LWN.net Weekly Edition for August 5, 2004

LSB 2.0 and C++

The Linux Standard Base is a standardization effort aimed at making Linux friendly for application vendors. By nailing down issues like which libraries should be available, how packages are to be managed, where files should reside, etc., the LSB seeks to create a standard environment which will be present on every compliant distribution. Application vendors can then build their offerings for that environment and, with luck, have them run everywhere.

A major release of the LSB (version 2.0) is in the final stages. The most recent plan had been to release this version at LinuxWorld, but, for reasons we are about to get into, that release may be delayed a bit. Version 2.0 adds a number of things; included therein is a description of the environment which should be available for C++ applications. A great many commercial programs are written in C++, so, for many vendors, the LSB is of little use until it covers that language. So the C++ description is a high-priority part of the LSB 2.0 release.

The standardization of the C++ environment has run into some opposition, however, as seen by this posting to the gcc list and the subsequent discussion. Many people, including a number of gcc developers, are unhappy with the choices that have been made for the LSB 2.0, and are pushing for changes.

The core of the problem is that the LSB specifies that compliant systems must offer a modified version of the "v5 ABI." This is the binary interface used by gcc 3.3; current versions of gcc 3.3, however, are not compliant with the specification. Patches exist toward a future 3.3.5 release which will bring it into compliance; this release will probably happen, though no promises to the effect have been made.

The real problem, however, is that gcc 3.3 is already old technology, and is considered to be a dead end. Current development efforts are going into gcc 3.4 and even 3.5; gcc 3.4 can already be found on some systems (such as your editor's Fedora Rawhide box). gcc 3.4 is widely held to be a superior release; it has much improved performance, better interoperability with other C++ compilers, and better standards support. It also has a different and incompatible binary interface, of course. Since the C++ environment is only now being nailed down by the LSB, it is asked, why not go with the newer, v6 ABI, which will actually be relevant into the future?

The reasons appear to come down to the following:

• The LSB is explicitly mandated to focus on existing, deployed technology. At this time, none of the mainstream distributions are shipping with the v6 ABI. Standardizing on that ABI would violate the LSB requirements, and so will not be done.

• The 2.0 release has already been delayed; making a major change to the C++ ABI specification would add another, long delay.

• The LSB 2.0 specification is planned to be submitted to the ISO/PAS process. ISO certification would help vendors trying to sell Linux solutions into a number of governmental and corporate environments. That submission must happen by October, however, or the application process must be restarted from the beginning.

• The v5 ABI is what (most) distributors are shipping now; standardizing on that ABI will make it easier for existing distributions to be brought into compliance.

Opponents argue that the version of the v5 ABI documented in the LSB has never been distributed either - though, in all fairness, the required changes appear to be small. The stronger complaints seem to be that the LSB has made its choices based on the short-term needs of commercial Linux distributors, to the detriment of what the community wants. Of course, determining what the community wants can be problematic, especially since Richard Stallman has prohibited the gcc steering committee from cooperating with the LSB process.

The truth of the matter is that the Linux Standard Base is in a bit of a bind. There is pressure from vendors to create a C++ standard in the near future, the LSB 2.0 process has already taken longer than expected, and, from the LSB's point of view, the v6 ABI has not yet reached a level of deployment or stability that would allow it to be used as the basis for a specification. The gcc C++ ABI remains a moving target, so any attempt to write a standard based on it is bound to encounter difficulties. The only option available at this time, assuming that the C++ section is not to be dropped altogether, is to go with the v5 ABI.

We talked briefly with Stuart Anderson, the lead developer for the LSB written specification. His belief is that the LSB 2.0 release will go forward essentially unchanged, though perhaps with an added statement regarding the C++ ABI and the fact that it will change in the future. The v6 ABI will then be incorporated into the LSB 3.0 release, which is currently planned for about one year from now. It is possible, however, that the C++ section will be dropped from the version of the specification submitted to the ISO.

Standards are a tricky subject in the free software world; they promote interoperability, but also freeze development in a community that values its ability to make changes and move forward. Occasionally a standard catches a development project at the wrong time; that appears to have happened with the C++ specification. As a result, some people are upset now. In a year or two, however, when the gcc C++ ABI has settled down and found its way into future LSB releases, few people will remember this episode.

Comments (34 posted)

Bash 3.0 released

GNU Bash has been in the low 2.0x series for some time, so the version jump to 3.0 last week was something of a surprise, at least to those who haven't been following Bash development closely. Since Bash is a core piece of infrastructure for most of the Linux community, we decided to take a look at the 3.0 release and find out what changed, and what users could expect from the new release.

To that end, we touched base with Bash maintainer Chet Ramey, who was kind enough to reply to our questions about the latest release. The first question on our mind, of course, was "why the version bump?"

Indeed, there are quite a few changes in this release. A look at the CHANGES file or the NEWS with the release source shows a slew of bugfixes and changes to Bash and Readline.

One interesting new addition to Bash 3.0 is new type of brace expansion. The syntax for the new brace expansion is {x..y} where x and y can be an integer or a single character in ascending or descending order. For example, the set {z..a} would match all of the letters from z to a in descending order. (z,y,x, etc.) The set {1..1000} would match the each of the integers from 1 to 1000.

Another new feature of interest is the addition of history timestamps. This allows users to see when commands were run, which can provide some useful and interesting information.

There are several new options with Bash 3.0. The "failglob" option will probably be of interest to many users. When set, this option will cause an error when a glob expression fails to match any files -- as opposed to running the command anyway. The new "pipefail" option tells Bash to return a failure status if any command in a "pipeline" fails, as opposed to the default behavior of returning the status of the last job in a pipeline.

Of course, one might wonder if all of the improvements and changes in the release will affect existing shell scripts. Many Bash users have a number of shell scripts that are vital to our day to day work, this writer included, and aren't eager to see them break on a new version of Bash. According to the release notes, there are some incompatibilities between 3.0 and Bash version 1.14, but no mention of 2.0x versions. According to Ramey:

This writer has tried a number of shell scripts against the Bash 3.0 release, and didn't find any incompatibilities or issues. In fact, a (permanent) switch to a Bash 3.0 login shell may be in my very near future.

We also asked Ramey what, if any, features were planned for future versions of Bash. Ramey said that there were already plans for future releases

Interested users who don't want to wait for Bash to ship with their favorite distribution can find the source on Ramey's Bash page, or the GNU mirrors.

Comments (13 posted)

OSRM's patent study

Open Source Risk Management has been in the limelight for a while as a result of its Linux insurance policies. This group has, just in time for LinuxWorld, issued a press release on software patents and the Linux kernel. The PR describes a survey performed by Dan Ravicher; it contains both good and bad news. The good news is that Mr. Ravicher performed a study of all U.S. software patents which had actually been litigated, and concluded that the Linux kernel infringes none of them. On the other hand, 283 patents were found which have not seen a day in court, but which could, perhaps, be used to make claims against Linux.

It will, doubtless, come as a great surprise that OSRM is now gearing up to sell insurance policies to Linux users who fear patent infringement suits. A mere $150,000 per year buys $5 million in coverage.

There are certainly good things to be said about what OSRM is doing. Insurance against patent suits may give some large users the confidence they need to go forward with Linux development and deployment. The insurance pool could be used to aggressively challenge the validity of patents which are brought to bear against Linux - if the insurers choose to take that approach. The invalidation of a couple of patents could be a powerful deterrent for any other litigious patent holder who has thoughts of going up against the Linux community.

A white paper (PDF format) published by OSRM suggests that invalidation of patents is not the only, or even first approach that OSRM will take. An alternative which is discussed there is obtaining a license for the patent which applies to GPL-licensed software. This license might even be purchased:

The interesting fact here, of course, is that the GPL would make it very hard for OSRM to solve a patent problem only for its policy holders. If patent holders decide to target those users who are insured by OSRM (because that's where the money is), the entire community could benefit from the settlements. But OSRM could find itself in a situation where everybody waits for somebody else to buy the insurance and be the target.

The OSRM white paper also talks about rewriting code to sidestep patent suits. But, says OSRM:

One can only hope that they think very carefully before going out and issuing "recommendations" to the kernel development community.

