWorks is running a new series on securing Linux systems. Part one has been published. "Only the paranoid survive, and that is no less true when securing Linux systems as any other. Fortunately, a host of security features are built into the kernel, are packaged with one of the many Linux distributions, or are available separately as open source applications. The first in a series, this article starts you on your way to understanding security concepts and potential threats, and sets the stage for what you really need to know: how to secure and harden a Linux-based installation."

Comments (none posted)

Page editor: Rebecca Sobol

Kernel development

Brief items

Kernel release status

The current 2.6 kernel prepatch is 2.6.8-rc2, which was released by Linus just prior to heading off to Ottawa. Changes this time include another big set of "sparse" annotations, a USB update, and lots of fixes; see the long-format changelog for the details.

Linus's BitKeeper repository has acquired no patches since 2.6.8-rc2. There have also been no new -mm releases in the last week; expect the process to remain stopped for a few days until OLS is done. Thereafter, expect a large flood of patches as various developers test the limits of the new development process, which states that more intrusive patches are welcome in 2.6.

The current 2.4 prepatch remains 2.4.27-rc3; Marcelo has released no patches since July 3.

Comments (1 posted)

Kernel development news

The 2004 Kernel Summit

The 2004 Kernel Summit was scheduled for July 19 and 20, immediately prior to the Ottawa Linux Symposium. For those who are interested, the advance agenda is available. LWN editor Jonathan Corbet was a member of the program committee and attended the event; the following is his report.

Monday

Monday got off to a bit of a slow start; it seems that some of the developers may have enjoyed themselves a bit too much at the opening dinner the night before. Summit attendees also had a serious problem: ISP troubles keep the wireless network down all day, so there was little alternative to actually listening to the ongoing sessions. That said, a constructive set of discussions was held with little overt disagreement among the participants.

Monday's sessions include:

• The processor panel. Engineers from Intel, AMD, and IBM discussed where their architectures are going and the implications for the Linux kernel.

• Virtual memory, with special attention to the topics of NUMA support, hotpluggable memory, and page clustering.

• Software suspend; what will it take before we can reliably suspend and restore our systems?

• Kobjects and sysfs, and what needs to be done to get the developers to complain about them less in 2.7.

• Video drivers, featuring a cameo appearance by Keith Packard.

• Desktop performance. Robert Love led a discussion on how the Linux kernel can better support desktop applications.

• Short topics, being an opportunity for developers to present an interesting issue in five minutes.

Tuesday

Tuesday's coverage is now complete. This long day was set aside for a wide range of topics, from customer experiences to clustering, to the development process. The individual sessions were:

• The customer panel was a discussion led by technical managers from Goldman Sachs and Amazon.com; they talked about the problems they have with Linux and how the kernel could better support their needs.

• Clustered storage and just what capabilities need to go into the kernel to support this feature.

• Kexec and fast booting; what is required to make the Linux kernel boot in a reasonable period of time?

• RAS tools, with an emphasis on simple tools to help track down kernel reliability problems.

• Networking summit summary. One week prior to the kernel summit, a small group got together in Oregon for a two-day networking summit. Stephen Hemminger summarized the results for the kernel group.

• Asynchronous I/O; a session on what is required to make AIO work properly under Linux, and whether it is worth doing.

• Multipath I/O and device mapper issues.

• Virtualization, running virtual machines under (and on top of) Linux.

• Security. Linux has acquired a great many security features over the last few years; what other work is required in that area?

• Class-based Kernel Resource Management.

• OSDL relations. How does the Open Source Development Labs relate with the development community, and how can that relationship be improved?

• The final session was about the development process; have a look to see what was said about when the 2.7 development series will begin - the answer is not quite what one would expect.

Comments (none posted)

Software suspend: and then there were two

Software suspend has long been one of the problem areas in the Linux kernel. Despite multiple available implementations, truly reliable, out-of-the-box support for suspending a system to disk and (crucially) restoring it again is still missing. The return of one long-missing developer may help to improve things, however.

Pat Mochel is the author of much of the power management and device model code in the 2.6 kernel. At one point in his efforts, his communications with software suspend ("swsusp") maintainer Pavel Machek broke down. In response, Patrick created his own fork of the software suspend code, which he called "pmdisk." The pmdisk code went into the kernel, and a small amount of work was done on it, but then Pat got busy with other things and vanished from the kernel development community. Nobody else was working on pmdisk, so the effort simply stalled. Pavel has discussed its removal from the kernel more than once, but that has not ever happened.

Just in time for the Kernel Summit, Pat returned with a 25-part patch set. Pat now believes that he made a mistake by forking the software suspend code, and is trying to make up. So his patch set removes pmdisk from the 2.6 kernel - but not before merging its best parts into the existing swsusp code base. With this patch set, swsusp is significantly cleaned up and more firmly integrated into the kernel's power management subsystem. This code base, Pat hopes, will prove a good starting place for further work toward respectable software suspend support.

There is one other player in this game, however: the swsusp2 work done by Nigel Cunningham and others. This code, which forked from swsusp some time ago, exists as a out-of-tree patch. It is, however, by many accounts, the most featureful and reliable software suspend implementation available for Linux. Swsusp2 offers a more polished display, the ability to abort the suspend operation, and more. Nigel has recently been making noises about trying to merge swsusp2 into the 2.6 mainline.

The last time this topic came up, there was a significant amount of resistance. All versions of swsusp feature a "refrigerator," which is a mechanism for cooling off all processes in the system before suspending the system itself. The swsusp2 refrigerator has seen significant amounts of work intended to keep the system from refrigerating processes which might still be needed by other parts of the system before it is suspended. The result is a large number of macro calls interspersed through the rest of the kernel marking places where a process should not be refrigerated. These changes make the swsusp2 patch relatively intrusive; they also create a new kind of critical section within the kernel which looks hard to maintain over the long run.

The current feeling, as reflected at the kernel summit, is that much of Nigel's work cannot be merged in its current form. It also needs to be split into a set of small, incremental patches before it can be considered. Hopefully this work will happen, however; swsusp2 has things to offer. If its best features can be merged in with swsusp, perhaps the kernel may yet move from three unreliable software suspend implementations to a single version which actually works.

Comments (8 posted)

Patches and updates

Kernel trees

• Linus Torvalds: Linux 2.6.8-rc2. (July 18, 2004)

• Nick Piggin: 2.6.8-rc1-np1. (July 17, 2004)

• Nick Piggin: 2.6.8-rc1-np3. (July 20, 2004)

Core kernel code

• Matthew Dobson: Create nodemask_t. (July 17, 2004)

• Patrick Mochel: Merge pmdisk and swsusp. (July 18, 2004)

• Ravikiran G Thirumalai: kref shrinkage patches -- 1 of 2 -- kref shrinkage. (July 20, 2004)

• Ravikiran G Thirumalai: kref shrinkage patches -- 2 of 2 -- kref shrinkage. (July 20, 2004)

• Hannes Reinecke: Limit number of concurrent hotplug processes. (July 20, 2004)

Development tools

• Peter Williams: CPU Scheduler Evaluation tool for 2.6.8-rc1. (July 18, 2004)

Device drivers

• Greg KH: USB patches for 2.6.8-rc1. (July 15, 2004)

• Greg KH: I2C update for 2.6.8-rc1. (July 15, 2004)

• Greg KH: Driver Core patches for 2.6.8-rc1. (July 15, 2004)

• Vladislav Bolkhovitin: [ANNOUNCE] [RFC] Generic SCSI Target Middle Level for Linux (SCST) version 0.9.2 released. (July 21, 2004)

Filesystems and block I/O

• Heinz Mauelshagen: *** Announcement: dmraid 1.0.0-rc2 ***. (July 15, 2004)