OSRM describes itself as "vendor-neutral" more than once in its PR. But that is not entirely true: OSRM is a vendor of insurance products that, by some strange coincidence, address just the threat that the PR describes. Just to be sure you don't miss the point, the PR also discusses the multi-million dollar cost of defending a patent suit in court. This work may not be FUD in the normal sense, but it cannot be denied that OSRM's press release does seek to inspire a certain amount of fear, uncertainty, and doubt in Linux users.

OSRM is not without a potential conflict of interest here. A long list of scary patents can only help to sell OSRM's products, so its researchers have every incentive to be as inclusive as possible. The list itself is not directly available to the public. Interested parties can apparently get it, but only after being warned about exposure for triple damages for "willful" infringement. That is a risk that many will choose to avoid, so most of us will have to trust Mr. Ravicher when he says 283 problematic patents exist. Then again, many people see that number as implausibly small, given the large number of bogus software patents in the U.S.

The PR claims that "OSRM is active in promoting systematic patent policy reforms to address the issue at its roots, patent policies themselves," but is not particularly forthcoming on what form that activity takes. So we asked:

Here is another statement from the PR:

Who wouldn't like to become part of the "everyday cost of doing business" with Linux? OSRM only stands a chance of collecting its piece of that "everyday cost" as long as Linux users and developers see patent suits as a threat. That should be kept in mind when pondering the company's motivations and actions. The community is little served by headlines throughout the mainstream media that Linux violates almost 300 patents, but an insurance business may well benefit.

So is OSRM guilty of spreading FUD? They say not:

OSRM also pointed out to us that it can only be successful as long as free software is successful. Since fewer users means fewer customers for OSRM, the company has no interest in scaring people away. People in the free software community have been warning about patent threats for years; all OSRM has done is to try to quantify the risk.

It is worth noting that OSRM's patent insurance will be restricted to the kernel. The kernel, however, is a very small part of any deployed Linux system, and litigious software patent holders will certainly not restrict themselves to that one piece. Purchasers of OSRM's patent insurance will not have decreased their exposure by much.

And that exposure does exist. There is no doubt that Linux will be the target of a high-profile patent suit sooner or later. We (and many, many others) have been saying that for a very long time, to the point that many people may not believe it anymore. The SCO case has shown the world just how strongly the community will fight back when it is attacked, and how good the community is at digging up interesting history - such as prior art. The prospect of going up against the community may well deter a number of casual patent shakedowns. Even so, somebody will eventually give in to the perceived promise of easy money (or, perhaps, the salvation of a failing business) and go on the attack. It is just a matter of time.

Anything we can do to prepare ourselves for that day is good. Insurance policies are almost certainly a useful part of that preparation, and it is good that companies like OSRM are stepping up to provide those policies. But we should not forget that OSRM's interests are not precisely aligned with those of the community; if software patents went away, so would that part of OSRM's insurance business. A company like OSRM must walk a fine line; let us hope that they continue to stay on it.

Comments (12 posted)

A patent obstacle in Germany

Readers who made it all the way through the OSRM article may be wondering: what harm can a list of potential patent problems do, anyway? Consider this: in Munich, the Green Party, which is a steadfast opponent of software patents, compiled a list of patents which could be infringed by the city's future Linux-based IT system, should software patents be enacted in Europe. That list is available as a German-language PDF file. The intent was clearly to spread awareness of the potential consequences of software patents in Europe.

The tactic may have worked a little too well: the first request for bids in the Munich project has been put on hold while the city examines its legal risks. At this time, Munich apparently remains committed to the change, but the process will be slowed down while the lawyers do their thing. The European Union has not, yet, adopted software patents, but software patents are already complicating life anyway.

Given events in much of the rest of the world, Europe is about all that stands in the way of a worldwide software patent regime. If software patents can be stopped there, there may be a chance of, someday, reforming the system elsewhere. If Europe falls, the job gets harder for everybody. So the upcoming, presumably final battle over the EU patent directive is critically important. There are signs that European governments are beginning to understand the problem. If making the issue clearer requires a delay in a high-profile municipal Linux deployment, it may turn out to be a price well paid.

Comments (4 posted)

Page editor: Jonathan Corbet

Security

What happened to the other 8%

As reported last week, Evans Data recently announced the results of a survey which indicated (among other things) that 92% of their respondents have never suffered a virus infection on their Linux systems. The mainstream press made a big deal out of this result, but, to most Linux users, the interesting result was the 8%. Linux systems can have security problems, but virus problems, in particular, are almost unheard of. An 8% infection rate seemed too high.

We dropped the folks at Evans Data a note asking for some more information. The result came back from none other than Nick Petreley, who is now the "Linux analyst" for Evans. He says:

In other words, they don't really know either. The survey was performed over the web (a private page accessible by invitation only) and didn't really provide for detailed answers.

Comments (4 posted)

Fun with RFID tags

The various privacy implications of widespread use of radio-frequency identification tags have been widely discussed. This eWeek article, reporting on a Black Hat Briefings session, brings up a new issue. It seems that the portion of most RFID tags which holds the product code is rewritable. Anybody who can haul a suitably equipped system into a store can rewrite the tags at will, creating no end of opportunities for confusion and theft.

According to the article, things go even further than that:

That scenario seems unlikely; the capacity of an RFID tag, and the uses to which the tags are put, do not afford many opportunities for the injection of shell code into point-of-sale systems. But, then, somebody might just pull it off.

The real security risk is the number of systems which will be programmed to believe what their RFID readers are telling them. It is surprising that a device meant to be used as an identification token is rewritable in this way. It should not take too long before troublemakers with RFID writers convince the retail establishment that this was a bad decision.

Comments (2 posted)

Surge in Scans Seeking SSL Servers (Netcraft)

Netcraft reports that Internet scanning for servers running Secure Sockets Layer (SSL) has spiked in the past week. "Security firms are advising network administrators to install security patches for SSL servers, including a recent update for mod_ssl, which is widely used in Apache servers running OpenSSL. A security update was released July 16 to fix the vulnerability, which may allow a remote attacker to execute arbitrary code when Apache is configured to use mod_ssl and mod_proxy, according to an advisory from Gentoo Linux."

Comments (2 posted)

New vulnerabilities

gnome-vfs: backend script vulnerabilities

Package(s):	gnome-vfs	CVE #(s):	CAN-2004-0494
Created:	August 4, 2004	Updated:	February 21, 2005
Description:	Several scripts packaged with gnome-vfs, using its "extfs" capability, have security flaws. These scripts tend not to be used on many systems, but their presence can still be a threat.
Alerts:	Fedora-Legacy FLSA:1944 2005-02-20 Whitebox WBSA-2004:373-01 2004-08-19 Red Hat RHSA-2004:373-01 2004-08-04

Comments (none posted)

kernel information leak

Package(s):	kernel	CVE #(s):	CAN-2004-0415
Created:	August 3, 2004	Updated:	October 26, 2004
Description:	Paul Starzetz discovered flaws in the Linux kernel when handling file offset pointers. These consist of invalid conversions of 64 to 32-bit file offset pointers and possible race conditions. A local unprivileged user could make use of these flaws to access large portions of kernel memory. Note that this vulnerability affects all 2.4 kernels through 2.4.26 and 2.6 kernels through 2.6.7. A fix for this problem was added to the fifth 2.4.27 release candidate.
Alerts:	Conectiva CLA-2004:879 2004-10-26 Fedora-Legacy FLSA:1804 2004-10-18 Mandrake MDKSA-2004:087 2004-08-26 Gentoo 200408-24 2004-08-25 Whitebox WBSA-2004:413-01 2004-08-19 Red Hat RHSA-2004:327-01 2004-08-18 Fedora FEDORA-2004-251 2004-08-10 Trustix TSLSA-2004-0041 2004-08-09 SuSE SUSE-SA:2004:024 2004-08-09 Red Hat RHSA-2004:413-01 2004-08-03 Red Hat RHSA-2004:418-01 2004-08-03 Fedora FEDORA-2004-247 2004-08-03

Comments (none posted)

libpng: multiple vulnerabilities

Package(s):	libpng	CVE #(s):	CAN-2002-1363 CAN-2004-0597 CAN-2004-0598 CAN-2004-0599
Created:	August 4, 2004	Updated:	February 10, 2005
Description:	There is yet another set of holes in libpng, versions 1.2.5 and prior, which can be exploited by a malicious image file; see this advisory from Chris Evans or this CERT advisory for details.
Alerts:	Fedora-Legacy FLSA:1943 2005-02-08 Red Hat RHSA-2004:421-01 2004-08-04 Gentoo 200408-22 2004-08-23 Whitebox WBSA-2004:402-01 2004-08-19 Mandrake MDKSA-2004:082 2004-08-12 Slackware SSA:2004-223-01 2004-08-09 Slackware SSA:2004-223-02 2004-08-07 Slackware SSA:2004-222-01b 2004-08-10 Slackware SSA:2004-222-01 2004-08-07 Conectiva CLA-2004:856 2004-08-06 Trustix TSLSA-2004-0040 2004-08-05 Gentoo 200408-03 2004-08-05 Debian DSA-536-1 2004-08-04 Mandrake MDKSA-2004:079 2004-08-04 SuSE SUSE-SA:2004:023 2004-08-04 Red Hat RHSA-2004:402-01 2004-08-04 OpenPKG OpenPKG-SA-2004.035 2004-08-04

Comments (1 posted)

phpMyAdmin: remote PHP execution

Package(s):	phpmyadmin	CVE #(s):
Created:	July 29, 2004	Updated:	August 4, 2004
Description:	phpMyAdmin has a vulnerability that allows a remote attacker to modify variables and execute PHP code. The attacker must have a valid user account.
Alerts:	Gentoo 200407-22 2004-07-29

Comments (none posted)

MPlayer: GUI filename handling overflow

Package(s):	mplayer	CVE #(s):
Created:	August 2, 2004	Updated:	August 4, 2004
Description:	The MPlayer GUI code contains several buffer overflow vulnerabilities, and at least one in the TranslateFilename() function is exploitable. By enticing a user to play a file with a carefully crafted filename an attacker could execute arbitrary code with the permissions of the user running MPlayer.
Alerts:	Gentoo 200408-01 2004-08-01

Comments (none posted)

Updated vulnerabilities

Apache mod_proxy: denial of service

Package(s):	apache	CVE #(s):	CAN-2004-0492
Created:	June 11, 2004	Updated:	October 14, 2004
Description:	A buffer overflow vulnerability in the apache mod_proxy module can be exploited to create a denial of service.
Alerts:	Fedora-Legacy FLSA:1737 2004-10-13 Mandrake MDKSA-2004:065 2004-06-29 Debian DSA-525-1 2004-06-24 Gentoo 200406-16 2004-06-21 OpenPKG OpenPKG-SA-2004.029 2004-06-11

Comments (none posted)

apache2: stack-based buffer overflow in ssl_util.c

Package(s):	apache2	CVE #(s):	CAN-2004-0488
Created:	June 1, 2004	Updated:	October 14, 2004
Description:	A stack-based buffer overflow exists in the ssl_util_uuencode_binary function in ssl_util.c in Apache. When mod_ssl is configured to trust the issuing CA, a remote attacker may be able to execute arbitrary code via a client certificate with a long subject DN.
Alerts:	Fedora-Legacy FLSA:1888 2004-10-13 Debian DSA-532-2 2004-07-27 Debian DSA-532-1 2004-07-22 Red Hat RHSA-2004:245-01 2004-06-14 Gentoo 200406-05 2004-06-09 Slackware SSA:2004-154-01 2004-06-02 OpenPKG OpenPKG-SA-2004.026 2004-05-27 Trustix TSLSA-2004-0031 2004-06-02 Mandrake MDKSA-2004:054 2004-06-01 Mandrake MDKSA-2004:055 2004-06-01

Comments (none posted)

apache mod_ssl format string vulnerability

Package(s):	apache mod_ssl	CVE #(s):
Created:	July 16, 2004	Updated:	August 6, 2004
Description:	Triggered by a report to Packet Storm from Virulent, a format string vulnerability was found in mod_ssl, the Apache SSL/TLS interface to OpenSSL, version (up to and including) 2.8.18 for Apache 1.3. The mod_ssl in Apache 2.x is not affected. The vulnerability could be exploitable if Apache is used as a proxy for HTTPS URLs and the attacker established a own specially prepared DNS and origin server environment.
Alerts:	Conectiva CLA-2004:857 2004-08-06 Mandrake MDKSA-2004:075 2004-07-27 Slackware SSA:2004-207-02 2004-07-25 Gentoo 200407-18 2004-07-22 OpenPKG OpenPKG-SA-2004.032 2004-07-16

Comments (none posted)

aspell: bounds checking problem

Package(s):	aspell	CVE #(s):	CAN-2004-0548
Created:	June 17, 2004	Updated:	December 20, 2004
Description:	Aspell's word-list-compress utility fails to properly check bounds when dealing with words that are more than 256 bytes long. This can lead to arbitrary code execution by an attacker.
Alerts:	Mandrake MDKSA-2004:153 2004-12-20 OpenPKG OpenPKG-SA-2004.042 2004-09-15 Gentoo 200406-14 2004-06-17

Comments (none posted)

courier: cross-site scripting vulnerability

Package(s):	courier	CVE #(s):	CAN-2004-0591
Created:	July 23, 2004	Updated:	August 4, 2004
Description:	The sqwebmail application has a cross-site scripting vulnerability. An attacker can inject and execute a web mail script via an email message.
Alerts:	Gentoo 200408-02 2004-08-04 Debian DSA-533-1 2004-07-22

Comments (none posted)

Ethereal: Multiple security problems

Package(s):	ethereal	CVE #(s):	CAN-2004-0633 CAN-2004-0634 CAN-2004-0635
Created:	July 9, 2004	Updated:	August 19, 2004
Description:	There are multiple vulnerabilities in versions of Ethereal earlier than 0.10.5, including: * In some cases the iSNS dissector could cause Ethereal to abort. * If there was no policy name for a handle for SMB SID snooping it could cause a crash. * A malformed or missing community string could cause the SNMP dissector to crash. See this advisory for more information.
Alerts:	Whitebox WBSA-2004:378-01 2004-08-19 Red Hat RHSA-2004:378-01 2004-08-05 Netwosix NW-2004-0016 2004-07-23 Fedora FEDORA-2004-234 2004-07-22 Debian DSA-528-1 2004-07-17 Fedora FEDORA-2004-220 2004-07-14 Fedora FEDORA-2004-219 2004-07-14 Mandrake MDKSA-2004:067 2004-07-09 Gentoo 200407-08 2004-07-09

Comments (none posted)

Filename disclosure vulnerability in fam

Package(s):	fam	CVE #(s):	CAN-2002-0875
Created:	August 19, 2002	Updated:	January 5, 2005
Description:	"fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible.
Alerts:	Red Hat RHSA-2005:005-01 2005-01-05 Debian DSA-154-1 2002-08-15

Comments (none posted)

flim: insecure file creation

Package(s):	flim	CVE #(s):	CAN-2004-0422
Created:	May 5, 2004	Updated:	December 16, 2004
Description:	The emacs "flim" mode creates temporary files in an insecure fashion, possibly allowing a local attacker to overwrite files.
Alerts:	Fedora FEDORA-2004-546 2004-12-15 Red Hat RHSA-2004:344-01 2004-08-18 Debian DSA-500-1 2004-05-01

Comments (none posted)

gtkhtml: malformed messages cause crash

Package(s):	gtkhtml	CVE #(s):	CAN-2003-0133 CAN-2003-0541
Created:	April 14, 2003	Updated:	April 18, 2005
Description:	GtkHTML is the HTML rendering widget used by the Evolution mail reader. GtkHTML supplied with versions of Evolution prior to 1.2.4 contain a bug when handling HTML messages. Alan Cox discovered that certain malformed messages could cause the Evolution mail component to crash.
Alerts:	Debian DSA-710-1 2005-04-18 Mandrake MDKSA-2003:093 2003-09-18 Conectiva CLA-2003:737 2003-09-12 Red Hat RHSA-2003:264-01 2003-09-09 Mandrake MDKSA-2003:046 2003-04-15 Red Hat RHSA-2003:126-01 2003-04-14

Comments (none posted)