Janitorial

• Paul Mckenney: Improve readability of code using read_barrier_depends(). (July 20, 2004)

• Paul Mckenney: More comment improvements for RCU primitives. (July 20, 2004)

• Greg KH: delete devfs. (July 21, 2004)

• James Morris: Delete cryptoloop. (July 21, 2004)

Architecture-specific

• Eric W. Biederman: [PATCH] 2.6.8-rc1-kexec1 (ppc & x86). (July 15, 2004)

• Ingo Molnar: NX: clean up legacy binary support, 2.6.8-rc2. (July 18, 2004)

• Andi Kleen: x86_64-2.6.8rc2 released. (July 20, 2004)

Miscellaneous

• Nigel Cunningham: Software Suspend is on the move!. (July 15, 2004)

• Marcelo Tosatti: List of pending v2.4 kernel bugs. (July 20, 2004)

Page editor: Forrest Cook

Distributions

News and Editorials

Cobind Linux Desktop

With the release of Fedora Linux into the wild by Red Hat the proliferation of distributions based on it has been growing. This is a good thing. Even with Fedora Core Linux being more community based, no distribution can be all things to all people. This is a review of one of these new distributions, Cobind Linux.

According to their website -

Great market speak, but what does it mean? Cobind is built on Fedora Core 1 but striped down to fit on one CD. They did this by leaving out the big and complex software. No OpenOffice. No Evolution. No GNOME or KDE. No development tools. Just a light weight yet functional desktop OS. But lest you think that they skimped on the available tools and apps, the default install still consists of 537 RPM packages.

What you do get is the wonderful Xfce4 Desktop Environment and what Cobind refers to as the "best-of-breed" applications. These include Firefox for web browsing, Thunderbird for news and email, gaim for all your IM needs and a productivity suite made up of AbiWord, Gnumeric, the GIMP, XMMS and GnuCash. It does include the three main file managers in Konqueror, Nautilus and XFFM but otherwise keeps the duplication of programs to a minimum. There are no servers in this distribution as it is well focused on the desktop. But enough of the talking, let's get to the test drive.

Anyone who's ever installed any of the Red Hat or Fedora Linux versions will be right at home here. Cobind uses Anaconda for installation and configuration. There's no section in the install for selecting packages but that is to be expected with a distribution focused on simple and easy. Just a few clicks and the occasional input screen.

After the install and the normal "firstboot" screen you get the Cobind login screen. It's a clean and pleasant configuration of GDM (seen here running under VMware). Once logged in, you see a simple desktop with a panel at the bottom, a bar at the top and the familiar desktop icons of Nautilus. It doesn't have many menus, just the applications. The apps are, from left to right, Terminal, File Manager (xffm), Firefox, Thunderbird, gaim, AbiWord, Gedit, Gnumeric, GnuCash, Mplayer, XMMS and k3b. The desktop is managed by Nautilus instead of the xfdesktop4 (part of xfce4). If you kill off Nautilus you get xfdesktop4, which is quite good in its own right. Next on the panel comes the configuration menu followed by the Software Manager (more in this later), Help/Documentation, Lock, Log out and the clock.

While the layout and available/clickable programs may seem quite sparse, the distribution comes with everything a home user might need. And it's all configured so that very little user intervention is ever needed. Should any configuration be needed all of the config tools from Fedora are also available.

The most significant part of Cobind Linux is the Software Manager. Cobind has made a GUI front end to the command line RPM management tool yum. This program makes using yum very intuitive and easy. You can update, add or remove RPMs from any repository you want. Adding new repositories is as easy as clicking an Add button. The program gives you three tabs at the top half of the window where you can see RPMs to Install, Remove and Update, if there are any available updates. There's also a Settings tab from where you manage the repositories. The bottom half is divided again into two with the left side giving you a description of the RPM that is selected (from any of the above tabs). On the right is the output of the actual yum command so you can see what is actually being shown "under the hood". These last two features make this tool better than Red Hat's up2date, in this writers opinion. With this Software Manager you can easily install any of the programs that you might want, like OpenOffice for example. Just select it from the Install tab and off you go.

Cobind Linux might feel a bit restrictive to some seasoned Linux users, especially with it's lack of any development tools, but it does make for a very nice home desktop system. Fast, light but with plenty of capabilities, Cobind has some interesting potential as a Linux distribution.

Comments (2 posted)

Distribution News

OpenPKG 2.1

The OpenPKG project has announced version 2.1 of its OpenPKG software. New in 2.1: increased platform support, lots of new packages in the repository, and more. Click below for additional details.

Full Story (comments: none)

Debian GNU/Linux

The Debian Weekly News for July 20, 2004 is out. Topics this week include the University of Zaragoza in Spain which plans to distribute 50,000 copies of its Debian/GNOME based distribution; the General Resolution to force AMD64 into Sarge; Debian's increasing market share; GNUstep policy violation; GNU Compiler Collection 3.4 in unstable; and more.

The Debian-Installer team met on IRC on July 17. Here are the minutes of that meeting.

This Bits from the listmasters post reports on new lists, changed lists and has other information to help you get the most out of all 169 available Debian mailing lists.

This week's Front page contains an analysis of the General Resolution to force AMD64 in Sarge. We'll just add a post from Martin Michlmayr, Debian Project Leader, on the steps he has taken to resolve this issue.

Ian Lynagh has made two new package status web pages available. One gives you the status of all your packages (or an arbitrary list of packages) on all arches, the other gives you the information in the buildd status text files.

Comments (none posted)

Gentoo Linux

The Gentoo Weekly Newsletter for the week of July 19, 2004 is out with a look at the Gentoo MacOS X release.

The Gentoo Project has announced the release of tenshi 0.3 with some major improvements. Tenshi, formerly known as Wasabi, is a log monitoring program initially developed for Gentoo infrastructure servers. Tenshi 0.3.1, a bug fix release, is also available.

Comments (none posted)

New Mandrakeonline easily updates Mandrakelinux systems

Mandrakesoft has announced the availability of a new update service aimed at helping corporations keep their systems up-to-date: Mandrakeonline provides a wide range of valuable services for taking care of all updates on a range of Mandrakelinux systems, at a low cost.

Full Story (comments: none)

ELX Linux Sets the Pace With Biz Desk 4.0 (ChannelTimes.com)

The ChannelTimes takes a quick look at ELX. "ELX Linux, the Hyderabad-based Linux distributor, is overwhelmed with the sales of its Biz Desk 4.0 Linux and claims that it is months ahead of the competition. Manojit Majumdar, head-sales, ELX, explained, "When we started selling three months ago over the Internet, the response was very encouraging and we set up a channel in Hyderabad, Andhra Pradesh. We will now be building our channel in Delhi and Bangalore as well.""

Comments (none posted)

Lineox Linux gains more updates, global file system support (Desktop Linux)

Desktop Linux takes a look at Lineox Enterprise Linux. "Lineox claims to reduce the cost of Linux by eliminating many of the production fees associated with boxed sets and bundled support programs. Always Current Lineox Enterprise Linux is based on freely distributable programs found in Red Hat Enterprise Linux 3.0 AS/ES/WS, Red Hat Cluster Suite, and Red Hat Developer Suite."

Comments (none posted)

Fedora Core

Fedora Core 2 updates:

• mod_python: browsing the manual caused an internal server error in httpd
• system-config-network: bug fixes
• texinfo: upgrade to 4.7

Comments (none posted)

New Distributions

H3Knix

H3Knix is a small, source-based, desktop Linux distribution. It provides a custom package management system based on "capsules", which allows the user to select the functionality they require (e.g., "Dialup Internet access"), and it will automatically retrieve all required applications, including relevant dependencies. H3Knix joins the list at version 1.2 released July 14, 2004.