Horde-IMP: improper input validation

Package(s):	Horde-IMP	CVE #(s):
Created:	June 16, 2004	Updated:	August 10, 2004
Description:	An input validation error exists in Horde-IMP through version 3.2.4; a specially crafted message could be used to run scripts in the context of the target's browser.
Alerts:	Gentoo 200408-07 2004-08-10 Gentoo 200406-11 2004-06-16

Comments (none posted)

iproute: local denial of service

Package(s):	iproute net-tools	CVE #(s):	CAN-2003-0856
Created:	November 25, 2003	Updated:	December 14, 2004
Description:	The iproute utility is susceptible to spoofed netlink messages sent by local users, with the result that denial of service attacks are possible.
Alerts:	Mandrake MDKSA-2004:148 2004-12-13 Fedora FEDORA-2004-154 2004-06-03 Fedora FEDORA-2004-115 2004-05-11 Debian DSA-492-1 2004-04-18 Gentoo 200404-10 2004-04-09 Red Hat RHSA-2003:316-01 2003-11-24

Comments (none posted)

racoon: failure to verify signatures

Package(s):	ipsec-tools racoon	CVE #(s):	CAN-2004-0155
Created:	April 7, 2004	Updated:	August 19, 2004
Description:	Versions of ipsec-tools prior to 0.2.5 contain a vulnerability wherein the racoon utility fails to verify digital signatures on some packets. This hole can lead to unauthorized connections or man-in-the-middle attacks. See this advisory for details.
Alerts:	Whitebox WBSA-2004:308-01 2004-08-19 Mandrake MDKSA-2004:027 2004-04-08 Gentoo 200404-05 2004-04-07

Comments (none posted)

racoon: denial of service vulnerability

Package(s):	ipsec-tools racoon iputils	CVE #(s):	CAN-2004-0403
Created:	April 26, 2004	Updated:	July 29, 2004
Description:	racoon does not check the length of ISAKMP headers. Attackers may be able to craft an ISAKMP header of sufficient length to consume all available system resources, causing a Denial of Service. This advisory contains additional details.
Alerts:	Red Hat RHSA-2004:308-01 2004-07-29 Mandrake MDKSA-2004:069 2004-07-14 Fedora FEDORA-2004-197 2004-06-28 Whitebox WBSA-2004:165-01 2004-06-10 Fedora FEDORA-2004-132 2004-05-19 Red Hat RHSA-2004:165-01 2004-05-11 Gentoo 200404-17 2004-04-24

Comments (none posted)

kdelibs: cookie disclosure

Package(s):	kdelibs	CVE #(s):	CAN-2003-0592
Created:	March 10, 2004	Updated:	August 24, 2004
Description:	kdelibs (and, thus, Konqueror) has a vulnerability where a hostile server can force the disclosure of cookies that should not be presented to it. KDE versions 3.1.3 and later contain a fix.
Alerts:	Gentoo 200408-23 2004-08-24 Red Hat RHSA-2004:074-01 2004-03-10 Red Hat RHSA-2004:075-01 2004-03-10 Mandrake MDKSA-2004:022 2004-03-10 Debian DSA-459-1 2004-03-10

Comments (none posted)

kernel allows unauthorized changes to the group ID

Package(s):	kernel	CVE #(s):	CAN-2004-0497
Created:	July 2, 2004	Updated:	September 27, 2004
Description:	During an audit of the Linux kernel, SUSE discovered a flaw that allowed a user to make unauthorized changes to the group ID of files in certain circumstances - such as when the files are exported via NFS.
Alerts:	Conectiva CLA-2004:869 2004-09-27 Gentoo 200407-16 2004-07-22 Whitebox WBSA-2004:360-01 2004-07-07 Mandrake MDKSA-2004:066 2004-07-06 SuSE SUSE-SA:2004:020 2004-07-02 Fedora FEDORA-2004-206 2004-07-02 Fedora FEDORA-2004-205 2004-07-02 Red Hat RHSA-2004:354-01 2004-07-02 Red Hat RHSA-2004:360-01 2004-07-02

Comments (none posted)

kernel: netfilter denial of service

Package(s):	kernel	CVE #(s):
Created:	June 30, 2004	Updated:	July 28, 2004
Description:	The netfilter code in 2.6 kernels through 2.6.7 is vulnerable to a remote denial of service attack - but only if filtering on the TCP options field has been enabled. See this advisory for details.
Alerts:	Conectiva CLA-2004:852 2004-07-28 Gentoo 200407-12 2004-07-14 Fedora FEDORA-2004-202 2004-06-30

Comments (none posted)

kernel-utils: setuid vulnerability

Package(s):	kernel-utils	CVE #(s):	CAN-2003-0019
Created:	February 7, 2003	Updated:	January 21, 2005
Description:	The kernel-utils package contains several utilities that can be used to control the kernel or machine hardware. In Red Hat Linux 8.0 this package contains user mode linux (UML) utilities. The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was incorrectly shipped setuid root. This could allow local users to control certain network interfaces, add and remove arp entries and routes, and put interfaces in and out of promiscuous mode. All users of the kernel-utils package should update to these packages that contain a version of uml_net that is not setuid root. Alternatively, as a work-around to this vulnerability issue the following command as root: chmod -s /usr/bin/uml_net
Alerts:	Red Hat RHSA-2003:056-08 2003-02-07

Comments (none posted)

libxml2 - arbitrary code execution

Package(s):	libxml2	CVE #(s):	CAN-2004-0110
Created:	February 26, 2004	Updated:	August 19, 2009
Description:	Yuuichi Teranishi discovered a flaw in libxml2 versions prior to 2.6.6. When fetching a remote resource via FTP or HTTP, libxml2 uses special parsing routines. These routines can overflow a buffer if passed a very long URL. If an attacker is able to find an application using libxml2 that parses remote resources and allows them to influence the URL, then this flaw could be used to execute arbitrary code.
Alerts:	Fedora FEDORA-2009-8594 2009-08-15 Fedora FEDORA-2009-8582 2009-08-15 Fedora-Legacy FLSA:1324 2004-07-19 Conectiva CLA-2004:836 2004-03-31 Gentoo 200403-01 2004-03-06 Trustix TSLSA-2004-0010 2004-03-05 OpenPKG OpenPKG-SA-2004.003 2004-03-05 Netwosix NW-2004-0004 2004-03-04 Debian DSA-455-1 2004-03-03 Mandrake MDKSA-2004:018 2004-03-03 Red Hat RHSA-2004:091-02 2004-03-03 Whitebox WBSA-2004:090-01 2004-03-01 Red Hat RHSA-2004:090-01 2004-02-26 Fedora FEDORA-2004-087 2004-02-25 Red Hat RHSA-2004:091-01 2004-02-26

Comments (none posted)

logcheck: symlink vulnerability

Package(s):	logcheck	CVE #(s):	CAN-2004-0404
Created:	April 21, 2004	Updated:	December 22, 2004
Description:	The logcheck utility handles temporary files in an unsafe way, possibly allowing local attackers to overwrite files.
Alerts:	Mandrake MDKSA-2004:155 2004-12-22 Debian DSA-488-1 2004-04-16

Comments (none posted)

mailreader: directory traversal vulnerability

Package(s):	mailreader	CVE #(s):	CAN-2002-1581
Created:	July 23, 2004	Updated:	July 28, 2004
Description:	Mailreader has a directory traversal vulnerability. A remote attacker can view arbitrary files with the privileges of the nph-mr.cgi process.
Alerts:	Debian DSA-534-1 2004-07-22

Comments (none posted)

mikmod: buffer overflow

Package(s):	mikmod	CVE #(s):	CAN-2003-0427
Created:	June 16, 2003	Updated:	June 16, 2005
Description:	Ingo Saitz discovered a bug in mikmod whereby a long filename inside an archive file can overflow a buffer when the archive is being read by mikmod.
Alerts:	Fedora FEDORA-2005-405 2005-06-16 Red Hat RHSA-2005:506-01 2005-06-13 Fedora FEDORA-2005-404 2005-06-09 Gentoo 200307-01 2003-07-02 Debian DSA-320-1 2003-06-13