Comments (none posted)

Lisp Resource Kit

The Lisp Resource Kit is a dedicated development/learning environment on a self-booting CD. It is designed to be an easy to use single resource for those who are interested in exploring Common Lisp, regardless of their experience or domain of expertise. (Thanks to Chris Riddoch)

Comments (none posted)

Minor distribution updates

blueflops

blueflops has released v2.0.5 with minor feature enhancements. "Changes: New translations are available for French and German. The Latin-1 console font has been replaced with Latin-9."

Comments (none posted)

Coyote Linux

Coyote Linux has released v2.11 with major security fixes. "Changes: This release upgrades the SSH server to dropbear 0.43 to fix a potential security problem."

Comments (none posted)

CrashRecoveryKit v2.6.7 (X86_64/AMD64) released

Crash Recovery Kit has released an X86_64/AMD64 port of CRK 2.6.7. Click below for details.

Full Story (comments: none)

Echelon Linux

Echelon Linux has released v0.2. "Changes: Echelonlinux has been redesigned from scratch. Only Nagios, NTOP, and NESSUSd are integrated. The administration interface skin is now derived from the echelonlinux Web site."

Comments (none posted)

Hakin9 Live

Hakin9 Live has released v2.0.1 with code cleanup. "Changes: This version has been created from scratch, based on Aurox Live 9.3. Some artifacts from an early, experimental stage of Hakin9 Live were cleaned up. Some problems with booting h9l on some hardware were fixed. XFCE4 was added as a new window manager option. This version has most of the tools that were in previous version, as well as some more."

Comments (none posted)

LEAF (Linux Embedded Appliance Firewall)

LEAF has released Bering-uClibc 2.2-beta5 with minor feature enhancements. "Changes: This release updates ash to dash 0.5.1. There are various other upstream updates (dropbear, iptables, shorewall, etc.). PCMCIA has been reworked to support more cards."

Comments (none posted)

MoviX

The MoviX project has released MoviX2 v0.3.1RC1 with major feature enhancements. "Changes: In this release, all new MoviX features (including the two 'console' interfaces) have been imported, XFree86 has been upgraded to 4.4.0, and experimental support for proprietary ATI and Kyro video drivers have been added."

Comments (none posted)

PLD RescueCD

PLD RescueCD has released v1.93 with major feature enhancements. "Changes: The kernel was updated to PLD 2.4.27rc1 with NTFS 2.1.6b and cifs. 276 packages were updated. The serial console was fixed. Hardware detection was improved. Support was added for remote network boot via PXE. Autodetection of sagem Eagle 8051 Analog was added. 40 new packages were added, including clamav, linux-atm, grub, star, and wipe."

Comments (none posted)

Distribution reviews

The Stealth Desktop, Part II (OfB.biz)

Open for Business continues configuring Slackware for desktop use. "In Part II we will focus on the hardest part: making sound and video work. Sound is not especially difficult; but video is. Fortunately, after this step, it is an easy ride. Now, do not despair: I said that this part is hard, not that it is arcane, difficult to understand, or for "Unix wizards" only. It is hard because it differs so much from other distros which have, for the most part, better tools to do the task. But you can certainly do it and you have a very good chance to succeed."

Comments (none posted)

Page editor: Rebecca Sobol

Development

MusE, the MIDI/Audio Sequencer

After many months of continuous development work, version 0.7.0 of MusE, a GPL licensed multi-track virtual studio has been released.

"This release has been in development for over half a year and the list of changes is huge. This milestone release has internal as well as external redesigns resulting in much improved stability. MusE 0.7 has also improved usability as well as plenty new and improved features."

Some of the MusE features include:

• Real-time and step-mode MIDI recording.
• Audio recording, playback, and sequencing capabilities.
• Synchronization with the internal real time clock, external MIDI Time Code, MIDI clock, and JACK.
• Master and slave synchronization capabilities.
• Support for an unlimited number of inputs, outputs, auxilliary devices, and tracks.
• Integrated support for software synthesizers.
• Support for pre and post-fader LADSPA audio effects.
• Support for the Jack Audio Connection Kit (JACK) for audio routing.
• Support for the ALSA sound and MIDI drivers.
• A Midi and audio automation architecture.
• An integrated audio mixer console.
• Real-time editors for piano rolls, musical scores, drums, controllers, lists, shortcuts, and master tracks.
• Unlimited undo/redo.
• A MIDI mixer, transformator, device configurator, sync configurator, and input filter.
• XML formatted project and configuration files.
• Midi instrument definition files.

The online documentation has more information on installation and use of the software.

MusE has a certain eye-candy appeal, take a look at the various Screen Shots to see it in action. The software is available for download here.

The build prerequsites for MusE are quite lengthy, and are probably well beyond the grasp of most casual Linux users. They include Qt 3.2, gcc 2.95.2, glibc 2.1, the 2.4 kernel with low latency patches applied or the 2.6 kernel with the realtime-lsm module, kernel /dev/rtc support, ALSA, JACK, and libcap-dev 1.10. MusE currently compiles on both x86 and PPC-based Linux systems. One might save a lot of time getting the software up and running by working with an audio meta-distribution such as Planet CCRMA.

Comments (none posted)

System Applications

Audio Projects

Planet CCRMA Changes

The latest changes from the Planet CCRMA audio utility packaging project include new releases of the SWH LADSPA Plugins, Ardour, and the CMT LADSPA Plugins.

Comments (none posted)

Database Software

Kexi 0.1 Beta 4 is available (KDE.News)

Version 0.1 beta 4 of Kexi has been released. "Kexi is an integrated environment for managing data. It helps creating database schemas, inserting, querying and processing data." Changes include improvements to the Form, Query, and Table Designers, bug fixes, and more.

Comments (none posted)

Pear DB 1.6.5 (stable) released

Stable version 1.6.5 of Pear DB, the Database Abstraction Layer of the PHP Extension and Application Repository (PEAR) is out with bug fixes. See the Changelog for the details.

Comments (none posted)

PostgreSQL Weekly News

The July 20, 2004 edition of the PostgreSQL Weekly News is out with the latest PostgreSQL database developments and events.

Full Story (comments: none)

Embedded Systems

BusyBox 1.0.0-rc1 released

Release Candidate #1 of BusyBox 1.0.0, an integrated collection of command line utilities for embedded Linux systems, has been announced. "Here goes release candidate 1... This fixes all (most?) of the problems that have turned up since -pre10. In particular, loading and unloading of kernel modules with 2.6.x kernels should be working much better. I really want to get BusyBox 1.0.0 released soon and I see no real reason why the 1.0.0 release shouldn't happen with things pretty much as is. BusyBox is in good shape at the moment, and it works nicely for everything that I'm doing with it." See the Change Log for more information.

Comments (none posted)

Libraries

GLib 2.5.0 released

Unstable release 2.5.0 of GLib is available. "This is the first development release loading up to GLib-2.6. This release contains new g_debug() macros and a number of bug and portability fixes."

Full Story (comments: none)

Pango 1.5.1 released

Unstable version 1.5.1 of Pango, a text layout and rendering library, is available. New features include ellipsization support, custom font decoder support, and more.

Full Story (comments: none)

Mail Software

milter-spamc 0.21 released

Version 0.21 of the milter-spamc mail filter has been released. "This update to milter-spamc provide 2, yet significant, bug fixes related to the handling of the null address and the simulated Recieved header prepended to the message given to spamd. Its worth updating."

Comments (none posted)

Printing

Gimp-Print 4.2.7 released (SourceForge)

Version 4.2.7 of Gimp-Print is out. "This is expected to be the last release in the 4.2 series unless any critical bugs are found or 5.0 is further delayed. Gimp-Print is a suite of printer drivers that may be used with most common UNIX print spooling systems, including CUPS, lpr, LPRng, or others."

Comments (none posted)

Web Site Development

APLAWS+ 1.0.1 released (SourceForge)

Version 1.0.1 of APLAWS+, an open-source Content Management System (CMS), is out. "Following considerable work on the code for the London Borough of Camden's implementation of APLAWS+, many bug fixes and improvements made by Red Hat have now been made available into a new release of the APLAWS+ code. This release also includes bug fixes and enhancements from other suppliers and went through a quality assurance process with Camden developers and GoMeta. This work serves as the first release in terms of the development path of APLAWS+ for the next year."

Comments (none posted)

opensurveypilot v1.2 now available for download

Version 1.2 of opensurveypilot, a web-based polling and voting system, is out. "The package now features multi language support and ships with german and english language files. Beside the improved GUI, most of the time was spend on the new panel modul with build in mailclient and integrated user administration."

Full Story (comments: 1)

Silva 1.0 released!

Version 1.0 of Silva has been announced. "Silva is an open source content management system with a focus on structured content and its reuse. It is based on the open source web application platform Zope, and the programming language Python." Changes include integration with the Kupu WYSIWYG web editor, complete documentation, support for image thumbnails and cropping, and more.

Full Story (comments: none)

ZopeMag Weekly News

The June 26 - July 17, 2004 edition of the ZopeMag Weekly News is online with another collection of Zope and Plone information.

Comments (none posted)

Desktop Applications

Accessibility

Accessible Software (O'Reilly)

Jouke Visser works with pVoice on O'Reilly's perl.com. "You can use the AAC::Pvoice modules to create GUI applications for people who have difficulty using conventional input devices like a mouse or a keyboard. Instead, those people can use your applications using only one or two keystrokes, mouse buttons, or switches on a wheelchair. You can also enhance the use of a conventional mouse or touch screen by highlighting objects on the screen as the mouse cursor hovers over them. AAC::Pvoice does not only handle the input for you, but it also provides an accessible graphical user interface."

Comments (none posted)

Audio Applications

EasyTAG 0.31_gtk2.4_pre1 is out

EasyTAG version 0.31_gtk2.4_pre1 has been released. "EasyTAG is an utility for viewing and editing tags for MP3, MP2, FLAC, Ogg Vorbis, MusePack and Monkey's Audio files. Its simple and nice GTK+ interface makes tagging easier under GNU/Linux." This release is a development version that features bug fixes, translation improvements, and more.

Comments (none posted)

News from the Festival Speech Synthesizer project

After more than a year without any significant news, the Festival speech synthesis project has posted an announcement for a new beta release. "Version 2.0 is coming at the end of July 2004. A beta version of this release labeled 1.95-beta is currently available for testing. This is the most recent version available free for unrestricted use." Changes include a new model based synthesis engine, support for gcc 3.2, 3.3, intel 8.0, and Apple OS X, bug fixes, and more.

Comments (none posted)

Desktop Environments

Updating .desktop files

Jonathan Blandford has announced upcoming changes to the .desktop file formats. "We'd like to move to use the freedesktop desktop file specification for mapping applications to MIME Types. That will let both GNOME and KDE (and other desktops) share the same database for applications, and provide a clear target for application developers. As preparation for this change, we'll need to modify the desktop files that we're installing to have a MimeType key."

Full Story (comments: none)

KDE-CVS-Digest (KDE.News)

The July 16, 2004 KDE CVS-Digest is online, here's the content summary: "Kolourpaint adds Emboss and dithering effects, more levels of undo. Digikam adds RGB balance plugin. KPresenter adds a custom slide show option. Krita improves input tablet support. Kexi continues improvement to query editing. KSpread gets a new formula engine. Kopete sees beginnings of MSN file transfer support. KConfigEditor can edit both Gnome and KDE configurations, and export configurations in KJSEmbed JavaScript."

Comments (none posted)

Games

gnome-games 2.7.5

Version 2.7.5 of gnome-games, a collection of games for the GNOME platform, is available. "This is the last release before the feature freeze, therefore it is full of new features. Klotski has been put back into the distribution. The network code for iagno has been factored out and there is a new connection dialog. The game server for iagno is now available for local use, it can be found in the libgames-support directory. Finally, gnometris has sounds !"

Full Story (comments: none)

Sear 0.5.0 Released

Version 0.5.0 of Sear has been released by the WorldForge game project. "This most important feature of this release is the Mercator integration for server generated terrain."

Comments (none posted)

Stratagus: Open Source Strategy Games (O'Reilly)

Howard Wen looks at the game Stratagus on O'Reilly. "Still, the main advantage of Stratagus over commercial engines is that players can easily modify games or create their own. Of course, there's both the Linux factor and its cross-platform compatibility, since Stratagus runs on Mac OS X and BSD, too. "One big disadvantage of commercial RTS games is they only provide a Windows version. You will rarely see a commercial RTS game for Linux," points out Nehal, who resides in Vancouver, Canada. He helped to develop the code for the sound and user interface of FreeCraft and contributes to its successor."

Comments (none posted)

Graphics

Inkscape 0.39 announced

Version 0.39 of Inkscape, a Scalable Vector Graphics Editor, is available. "The most important change in this release is the switch to the Pango library for font handling and Unicode support; a lot of work also went into new SVG features, export/import, UI, and usability."

Full Story (comments: none)

GUI Packages

gob2 2.0.9 the "C++ is for girly men" release

Version 2.0.9 of gob2, a GObject generator for GTK+ is out. "Do you enjoy warnings? Well too bad, now gob compiles even with very pedantic warnings set on the gcc command line, even ones as stupid as -Wbad-function-cast."

Full Story (comments: none)

GTK+ 2.5.0 released

Unstable release 2.5.0 of GTK+, a multi-platform toolkit for GUI development, is out. "This is the first development release loading up to GTK+-2.6. This release contains several new widgets and capabilities, including a new icon view widget, an about dialog, simple rotation support for GdkPixbufs, new cell renderers for combo boxes and progress bars, new stock icons, performance improvments, and bugfixes."

Full Story (comments: none)

Imaging Applications

Eye of Gnome 2.7.0

Version 2.7.0 of Eye of Gnome is available. "The by far biggest change for the default GNOME image viewer is the removal of the bonobo components. It comes now as a monolithic program again and makes use of the new wonderful GtkUIManager API. This change leads to great speed improvements and a much better user interface. On the shadow side the Nautilus "View as Collection" component isn't available anymore. It's planned to provide a new Nautilus extension in the future as a replacement."

Full Story (comments: none)

Interoperability

Wine 20040716 is available

Version 20040716 of Wine has been announced. Changes include implementation of the Microsoft Installer dll, inter-process window repaint work, DirectSound improvements, and bug fixes.

Comments (none posted)

Multimedia

GStreamer 0.8.4 is out

Version 0.8.4 of the GStreamer streaming media framework has been announced. Changes include better internationalization, new translations, bug fixes, and other improvements.

Comments (none posted)

Music Applications

Ardour 0.9beta18.2 released

Version 0.9 beta 18.2 of Ardour, a multi-track audio recording package, has been announced. "This fixes several bugs found shortly after the release of 18.1 that are deemed important."

Comments (1 posted)

swh-plugins 0.4.7 announced

Version 0.4.7 of the swh-plugins are available. This release includes a build fix, a new fast lookahead limiter plugin, bug fixes, and more.