Comments (none posted)

mod_python: denial of service vulnerability

Package(s):	mod_python	CVE #(s):	CAN-2003-0973
Created:	January 27, 2004	Updated:	October 4, 2004
Description:	Apache's mod_python module could crash the httpd process if a specific, malformed query string was sent. The Apache Foundation has reported that mod_python may be prone to Denial of Service attacks when handling a malformed query. Mod_python 2.7.9 was released to fix the vulnerability, however, because the vulnerability has not been fully fixed, version 2.7.10 has been released. Users of mod_python 3.0.4 are not affected by this vulnerability.
Alerts:	Fedora-Legacy FLSA:1325 2004-10-03 Conectiva CLA-2004:837 2004-04-12 Whitebox WBSA-2004:058-01 2004-03-01 Debian DSA-452-1 2004-02-29 Red Hat RHSA-2004:058-01 2004-02-26 Red Hat RHSA-2004:063-01 2004-02-26 Gentoo 200401-03 2004-01-27

Comments (none posted)

MoinMoin Group ACL Bypass

Package(s):	moinmoin	CVE #(s):
Created:	July 12, 2004	Updated:	August 26, 2004
Description:	MoinMoin contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is triggered when an attacker creates a user with the same name as an administrative group. This flaw may lead to a loss of integrity. See this osvdb entry for additional information.
Alerts:	Gentoo 200407-09 2004-07-11

Comments (none posted)

mozilla: multiple vulnerabilties

Package(s):	mozilla	CVE #(s):	CAN-2003-0594 CAN-2003-0564
Created:	March 10, 2004	Updated:	August 19, 2004
Description:	Mozilla 1.4 contains a few vulnerabilities, including disclosure of cookies to the wrong server, a scripting vulnerability which can allow an attacker to run arbitrary code, and an S/MIME vulnerability which can lead to remote denial of service or code execution attacks.
Alerts:	Whitebox WBSA-2004:421-01 2004-08-19 Whitebox WBSA-2004:110-01 2004-03-29 Red Hat RHSA-2004:112-01 2004-03-17 Mandrake MDKSA-2004:021 2004-03-10

Comments (none posted)

mpg321: format string vulnerability

Package(s):	mpg321	CVE #(s):	CAN-2003-0969
Created:	January 6, 2004	Updated:	March 28, 2005
Description:	A vulnerability was discovered in mpg321, a command-line mp3 player, whereby user-supplied strings were passed to printf(3) unsafely. This vulnerability could be exploited by a remote attacker to overwrite memory, and possibly execute arbitrary code. In order for this vulnerability to be exploited, mpg321 would need to play a malicious mp3 file (including via HTTP streaming).
Alerts:	Gentoo 200503-34 2005-03-28 Debian DSA-411-1 2004-01-05

Comments (none posted)

MySQL: temporary file vulnerabilities

Package(s):	mysql	CVE #(s):	CAN-2004-0381 CAN-2004-0388
Created:	April 14, 2004	Updated:	August 18, 2004
Description:	The mysqlbug and mysqld_multi scripts contain temporary file vulnerabilities which could be used by a local attacker to overwrite files on the system.
Alerts:	Gentoo 200405-20 2004-05-25 Mandrake MDKSA-2004:034 2004-04-19 OpenPKG OpenPKG-SA-2004.014 2004-04-14 Debian DSA-483-1 2004-04-14

Comments (none posted)

neon: buffer overflow

Package(s):	neon	CVE #(s):	CAN-2004-0398
Created:	May 19, 2004	Updated:	September 30, 2004
Description:	The neon library (through version 0.24.5) contains a buffer overflow in its date parsing code, allowing arbitrary code execution when connecting to a hostile server. See this advisory for details. This vulnerability also affects related applications (such as cadaver).
Alerts:	Fedora-Legacy FLSA:1552 2004-09-29 Mandrake MDKSA-2004:078 2004-07-29 Gentoo 200406-03 2004-06-05 Gentoo 200405-25b 2004-06-02 Gentoo 200405-25 2004-05-30 Conectiva CLA-2004:841 2004-05-25 Gentoo 200405-15 2004-05-20 Gentoo 200405-13 2004-05-20 OpenPKG OpenPKG-SA-2004.024 2004-05-19 Mandrake MDKSA-2004:049 2004-05-19 Fedora FEDORA-2004-130 2004-05-19 Fedora FEDORA-2004-129 2004-05-19 Red Hat RHSA-2004:191-01 2004-05-19 Debian DSA-507-1 2004-05-19 Debian DSA-506-1 2004-05-19

Comments (none posted)

Nessus NASL scripting engine security issues

Package(s):	nessus	CVE #(s):
Created:	May 27, 2003	Updated:	August 12, 2004
Description:	Some some vulnerabilities exsist in the Nessus NASL scripting engine. To exploit these flaws, an attacker would need to have a valid Nessus account as well as the ability to upload arbitrary Nessus plugins in the Nessus server (this option is disabled by default) or he/she would need to trick a user somehow into running a specially crafted nasl script. Read the full advisory for additional information.
Alerts:	Gentoo 200305-10 2003-05-27

Comments (none posted)

netpbm: insecure temporary files

Package(s):	netpbm	CVE #(s):	CAN-2003-0924
Created:	January 19, 2004	Updated:	December 29, 2004
Description:	netpbm is graphics conversion toolkit made up of a large number of single-purpose programs. Many of these programs were found to create temporary files in an insecure manner, which could allow a local attacker to overwrite files with the privileges of the user invoking a vulnerable netpbm tool.
Alerts:	Conectiva CLA-2004:909 2004-12-29 Gentoo 200410-02 2004-10-04 Mandrake MDKSA-2004:011-1 2004-09-27 Whitebox WBSA-2004:031-01 2004-02-12 Mandrake MDKSA-2004:011 2004-02-11 Red Hat RHSA-2004:030-01 2004-02-05 Fedora FEDORA-2004-068 2004-02-06 Red Hat RHSA-2004:031-01 2004-01-22 Debian DSA-426-1 2004-01-18

Comments (1 posted)

openssh: timing attack leads to information disclosure

Package(s):	openssh	CVE #(s):	CAN-2003-0190
Created:	May 2, 2003	Updated:	November 30, 2004
Description:	From the advisory: "During a pen-test we stumbled across a nasty bug in OpenSSH-portable with PAM support enabled (via the --with-pam configure script switch). This bug allows a remote attacker to identify valid users on vulnerable systems, through a simple timing attack. The vulnerability is easy to exploit and may have high severity, if combined with poor password policies and other security problems that allow local privilege escalation."
Alerts:	Ubuntu USN-34-1 2004-11-30 OpenPKG OpenPKG-SA-2003.035 2003-08-06 Red Hat RHSA-2003:222-01 2003-07-29 Gentoo 200305-02 2003-05-13 Gentoo 200305-01 2002-03-05

Comments (1 posted)

OpenSSL: denial of service vulnerabilities

Package(s):	OpenSSL	CVE #(s):	CAN-2004-0081 CAN-2003-0851
Created:	March 17, 2004	Updated:	November 2, 2005
Description:	Versions 0.9.7a-c of the OpenSSL library suffer from two denial of service vulnerabilities; see the version 0.9.7d release announcement for details.
Alerts:	Red Hat RHSA-2005:830-00 2005-11-02 Red Hat RHSA-2005:829-00 2005-11-02 Fedora FEDORA-2005-1042 2005-10-31 Fedora-Legacy FLSA:1395 2004-05-08 Conectiva CLA-2004:834 2004-03-31 Whitebox WBSA-2004:084-01 2004-03-23 Red Hat RHSA-2004:084-01 2004-03-23 Fedora FEDORA-2004-095 2004-03-19 Whitebox WBSA-2004:120-01 2004-03-22 Trustix TSLSA-2004-0012 2004-03-17 Slackware SSA:2004-077-01 2004-03-17 Red Hat RHSA-2004:121-01 2004-03-17 OpenPKG OpenPKG-SA-2004.007 2004-03-18 Gentoo 200403-03 2004-03-17 Debian DSA-465-1 2004-03-17 Netwosix NW-2004-0005 2004-03-17 Mandrake MDKSA-2004:023 2004-03-17 SuSE SuSE-SA:2004:007 2004-03-17 Red Hat RHSA-2004:120-01 2004-03-17 Red Hat RHSA-2004:119-01 2004-03-17 EnGarde ESA-20040317-003 2004-03-17

Comments (1 posted)

pavuk: buffer overflow

Package(s):	pavuk	CVE #(s):	CAN-2004-0456
Created:	June 30, 2004	Updated:	November 11, 2004
Description:	Versions of the pavuk web spider through 0.9.28-r1 contain a buffer overflow which could be exploited by a hostile server.
Alerts:	Gentoo 200411-19 2004-11-10 Debian DSA-527-1 2004-07-03 Gentoo 200406-22 2004-06-30

Comments (none posted)

Pavuk: Digest authentication helper buffer overflow

Package(s):	pavuk	CVE #(s):
Created:	July 26, 2004	Updated:	July 28, 2004
Description:	Pavuk contains several buffer overflow vulnerabilities in the code handling digest authentication. An attacker could cause a buffer overflow, leading to arbitrary code execution with the rights of the user running Pavuk. These vulnerabilities have been fixed in pavuk-0.9.28-r3.
Alerts:	Gentoo 200407-19 2004-07-26

Comments (none posted)

php: remotely exploitable memory errors

Package(s):	php	CVE #(s):	CAN-2004-0594
Created:	July 14, 2004	Updated:	February 7, 2005
Description:	Stefan Esser has issued an advisory regarding a remotely exploitable hole in PHP (through version 4.3.7). If the memory_limit feature is in use (as it should be, to prevent denial of service attacks), allocation failures can be forced at highly inopportune times, and those failures can be exploited to execute arbitrary code. The exploit is described as "quite easy," and it can be done regardless of whether Apache1 or Apache2 is in use. Upgrading to PHP 4.3.8 fixes the problem; yesterday's PHP 5.0 release also contains the fix (but the final release candidate did not).
Alerts:	Debian DSA-669-1 2005-02-07 Whitebox WBSA-2004:392-01 2004-08-19 Fedora FEDORA-2004-223 2004-07-23 Fedora FEDORA-2004-222 2004-07-23 OpenPKG OpenPKG-SA-2004.034 2004-07-22 Slackware SSA:2004-202-01 2004-07-20 Debian DSA-531-1 2004-07-20 Red Hat RHSA-2004:392-01 2004-07-19 Red Hat RHSA-2004:395-01 2004-07-19 Conectiva CLA-2004:847 2004-07-16 SuSE SUSE-SA:2004:021 2004-07-16 Mandrake MDKSA-2004:068 2004-07-14 Gentoo 200407-13 2004-07-15 tinysofa TSSA-2004-013 2004-07-14

Comments (none posted)

postgresql buffer overflow in ODBC driver

Package(s):	postgresql	CVE #(s):
Created:	June 7, 2004	Updated:	July 28, 2004
Description:	A buffer overflow has been discovered in the ODBC driver of PostgreSQL, an object-relational SQL database, descended from POSTGRES. It possible to exploit this problem and crash the surrounding application. Hence, a PHP script using php4-odbc can be utilized to crash the surrounding Apache webserver. Other parts of postgresql are not affected.
Alerts:	Mandrake MDKSA-2004:072 2004-07-27 Debian DSA-516-1 2004-06-07

Comments (none posted)

python: buffer overflow

Package(s):	python	CVE #(s):	CAN-2004-0150
Created:	March 10, 2004	Updated:	October 11, 2004
Description:	Python (versions 2.2 and 2.2.1 only) has a buffer overflow in the getaddrinfo() function which can be exploited by a malformed IPv6 address.
Alerts:	Debian DSA-458-3 2004-10-10 Gentoo 200409-03 2004-09-02 Debian DSA-458-2 2004-08-31 Mandrake MDKSA-2004:019 2004-03-09 Debian DSA-458-1 2004-03-09

Comments (none posted)

samba: potential buffer overruns

Package(s):	samba	CVE #(s):	CAN-2004-0600 CAN-2004-0686
Created:	July 22, 2004	Updated:	September 2, 2004
Description:	According to this Samba advisory, Evgeny Demidov discovered that the Samba SMB/CIFS server has a buffer overflow bug in the Samba Web Administration Tool (SWAT) on decoding Base64 data during HTTP Basic Authentication. Samba versions between 3.0.2 through 3.0.4 are affected. (CAN-2004-0600) Another buffer overflow bug has been located in the Samba code used to support the "mangling method = hash" functionality. The default setting for this parameter is "mangling method = hash2" and therefore Samba is not vulnerable by default. Samba versions between 2.2.0 through 2.2.9 and 3.0.0 through 3.0.4 are affected. (CAN-2004-0686)
Alerts:	Fedora FEDORA-2004-285 2004-09-02 Fedora FEDORA-2004-284 2004-09-02 Whitebox WBSA-2004:259-01 2004-08-19 Conectiva CLA-2004:854 2004-07-30 Gentoo 200407-21 2004-07-29 Trustix TSLSA-2004-0039 2004-01-05 Red Hat RHSA-2004:404-01 2004-07-26 Slackware SSA:2004-207-01 2004-07-25 tinysofa TSSA-2004-014 2004-07-23 SuSE SUSE-SA:2004:022 2004-07-23 Netwosix NW-2004-0015 2004-07-23 Mandrake MDKSA-2004:071 2004-07-22 Conectiva CLA-2004:851 2004-07-22 Red Hat RHSA-2004:259-01 2004-07-22 OpenPKG OpenPKG-SA-2004.033 2004-07-22

Comments (1 posted)

sox: buffer overflow

Package(s):	sox	CVE #(s):	CAN-2004-0557
Created:	July 28, 2004	Updated:	February 21, 2005
Description:	Sox suffers from buffer overflows in its WAV file handling; these overflows could conceivably be exploited by way of a malicious sound file.
Alerts:	Fedora-Legacy FLSA:1945 2005-02-20 Debian DSA-565-1 2004-10-13 Whitebox WBSA-2004:409-01 2004-08-19 Slackware SSA:2004-223-03 2004-08-07 Conectiva CLA-2004:855 2004-07-30 Gentoo 200407-23 2004-07-30 Mandrake MDKSA-2004:076 2004-07-28 Red Hat RHSA-2004:409-01 2004-07-29 Fedora FEDORA-2004-244 2004-07-28 Fedora FEDORA-2004-235 2004-07-28

Comments (none posted)

squid: buffer overflow

Package(s):	squid	CVE #(s):	CAN-2004-0541
Created:	June 9, 2004	Updated:	September 30, 2004
Description:	The NTLM authentication helper used by the squid proxy contains a buffer overflow vulnerability; an overly-long password may be used to run arbitrary code. Sites not using NTLM authentication are not vulnerable.
Alerts:	Red Hat RHSA-2004:462-01 2004-09-30 Mandrake MDKSA-2004:093 2004-09-15 Gentoo 200409-04 2004-09-02 Gentoo 200406-13 2004-06-17 Whitebox WBSA-2004:242-01 2004-06-10 Trustix TSLSA-2004-0033 2004-06-10 Mandrake MDKSA-2004:059 2004-06-09 SuSE SuSE-SA:2004:016 2004-06-09 Red Hat RHSA-2004:242-01 2004-06-09 Fedora FEDORA-2004-164 2004-06-09 Fedora FEDORA-2004-163 2004-06-09

Comments (none posted)

SquirrelMail cross site scripting vulnerabilities

Package(s):	squirrelmail	CVE #(s):	CAN-2004-0519 CAN-2004-0520 CAN-2004-0521
Created:	May 21, 2004	Updated:	October 4, 2004
Description:	Several unspecified cross-site scripting (XSS) vulnerabilities and a well hidden SQL injection vulnerability were found in SquirrelMail versions 1.4.2 and lower. An XSS attack allows an attacker to insert malicious code into a web-based application. SquirrelMail does not check for code when parsing variables received via the URL query string.
Alerts:	Fedora-Legacy FLSA:1733 2004-10-02 Conectiva CLA-2004:858 2004-08-12 Whitebox WBSA-2004:240-01 2004-06-21 Gentoo 200406-08 2004-06-15 Red Hat RHSA-2004:240-01 2004-06-14 Fedora FEDORA-2004-160 2004-06-09 Fedora FEDORA-2004-159 2004-06-09 Gentoo 200405-16:02 2004-05-25 Gentoo 200405-16 2004-05-21

Comments (none posted)