Full Story (comments: none)

News Readers

Straw 0.25.1 is out

Version 0.25.1 of Straw, a desktop news aggregator for GNOME, is available and features one bug fix. This follows version 0.25, which had bug fixes, performance enhancements, and improved translations.

Full Story (comments: none)

Office Suites

New snapshot OpenOffice.org 1.9.m47

OpenOffice.org has a new snapshot of the upcoming OpenOffice.org 2.0 ready for download. The 1.9.x series offers a glimpse of many of the new features and bug fixes coming with the 2.0 release. Click below for pointers to the download, release notes and other information.

Full Story (comments: none)

PDA Software

Guikachu 1.5.1 released

Stable version 1.5.1 of Guikachu, the GNOME Resource editor for PalmOS projects, is out. The change summary says: "A more sophisticated GNOME 2 port than 1.5.0, this release utilizes the advanced features of GTK+ 2.4, providing a much nicer look and an array of usability improvements".

Full Story (comments: none)

Web Browsers

Mozilla 1.8 Alpha 2 Released (MozillaZine)

The alpha 2 release of Mozilla 1.8 has been announced. "In this release, users can open blocked popups and consolidate all their POP3 mail in a global inbox. Initial support for the new Netscape Plugin API extensions has also been implemented. In May, the Foundation switched to a new milestone schedule with a longer alpha period and two alpha releases in each development cycle. The next freeze is scheduled for Wednesday 4th August, with the target for Mozilla 1.8 Beta set at couple of days later."

Comments (none posted)

Miscellaneous

Blogfish 0.1 initial release

Blogfish version 0.1, the initial release, is out. "Blogfish is a Gnome panel applet, using PyGTK and Gnome-python. It allows users to spread their blog URL, website URL or random thoughts to other users, in piscine form. Good memes survive; bad ones are voted down and go belly up."

Full Story (comments: none)

GNOME System Tools 0.90.0 has been released

Version 0.90.0 of the GNOME System Tools configuration utility collection is out. Changes include a complete set of help docs, UI improvements, support for Fedora Core 2 and Slackware 10, bug fixes, and more.

Full Story (comments: none)

Languages and Tools

C

gcc newsletter #6

Issue #6 of the gcc newsletter is available. Topics include the release of gcc 3.4.1 and other gcc development issues.

Comments (none posted)

Caml

Caml Weekly News

The Caml Weekly News for July 13-20, 2004 is online with another collection of Caml language articles.

Full Story (comments: none)

Java

gcj news

Some new news from the Gnu Compiler for Java project (GCJ) is available. "AWT and Swing support continues to improve rapidly. Thomas Fitzsimmons of Red Hat added support for the AWT 1.0 event model, still used by many web applets. This means that Slime Volleyball now runs on GCJ and gcjwebplugin."

Comments (none posted)

An Introduction to Aspect-Oriented Programming with the Spring Framework (O'ReillyNet)

O'Reilly has published part one in a series on the Spring framework by Russ Miles. "This article, part one of this introduction to Aspect-Oriented Programming (AOP) with the Spring framework, covers the basics to get you quickly developing using aspect orientation in Spring. Using tracing and logging aspect examples, the HelloWorlds of aspect orientation, this article shows how to declare pointcuts and advice in order to apply aspects using the unique facilities that the Spring framework provides."

Comments (none posted)

Functional programming in the Java language (IBM developerWorks)

Abhijit Belapurkar writes about functional programming in Java on IBM's developerWorks. "If you work on large-scale development projects, then you're familiar with the advantages of writing modular code. Well-structured, modular code is easier to write, debug, understand, and reuse. The problem for Java developers is that the functional programming paradigm has long been implemented only via specialized languages such as Haskell, Scheme, Erlang, and Lisp. In this article, author Abhijit Belapurkar shows you how to use functional programming constructs such as closures and higher order functions to write well-structured, modular code in the Java language."

Comments (1 posted)

Perl

Perl 5.8.5 Released (use Perl)

Perl version 5.8.5 has been announced. "5.8.5 is a maintenance release for perl 5.8, incorporating various minor bugfixes and optimisations."

Comments (none posted)

Gtk2-Perl 2.7.4 Released

Version 2.7.4 of Gtk2-Perl, the Perl bindings to GTK+ 2.x, is out. "This is the API-frozen Gtk2-Perl 2.7.4."

Full Story (comments: none)

PHP

PHP 5.0.0 Released

Version 5.0.0 of PHP is available. This version adds the new Zend Engine II, reworked XML support, the new SimpleXML extension, a new SOAP extension, a new MySQL extension, SQLite bundling, improved streams, and more. PHP 4.3.8 has also been released.

Comments (none posted)

Why PHP 5 Rocks! (O'Reilly)

Adam Trachtenberg explores PHP version 5 on O'Reilly. "In this article, I highlight seven of my favorite PHP 5 features. These features allow your PHP 5 code to frequently be shorter, more elegant, and more flexible than ever before."

Comments (none posted)

PostScript

GGV 2.6.2 is out

Version 2.6.2 of GGV, a PostScript previewer, is out with a number of bug fixes.

Full Story (comments: none)

GGV 2.7.0 is out

Version 2.7.0 of the GGV PostScript previewer, the first release in the 2.7 series, is available. Changes include numerous bug fixes, a file chooser filter, Gnome integration, a new print icon on the toolbar, and more.

Full Story (comments: none)

Python

PyGTK 2.3.93 (unstable) is available

Unstable release 2.3.93 of PyGTK, the Python bindings to GTK+, has been announced. This release features bug fixes, build fixes, and numerous other changes.

Full Story (comments: none)

Dr. Dobb's Python-URL!

The July 19, 2004 edition of Dr. Dobb's Python-URL! is out with the week's Python language article links.

Full Story (comments: none)

Tcl/Tk

Dr. Dobb's Tcl-URL!

Dr. Dobb's Tcl-URL! for July 19, 2004 is available with the latest Tcl/Tk article links.

Full Story (comments: none)

Build Tools

Ant 1.6.2 is Available

Version 1.6.2 of Ant, a build tool for Java, has been released. Here is the summary of changes: "Nested elements for namespaced tasks and types may belong to the Ant default namespace as well as the task's or type's namespace. All exceptions thrown by tasks are now wrapped in a buildexception giving the location in the buildfile of the task. Ant 1.6.2 fixes a large number of bugs and adds a number of features which were asked for by users on Bugzilla."

Comments (none posted)

Cross Assemblers

gputils-0.12.2 Released

Version 0.12.0 of gputils, the GNU Pic Utilities, is out. The release blurb says: "Fixed many bugs and added features to gpal."

Comments (none posted)

Profilers

Valgrind-2.1.2 is available

Version 2.1.2 of Valgrind, a tool suite for debugging and profiling x86 programs under Linux, is out. "2.1.2 contains four months worth of bug fixes and refinements. Although officially a developer release, we believe it to be stable enough for widespread day-to-day use. 2.1.2 contains many improvements relative to the current 2.0.0 stable release, and includes a new tool, Massif, for profiling the heap (space) use of your programs."

Full Story (comments: none)

Page editor: Forrest Cook

Linux in the news

Recommended Reading

Is Linux Desktop Better Than Windows? (LinuxPlanet)

LinuxPlanet compares Linux to Windows in the educational arena. ""Using Windows ME, we've had lots of problems with popups and spyware. There's been none of that with Linux," says Subroto Mukerjea, a site director for the Computer Learning Center in Fairfax County, VA. Mukerjea oversees one of 14 sites within an after school program for children and teens aged six to 16. "Windows 95 was always going down," maintains Paul Mundell, national director of canine programs at Canine Companions for Independence, Santa Rosa, CA. "The problem with Windows 2000 isn't 'crashing.' It's just that, after a while, applications start running more slowly and features don't work as well unless you say to yourself, 'Maybe it's time to rebuild your hard drive.'""