Subversion: Remote heap overflow

Package(s):	subversion	CVE #(s):	CAN-2004-0413
Created:	June 11, 2004	Updated:	March 7, 2005
Description:	Subversion has a remote Denial of Service vulnerability that may allow a server that runs svnserve to execute arbitrary code. See this advisory for more information.
Alerts:	Fedora-Legacy FLSA:1748 2005-03-07 SuSE SuSE-SA:2004:018 2004-06-17 Fedora FEDORA-2004-166 2004-06-11 Fedora FEDORA-2004-165 2004-06-11 OpenPKG OpenPKG-SA-2004.028 2004-06-11 Gentoo 200406-07 2004-06-10

Comments (none posted)

subversion: access control bypass

Package(s):	subversion	CVE #(s):
Created:	July 23, 2004	Updated:	July 28, 2004
Description:	Subversion has a vulnerability in the mod_authz_svn Apache authentication module that can allow a local user to bypass read restrictions in the repository.
Alerts:	Gentoo 200407-20 2004-07-26 Fedora FEDORA-2004-231 2004-07-23

Comments (none posted)

sysstat: temporary file vulnerability

Package(s):	sysstat	CVE #(s):	CAN-2004-0107 CAN-2004-0108
Created:	March 10, 2004	Updated:	October 4, 2004
Description:	The sysstat utility has a temporary file vulnerability which can be exploited by a local attacker to overwrite system files.
Alerts:	Fedora-Legacy FLSA:1372 2004-10-03 Gentoo 200404-04 2004-04-06 Debian DSA-460-2 2004-04-03 Trustix TSLSA-2004-0011 2004-03-16 Whitebox WBSA-2004:053-01 2004-03-10 Red Hat RHSA-2004:053-01 2004-03-10 Red Hat RHSA-2004:093-01 2004-03-10 Debian DSA-460-1 2004-03-10

Comments (none posted)

File overwrite vulnerability in tar and unzip

Package(s):	tar unzip	CVE #(s):	CAN-2001-1267 CAN-2001-1268 CAN-2001-1269 CAN-2002-0399
Created:	October 1, 2002	Updated:	April 10, 2006
Description:	The tar utility does not properly filter file names containing "../", meaning that a hostile archive can, if unpacked by an unsuspecting user, overwrite any file that is writable by that user. GNU tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42 has the same vulnerability.
Alerts:	Fedora-Legacy FLSA:183571-1 2006-04-04 Red Hat RHSA-2006:0195-01 2006-02-21 Conectiva CLA-2002:538 2002-10-29 Mandrake MDKSA-2002:066 2002-10-10 Mandrake MDKSA-2002:065 2002-10-10 EnGarde ESA-20021003-022 2002-10-03 Gentoo unzip-20021001 2002-10-01 Gentoo tar-20021001 2002-10-01 Red Hat RHSA-2002:096-24 2002-09-18

Comments (1 posted)

tcpdump: ISAKMP payload handling denial-of-service vulnerabilities

Package(s):	tcpdump	CVE #(s):	CAN-2004-0183 CAN-2004-0184
Created:	March 30, 2004	Updated:	September 30, 2004
Description:	TCPDUMP v3.8.1 and earlier versions contain multiple flaws in the packet display functions for the ISAKMP protocol. Upon receiving specially crafted ISAKMP packets, TCPDUMP will try to read beyond the end of the packet capture buffer and crash. More information is available in this Rapid7 advisory.
Alerts:	Fedora-Legacy FLSA:1468 2004-09-29 Whitebox WBSA-2004:219-01 2004-06-10 Red Hat RHSA-2004:219-01 2004-05-26 Fedora FEDORA-2004-120 2004-05-13 Slackware SSA:2004-108-01 2004-04-17 Mandrake MDKSA-2004:030 2004-04-14 OpenPKG OpenPKG-SA-2004.010 2004-04-07 Debian DSA-478-1 2004-04-06 Trustix TSLSA-2004-0015 2004-03-30

Comments (none posted)

Multiple vendor telnetd vulnerability

Package(s):	telnet Telnet netkit-telnet-ssl kerberos telnetd netkit-telnet nkitb/nkitserv/telnetd krb5	CVE #(s):
Created:	May 21, 2002	Updated:	October 5, 2004
Description:	This vulnerability, originally thought to be confined to BSD-derived systems, was first covered in the July 26th Security Summary. It is now known that Linux telnet daemons are vulnerable as well.
Alerts:	Gentoo 200410-03 2004-10-05 Yellow Dog YDU-20010810-2 2001-08-10 Yellow Dog YDU-20010810-1 2001-08-10 SuSE SuSE-SA:2001:029 2001-09-03 Slackware sl-997726350 2001-08-09 Red Hat RHSA-2001:100-02 2001-08-09 Red Hat RHSA-2001:099-09 2002-02-07 Red Hat RHSA-2001:099-06 2001-08-09 Progeny PROGENY-SA-2001-27 2001-08-14 Mandrake MDKSA-2001:093 2001-12-17 Mandrake MDKSA-2001:068 2001-08-13 HP HPSBTL0202-023 2002-02-12 Debian DSA-075-2 2001-08-14 Debian DSA-075-1 2001-08-14 Conectiva CLA-2001:413 2001-08-24 SCO Group CSSA-2001-030.0 2001-08-10

Comments (none posted)

webmin: denial of service

Package(s):	webmin	CVE #(s):	CAN-2004-0582 CAN-2004-0583
Created:	June 16, 2004	Updated:	July 28, 2004
Description:	Versions of webmin prior to 1.150 suffer from denial of service and information disclosure vulnerabilities. See advisories for the disclosure and lockout problems for more information.
Alerts:	Mandrake MDKSA-2004:074 2004-07-27 Conectiva CLA-2004:848 2004-07-16 Debian DSA-526-1 2004-07-03 Gentoo 200406-12 2004-06-16

Comments (none posted)

wv: buffer overflow

Package(s):	wv	CVE #(s):	CAN-2004-0645
Created:	July 14, 2004	Updated:	February 10, 2005
Description:	wv, a viewer for MS Word files, contains a buffer overflow which may be exploited by a suitably-crafted file. Version 1.0.0-r1 fixes the problem.
Alerts:	Fedora-Legacy FLSA:1906 2005-02-08 Conectiva CLA-2004:902 2004-12-01 Debian DSA-579-1 2004-11-01 Debian DSA-550-1 2004-09-20 Conectiva CLA-2004:863 2004-09-10 Mandrake MDKSA-2004:077 2004-07-29 Fedora FEDORA-2004-225 2004-07-23 Fedora FEDORA-2004-224 2004-07-23 Gentoo 200407-11 2004-07-14

Comments (none posted)

XChat 2.0.x SOCKS5 Vulnerability

Package(s):	xchat	CVE #(s):	CAN-2004-0409
Created:	April 19, 2004	Updated:	November 15, 2005
Description:	XChat is vulnerable to a stack overflow that may allow a remote attacker to run arbitrary code. The SOCKS 5 proxy code in XChat is vulnerable to a remote exploit. Users would have to be using XChat through a SOCKS 5 server, enable SOCKS 5 traversal which is disabled by default and also connect to an attacker's custom proxy server. This vulnerability may allow an attacker to run arbitrary code within the context of the user ID of the XChat client.
Alerts:	Fedora-Legacy FLSA:123013 2005-11-14 Red Hat RHSA-2004:585-01 2004-10-27 Netwosix NW-2004-0014 2004-05-01 Red Hat RHSA-2004:177-01 2004-04-30 Mandrake MDKSA-2004:036 2004-04-21 Debian DSA-493-1 2004-04-21 Gentoo 200404-15 2004-04-19

Comments (none posted)

XFree86, X.org: XDM ignores requestPort setting

Package(s):	XFree86 X.org	CVE #(s):	CAN-2004-0419
Created:	July 5, 2004	Updated:	July 28, 2004
Description:	XDM will open TCP sockets for its chooser, even if the DisplayManager.requestPort setting is set to 0. This may allow authorized users to access a machine remotely via X, even if the administrator has configured XDM to refuse such connections. See this XFree86 bug report.
Alerts:	Mandrake MDKSA-2004:073 2004-07-27 Gentoo 200407-05 2004-07-05

Comments (none posted)

xine-ui - insecure temporary file creation

Package(s):	xine-ui	CVE #(s):	CAN-2004-0372
Created:	April 6, 2004	Updated:	April 27, 2006
Description:	Shaun Colley discovered a problem in xine-ui, the xine video player user interface. A script contained in the package to possibly remedy a problem or report a bug does not create temporary files in a secure fashion. This could allow a local attacker to overwrite files with the privileges of the user invoking xine.
Alerts:	Gentoo 200404-20 2004-04-27 Slackware SSA:2004-111-01 2004-04-20 Mandrake MDKSA-2004:033 2004-04-19 Debian DSA-477-1 2004-04-06

Comments (none posted)

Resources

"Cyber Adversary Characterization: Auditing the Hacker Mind" released

Syngress Publishing has announced the release of Cyber Adversary Characterization: Auditing the Hacker Mind, by Tom Parker, Matthew Devost, Marcus Sachs, Eric Shaw, and Ed Stroz. "By providing recent case studies and profiles of various cyber-terrorists, this is the must-have guide book for understanding the world of hackers."