Comments (18 posted)

Linux now a corporate beast (GCN.com)

Government Computer News notes that the Linux kernel has become a corporate effort. "About 1,000 developers contribute changes to Linux on a regular basis, Morton said. Of those 1,000 developers, about 100 are paid to work on Linux by their employers. And those 100 have contributed about 37,000 of the last 38,000 changes made to the operating system."

Comments (15 posted)

Trade Shows and Conferences

Java on eWeek

eWeek covers a JBoss announcement that the JBoss Application Server has passed the compatibility test suite for the Java 2 Enterprise Edition platform Version 1.4.

eWeek interviews Java creator James Gosling. "With NetBeans day occurring at JavaOne this year, I have to ask about Eclipse. Is the possibility of a Sun membership still on the table?
It's sort of hard to imagine us joining. I think that maybe Eclipse should join the NetBeans group."

Comments (3 posted)

The SCO Problem

Another SCO Memo, Reply Memorandum Re Discovery (Groklaw)

Groklaw takes a look at the latest long memo from SCO in the IBM case. "SCO repeatedly argues that it needs all this discovery so it can 'streamline, narrow and prioritize its searches for code and non-literal elements in Linux that originated in UNIX.' If they get every version of AIX and Dynix that there ever were, how will that streamline the search? It's silly to say that, but they are trying to tell the judge that it will speed the process up and increase efficiency, because judges like to hear that."

Comments (1 posted)

AutoZone Hearing Transcript (Groklaw)

Groklaw now has the transcript from the AutoZone hearing. "You will see that many of the stories you have been reading in the press about what happened at the hearing were not accurate. Well, what else is new? That's what transcripts are for."

Comments (2 posted)

Eyewitness Reports from the DC Hearing - SCO Trounced (Groklaw)

Groklaw is carrying a pair of reports from today's hearing in the SCO v. DaimlerChrysler case. All of SCO's charges got thrown out except one: whether DC should have responded in less than 30 days. "What that means is SCO's action against DC is over in all meaningful senses. I can't believe they will wish to spend the money to litigate over something so trivial with no conceivable damages or useful relief, even if they were to prevail, and I doubt they could anyhow. Still, this is SCO, so we will have to wait and see." Lesson: if you get a "certification demand" from SCO, be sure to tell them to take a hike within the 30 day deadline.

Comments (14 posted)

Companies

Will the first Linux carwash clean up? (Register)

The Register takes a look at a Linux-only computer store and carwash. "Sub500.com is the brainchild of Marc (32) and David Silverman (37), carwash owners, computer parts brokers and online retailers. They have opened a small Linux-only computer store in a room at the front of their carwash on Dufferin Street, in the northern suburbs of Toronto, a neighbourhood of large malls and offices cheered only by a few friendly Italian restaurants and cafes."

Comments (none posted)

IBM tries to hook computer science students (News.com)

News.com reports that IBM is offering free (as in beer) software and discounted hardware to universities. "Announced Tuesday, the IBM Academic Initiative is designed to create computing science curricula around IBM-backed technologies, notably the Java programming language and open-source software such as Linux."

Comments (none posted)

JBoss airs expansion plans (News.com)

News.com covers JBoss plans to get into the middleware business. "The company is evaluating a plan to purchase an existing infrastructure software, or middleware, company and make its product available for free under an open-source license, Bob Bickel, JBoss' vice president of corporate development and strategy, told CNET News.com."

Comments (none posted)

World's best-dressed Linux backer leaves Sun (Register)

The Register's reports that Peder Ulander is leaving Sun to work for MontaVista Software. "Ulander is easily the best-dressed member of the Linux community - think a young open source-leaning Jerry Sanders. And, hey, he can afford nice clothes. Ulander arrived at Sun following its $2bn buy of Linux appliance-maker Cobalt Networks."

Comments (8 posted)

Red Hat hit with class-action lawsuits (Triangle Business Journal)

Yesterday, Red Hat said it would make minor tweaks to the way it accounts for subscription revenue. Today, the Triangle Business Journal reports, at least two law firms have filed class-action shareholder lawsuits against the company. "The precipitous drop didn't escape the attention of Atlanta-based Chitwood & Harley LLP and New York-based Goodkind Labaton Rudoff & Sucharow LLP, which announced in separate press releases Wednesday that they had filed class-action suits against Red Hat and some of its executives. According to the press releases, the law firms accuse Red Hat of defrauding its investors by reporting false and misleading financial information."

Comments (17 posted)

Sun may put Java server on open-source table (ZDNet)

ZDNet covers an announcement from Sun Microsystems concerning the possible release of the Java Enterprise System as an open-source project. "The company on Thursday issued a statement saying, "Sun is considering open sourcing Java Enterprise System, but no final decision has been made." A Sun representative attributed the statement to Stephen Borcich, executive director of Sun's Java Enterprise System, and offered no other details. Sun has faced pressure to release the Java language and associated programming software to the open-source community, though it has indicated that it is reluctant to do so. Sun has also said that it will eventually make its Solaris Unix operating system open source, but has not offered details on timing or licensing changes."

Comments (2 posted)

Linux Adoption

In the beginning was Word (Independent.co.uk)

Independent.co.uk has published an article that looks at how the Microsoft legacy in the school system affects the adoption of Linux. "But can schools move away from Microsoft, as some in the business world are doing? There, the Linux operating system (which can be installed on a standard PC) is stirring things up: a typical Linux distribution contains OpenOffice - which is based on StarOffice, and compatible with Microsoft Office - along with other word processors. In the right hands, Linux pushes Microsoft off the desktop along with the most common viruses, worms and spyware. Linux, the argument goes, might help children to grow up to be computer-literate rather than Microsoft-literate." Thanks to Philip Webb.

Comments (none posted)

Interviews

More than an open-source curiosity (News.com)

News.com features an interview with Miguel de Icaza.
Q: "Now that Mono 1.0 is done, what can you do that you couldn’t do before?"
A: "Oh, Unix is a world of pain for developers. Now, basically what we got is very modern IDEs (integrated development environments) for developing software on other platforms."

Comments (54 posted)

The downlow on Mono (NewsForge)

NewsForge talks with Erik Dasque, the senior project leader for Mono. "Dasque: I think a lot of people view Mono as a .Net clone, and I think it goes well beyond that. I think the fact that it's a .Net implementation is great. It's a means to an end. But our goal was not to create a .Net implementation. Our goal is to deliver a development platform that works for Linux, that is what Linux needs to kind of go beyond what it has achieved to date."

Comments (12 posted)

Mozilla and the future of the Web (NewsForge)

NewsForge is running an interview with the Mozilla Foundation director of engineering, Chris Hofmann. "The issue of security is one that has got out of control for Microsoft, and that has benefited Mozilla. Every day people migrate to Mozilla and Firefox to get away from the spyware and security issues of Internet Explorer, and Microsoft isn't doing anything to change that. Hofmann says, "Microsoft seems unlikely to do a major PR campaign advising developers to move away from ActiveX until they have another proprietary solution in place to lock up the migration. I'm guessing that will come with Longhorn. If I was running a Web site or IT department, I'd be making plans to do this migration from ActiveX on my terms, and I'd be doing it as rapidly as possible."

Comments (1 posted)

Resources

Picking Your Lightweight Linux Desktop (eWeek)

eWeek looks at a the thin client approach to lightweight Linux desktops. "[L]et's say you want more control over your desktops. In that case, what you want is a Linux-based, thin-client approach. If that's you, you can also put together your own Linux thin-client solution with LTSP (Linux Terminal Server Project)."

Comments (2 posted)

Boot Linux from a FireWire device (developerWorks)

This IBM developerWorks article walks through a Gentoo install on an external FireWire drive. "Once you have booted with the install CD, with a bit of luck it should have recognized your drive. The drive should appear as a disk under /dev/sdX, where X is a lowercase letter starting at "a." On my system, the external drive was detected as /dev/sda, but this will vary if you have other SCSI disks (or emulated SCSI disks); in that case, it might be /dev/sdb or some other letter. If your drive is not detected automatically, some further steps may be required -- for instance, you might have to pass boot options to enable FireWire or PCMCIA, or you might have to manually load some kernel modules, or other things of that sort."

Comments (none posted)

Go Straight To The Source with CTrace (Linux Journal)

Linux Journal looks at CTrace. "My article details the use of an open-source multithreaded trace/debug library called CTrace. It also presents a method of remotely tracing a running application by using the SSH protocol."

Comments (none posted)

Reviews

CodeWeavers CrossOver Office 3.0 (vnunet)

Vnunet takes a look at CrossOver Office. "Available since last month, CrossOver Office 3.0 will suit Linux users needing to open or create Word documents and view web content that only displays correctly in Internet Explorer. One of the most useful features in the Professional version is the ability to build a configuration with specific Windows applications installed, and then replicate it and deploy it to other systems using Red Hat Package Manager tools."

Comments (1 posted)

Wrangle digital photos with imgSeek (NewsForge)

NewsForge reviews imgSeek, an open source photo organizer. "Back in the Bad Old Days we kept our photos crammed into shoeboxes in the closet, to be pulled out once every few years for a halfhearted attempt at assembling an album. With the onset of the digital era, that should be a thing of past, right? Yet most of us have simply replaced the shoeboxes with overcrowded folders on our PCs, and because our digital cameras tend to slap on unhelpful names like DCS00032.JPG, we still have to browse through them all manually to find the ones that are of interest to us. But one particularly good open source program, imgSeek, can help you get organized."

Comments (1 posted)

Device Profile: IntelliReach MessageScreen email filter appliance (LinuxDevices)

LinuxDevices.com looks at the MessageScreen appliance from IntelliReach. "MessageScreen is available with either SuSE Linux, or Solaris; however, according to [director of product management Jeff] Coveney, 'Linux allows throughput increases of up to 8x from a standard Solaris implementation.' Coveney adds, 'We realized early on that Linux will also give our users the lowest total cost of ownership.'"

Comments (10 posted)

KDE 3.3 Beta 1 Experiences (OSNews.com)

OSNews shares one person's experience upgrading KDE 3.2.3 to KDE 3.3 Beta 1. "When I started KDE 3.3 Beta1, I was presented with KDE's Desktop Configuration. What I liked in this wizard was that Plastik is now presented as one of the style choices (which I think is the best among the styles that come with KDE). Nice. Unfortunately, it is not the default but it should be. I also noticed that the startup speed has improved. The "aKademy" splash screen is new and looks cool! Also, everything feels more snappier and quicker. Applications seem to launch faster. If you configure to preload an instance of Konqueror at the start up time; all subsequent launches of Konqueror are lighting fast." (Found on KDE.News)

Comments (8 posted)

Why PHP 5 Rocks! (O'ReillyNet)

Here's an O'ReillyNet article on the more interesting features in PHP 5.0. "PHP 5 fixes the major problems in PHP 4's XML extensions. While PHP 4 allows you to manipulate XML, its XML tools are only superficially related. Each tool covers one part of the XML experience, but they weren't designed to work together, and PHP 4 support for the more advanced XML features is often patchy. Not so in PHP 5."

Comments (1 posted)

Open source Photoshop alternatives (NewsForge)

NewsForge looks at GIMP, SodiPodi and Inkscape. "The GIMP is great for raster graphics, but what about vector editing? That's a big part about what you have to do in Photoshop, right? The GIMP has one filter, called G-Fig, that gives you some limited vector editing capacity, but if you want to do very stylish graphics, you need a vector graphics package. In this area, the open source user turns to Sodipodi or Inkscape."

Comments (none posted)

New SGI supercomputer to scale Linux to 1,024 CPUs (Computerworld Australia)

Computerworld Australia takes a look at new supercomputer under construction at SGI. "Silicon Graphics is building an Altix supercomputer for the National Center for Supercomputing Applications (NCSA) that will run a single Linux operating system image across 1,024 Intel Itanium 2 processors and 3TB of shared memory."

Comments (1 posted)

Thinking XML: Harold's Effective XML (IBM developerWorks)

Uche Ogbuji reviews the book Effective XML by Elliotte Rusty Harold. "Noted XML expert Elliotte Rusty Harold's book Effective XML offers best practices for users of XML technologies. Much of the discussion in the book touches on issues of XML design that have also preoccupied Uche Ogbuji, and in this article he discusses the book as the thread for further observations on XML design and best practices."

Comments (none posted)

Sharp's Zaurus SL-6000L: A Free Software PDA (O'ReillyNet)

Here's an O'ReillyNet article on the Sharp Zaurus SL-6000L. "The SL6000L is a great machine. It may not look as sexy as the clamshell Zauruses, but it's very functional. I quickly discovered it was the tool for the job after carrying it with me along my Palm. It is rough, it has lot of battery life, a nice keyboard, and all sort of ports one may need. Best of all, there's wifi included and it runs Linux."

Comments (1 posted)

Miscellaneous

Toward true open source (NewsForge)

Tom Walker shares his opinion that the GPL has unintentional harmful side effects in this NewsForge article. "When I buy music protected by DRM, the seller intends is to stop me from making copies of songs. When I use software that is licensed under the GPL, the developer intends to stop me from making the software "closed," or non-free. The intentions obviously aren't even slightly similar, but the consequences are."

Comments (10 posted)

Surviving in a world full of software patents (NewsForge)

NewsForge presents an editorial on the merits of obtaining software patents. "If you are an open source developer you are probably less motivated by profit (though certainly you want to be fed), and more motivated by the hope of making the world a better place through cooperation. This is a noble position, but don't be played for a fool. The lack of a patent on your work gives free rein to people with PROFIT on their minds who want to steal your inventions from you and use them for their own gain instead of the gain of all. The next thing you know, you will be facing patents based on something that incorporates ideas that you pioneered."

Comments (9 posted)

Page editor: Forrest Cook

Announcements

Non-Commercial announcements

Firefox Marketing Project, Week 2 (MozillaZine)

MozillaZine covers week 2 of the Firefox marketing project. "As I write this, 1369 people have given Firefox a 96% approval rating, and 1220 people have rated it straight fives across the board. Firefox is now on the most popular list, above other heavyweights like MSN Messenger, AIM, and Winamp. This was an amazing launch to our 'ten weeks, ten ideas, ten million downloads' community marketing campaign."

Comments (none posted)

OSIA: We Have The Solution To Software Piracy

Australia's OSIA has sent out a press release that recommends the use of open source software to thwart the software piracy problem. "Australia's Open Source industry body OSIA calls upon governments worldwide to do more to stem the levels of software intellectual property misuse, which impacts the ICT industry globally. By emphasising alternative solutions based on open source software, governments and corporates can do much to halt the illegal copying of proprietary software."

Full Story (comments: none)

Python Software Foundation call for proposals

A PSF grant proposal has been posted. "The Python Software Foundation is seeking grant proposals for projects related to the further development of Python, Python-related technology, and educational resources. The PSF plans to issue calls for proposals regularly." Proposals should be submitted by October 1, projects start on November 1, and should be completed in one year. Thanks to A.M. Kuchling.

Comments (none posted)

Commercial announcements

Announcing CrossOver Office Server Edition, Version 3.0.1

Version 3.0.1 of CrossOver Office Server Edition has been announced. "In addition to many improvements in Windows compatibility, this release provides much better support for a wide variety of new Linux distributions, including modern RedHat and Fedora versions."

Full Story (comments: none)

Lindows announces PhoneGaim

Lindows, Inc. has announced its new PhoneGaim application. "PhoneGaim, a software program that combines phone and voice with Instant Messaging. With PhoneGaim, Linux computer users have the option to dial and receive phone calls directly from their PC to any phone, SIPphone or PhoneGaim user."

Comments (none posted)

Microsoft and Lindows Settle Trademark Case

Microsoft and Lindows have announced a settlement in all the trademark infringement cases between the two companies. The press release reports that the settlement terms are confidential, however News.com reports that Microsoft will pay Lindows a $20 million settlement fee. "In exchange for the payment, Lindows--which recently renamed most of its products "Linspire" to work around European trademark suits--will give up the Lindows name and assign related Web domains to Microsoft, according to the registration statement Lindows filed with the Securities and Exchange Commission."

Comments (6 posted)

European Weather Forecast Center Installs Linux Networx Cluster System

Linux Networx has announced that the European Centre for Medium-Range Weather Forecasts (ECMWF) has installed an Evolocity II Linux Networx cluster computing system. The system will be used to evaluate the suitability of cluster technology for broader deployment within ECMWF's high performance production environment.

Comments (none posted)

Net Integration Technologies and Ingram Micro form Alliance

Net Integration Technologies and Ingram Micro have announced an alliance. "Net Integration Technologies Inc. (NITI), an award-winning software developer, today announced an exclusive North American distribution agreement with Ingram Micro Inc. (NYSE:IM), the world's largest technology distributor, for its Nitix(TM)-powered server solutions."

Comments (none posted)

ObjectsSearch Web APIs announced

ObjectsSearch.com has announced its new Web APIs service. "With the ObjectsSearch Web APIs service, software developers can query ObjectsSearch index from their own computer programs. ObjectsSearch uses the SOAP and WSDL standards so a developer can program in his or her favorite environment - such as Java, Perl, or Visual Studio .NET."

Full Story (comments: none)

64-bit Applications Infrastructure Continues to Build Using Latest Release of PGI Compilers and Tools

The Portland Group has announced the general availability of version 5.2 of PGI Workstation, a suite of Fortran, C, and C++ compilers and development tools for scientists and engineers. The PGI compilers and tools are used on Linux workstations, servers, and clusters based on AMD64 and IA32 processors to build high-performance computing (HPC) applications for complex modeling and simulations in automotive crash testing, structural analysis, weather forecasting, geophysical processing, aerodynamic simulation, computational chemistry, and related fields.

Comments (1 posted)

Sleepycat pushes into telecom market

Sleepycat Software and MontaVista Software Inc. have announced their collaboration to deliver and support a fault-tolerant and highly scalable platform for developers of carrier-class telecommunications and networking applications. The platform combines MontaVista Linux Carrier Grade Edition with Sleepycat's Berkeley DB High Availability database.

Full Story (comments: none)

New Books

Dive Into Python on paper

A paper version of Mark Pilgrim's Dive Into Python is now available.

Comments (none posted)

Signate Announces Publication of First Comprehensive Guide to Asterisk Open Source PBX Software

Signate has announced the publication of VoIP Telephony with Asterisk, by Paul Mahler. VoIP Telephony with Asterisk is the first comprehensive guide to the open source Linux PBX software.

Comments (none posted)

Resources

The LDP Weekly News

A double issue of the LDP Weekly News is available with more than the usual amount of new documentation.

Full Story (comments: none)

Event Reports

Summary of the LSM Free Software Printing Summit

Roger Leigh has put together a summary of the Free Software Printing Summit that was held at the Rencontres Mondiales du Logiciel Libre (Libre Software Meeting) in Bordeaux, France.

Full Story (comments: none)

Upcoming Events

Gnome Documentation Day

The first Gnome Documentation Day will be held on Sunday, July 24. "Here's how you can help: Show up on #docs on GIMPNet (irc.gnome.org) on Sunday. Bring a fresh copy of emacs (or your text editor of choice), and prepare to be greeted shamelessly by one of our fearless community leaders. If you want to write, we can give you something to write. If you want to review, we can give you something to review. If you want to hack (oh please!), we can give you something to hack."

Full Story (comments: none)

Linux event: Picn*x13

The 4th annual Linux Anniversary Picnic & Barbecue ("Picn*x13") will be held on August 7, 2004 at the Sunnyvale Baylands Park in Sunnyvale, California. "All members of the Linux community are invited and encouraged to bring their friends and family. Picn*x13 is organized as a family event, so pack the kids in the minivan and head on over."

Full Story (comments: none)

LinuxPro 2004 Conference

The LinuxPro 2004 conference will be held in Warsaw, Poland on November 29 and 30, 2004. "LinuxPro - is the biggest meeting of Polish users and creators of Linux solutions, it is also an overview of applications of Linux environment and software which is dedicated to it as a basis of building efficient, stable and safe professional solutions."

Full Story (comments: none)

pd~convention04 - call for works

A call for works has gone out for the pd~convention04. The event will take place in Graz, Austria on September 27 - October 3, 2004. Proposals and material are due before August 31.

Full Story (comments: none)

Pre-register for ESC Boston

Pre-registration is now open for the Boston Embedded Systems Conference. The event takes place on September 13-16, 2004.

Full Story (comments: none)

YAPC::NA::2005 Call For Venues (use Perl)

A call for venues has gone out for the 2005 YAPC::NA conference. Proposals are due by August 31.

Comments (none posted)

Events: July 22 - September 16, 2004

Date	Event	Location
July 22 - 24, 2004	Linux Symposium	Ottawa, Canada
July 26 - 30, 2004	O'Reilly Open Source Software Convention 2004(OSCON)	Portland, OR
July 26 - 30, 2004	IBM pSeries Technical Conference	Cairns, Australia
July 31 - August 2, 2004	Vancouver Python Workshop	Vancouver, Canada
August 2 - 5, 2004	LinuxWorld Conference & Expo	(Moscone Center)San Francisco, California
August 5 - 8, 2004	UKUUG 2004 Linux Technical Conference	Leeds, England
August 21 - 29, 2004	KDE Community World Summit 2004(aKademy)	(Filmakademie Ludwigsburg)Ludwigsburg (Stuttgart Region), Germany
September 2 - 3, 2004	Python for Scientific Computing(SciPy)	(CalTech)Pasadena, CA
September 2 - 4, 2004	2nd Swiss Unix Conference	(Technopark)Zurich, Switzerland
September 9 - 10, 2004	Linux Expo Shanghai	(Shanghai Exhibition Center)Shanghai, China
September 13 - 16, 2004	Embedded Systems Conference	(Hynes Convention Center)Boston, MA
September 15 - 17, 2004	YAPC::Europe 2004	Belfast, Northern Ireland

Comments (none posted)

Mailing Lists

"Internetworking" by netwosix.org

Linux Netwosix has announced a new mailing list for the discussion of networking, security and Linux. The internetworking list aims to be a resource for those who wish to learn or share their knowledge about the world of the Linux Networking.

Full Story (comments: none)

Software announcements

This week's software announcements

Here are the software announcements, courtesy of Freshmeat.net. They are available in two formats:

• Sorted alphabetically,
• Sorted by license.

Comments (none posted)

Page editor: Forrest Cook