Full Story (comments: none)

What Countermeasures Really Means (O'ReillyNet)

Here's an O'ReillyNet article looking at the use of active countermeasures in the face of security threats. "One dirty little secret of information security is that corporations have been using 'tiger teams' for years in order to launch highly aggressive counterstrikes against attackers. Why? Because many more corporations get attacked and extorted through computer intrusions than the popular press will ever report."

Comments (1 posted)

Page editor: Jonathan Corbet

Kernel development

Brief items

Kernel release status

The current 2.6 prepatch is 2.6.8-rc3, which was announced by Linus on August 3. Most of the additions this time around are relatively small fixes; they include some kbuild work, a great many "sparse" annotations, the removal of the (non-functional) "fastroute" networking option, some crypto-API work (including an x86-optimized AES implementation which may be yanked out due to licensing concerns), and several architecture updates. The long-format changelog has all the details.

Linus's BitKeeper repository contains no patches after 2.6.8-rc3 as of this writing.

The current patch set from Andrew Morton is 2.6.8-rc2-mm2. Recent additions to -mm include some read-copy-update work (to address more latency issues), performance improvements for O_SYNC disk I/O, the staircase CPU scheduler (see below), token-based thrashing control (see below again), a change to /dev/mem allowing architectures block accesses to kernel memory, a new vprintk() function, and large numbers of fixes and updates.

The current 2.4 prepatch is 2.4.27-rc5, released by Marcelo on August 3. This one contains a fix for a new security issue (which could allow unprivileged processes to read kernel memory), takes out DVD-RW support for now (they will try again in 2.4.28), and adds a few fixes.

Comments (none posted)

Kernel development news

Scheduler tweaks get serious

Con Kolivas has been working on his staircase scheduler patch for a while; it was covered here in the beginning of June. That scheduler found its way into the 2.6.8-rc2-mm2 patch, along with this comment from Andrew Morton:

So it would seem that it is now open season for scheduler work.

Initial reports on the staircase scheduler are generally - but not uniformly - good. Martin Bligh posted some benchmark results showing some significant performance improvements for the 2.6.8-rc2-mm2 kernel, especially for "low to mid loads." Ingo Molnar, instead, has found a workload which performs poorly with this scheduler; it involves running multiple processes each of which wants most, but not all, of the CPU.

Con, meanwhile, has posted a couple of additional patches implementing additional policies in the staircase scheduler. SCHED_BATCH is another attempt at an "idle process" mode, where batch processes only run if nothing else wants the processor. This patch attempts to avoid priority inversion problems by scheduling SCHED_BATCH processes at normal priority when they are running in kernel mode.

SCHED_ISO, instead, is an "isochronous" mode intended for applications which need soft real-time response. Putting a process into SCHED_ISO is an unprivileged operation, any user can do it. Isochronous tasks start out with a relatively high priority, and should get scheduled quickly. Their allocated time slices are half of what they would otherwise be, however, and their priority drops especially quickly with CPU usage. So this mode is suitable for I/O bound processes which need to respond quickly (audio recording, CD burning, etc.), but it should not allow a hostile user to take over the system.

Peter Williams has been working on a different set of scheduler patches. His approach is to get rid of the "expired" array (where processes go to languish when they have used up their time slices) and move everything to a single array. The patch offers two modes, being the traditional priority-based mode and a new "entitlement" mode which tries to figure how much processor time each task is entitled to, then works to ensure that each is given at least that much time. His patches are available in a dizzying number of varieties; they seem to have seen less testing so far, but Andrew has said that one of them might get a turn in -mm for a while.

Nick Piggin's -np trees also contain a new scheduler. Nick's work tries to simplify many of the scheduler calculations while retaining logic which tries to evaluate the "interactivity" of each process. Unlike some implementations, this scheduler gives longer time slices to higher-priority processes. All slices are scaled depending on the job mix, however; low-priority processes will get longer slices if there are no high-priority processes around.

Ingo Molnar has continued his work on voluntary preemption; his voluntary-preempt-2.6.8-rc2-O2 patch features a new implementation of the interrupt threads feature. The available reports indicate that, with this patch, latency problems in the 2.6 kernel are becoming few and far between.

There is no way to tell, at this point, which of these scheduler approaches - if any - will find its way into the mainline kernel. Evaluating schedulers takes a long time, and, for any given scheduler, there always seems to be some strange workload out there which makes it fall apart. The approaches described above (with the exception of voluntary preemption) share one nice feature, however, which is likely to argue in favor of including one of them: they all remove a significant amount of code and make the scheduler simpler and easier to understand. That, in and of itself, may be a worthwhile step toward the implementation of a top-quality Linux scheduler.

Comments (2 posted)

Token-based thrashing control

A system which is in the throes of VM thrashing is no fun to work with. The kernel is forever throwing out pages which it will need in the near future in favor of pages needed right now, and little work actually gets done. It seems like there has to be a better way.

Rik van Riel has put together a patch based on the work of Song Jiang which might help. The basic idea is that a process which is currently bringing in pages should, for a short period, not have its other pages booted out to swap. With luck, that process will actually make some progress during that grace period before the VM grim reaper swoops down and consigns it, once again, to the swap ghetto.

Clearly, not all processes which are bringing in pages can be sheltered from page reclamation at the same time; if they could, the system would not be thrashing in the first place. This problem is addressed through the creation of a "swap token." A process holding the swap token will be allowed to bring in pages without having its current working set molested for a period of time. After a while, the token is passed on to the next needy process.

In Rik's patch, the (single, system-wide) token is implemented through swap_token_mm, a pointer to the mm structure of the process holding the token. If the kernel, on behalf of a process incurring a page fault, decides that the token is available, swap_token_mm will be set and the faulting process will get its breathing space for a while. The token is deemed to be available if (1) it has been held for longer than the maximum period, which is set to a surprisingly long 300 seconds, or (2) the process holding the token has not incurred any page faults recently. Once the token becomes available, the first process which comes looking for it will grab it - unless it has held the token in the recent past.

Rik's tests show some performance improvements with this patch applied. There are potential improvements which could be made, such as trying to add some intelligence to the decision of which process gets the token. A huge process may hold the token for some time, grow to fill much of memory, and still not have enough to get any real work done. Meanwhile, small processes which could have benefited from a few extra pages continue to thrash. Some tweaks could be made to the patch to address this issue, but there are limits to how much code and complexity should be added to the kernel to deal with a (hopefully) rare situation.

Comments (3 posted)

Recent patches of interest

A number of interesting kernel patches have been posted in recent times. Since your editor is pressed for time, a few of those patches will be quickly covered here.

Nigel Cunningham has been working at getting some small pieces of his software suspend implementation into the kernel. One of those pieces is this patch, which has to do with the "freezing" of kernel threads prior to suspending the system. As processes are put on hold, the kernel risks stopping a process which is needed later on in the suspend process; think about a process handling NFS service or software interrupts, for example. To avoid this situation, kernel threads are simply not frozen. But many of them can be, and that would make the suspend process more robust. So Nigel's patch goes through and tries to set up each thread with the appropriate flags, so that only truly necessary kernel threads continue to run while the system is being suspended.

A number of these threads, it turns out, are part of a workqueue. As a way of setting up every workqueue process with the right flags, Nigel changed the interface to create_workqueue() and create_singlethread_workqueue(), thus breaking all code which creates its own workqueues. Andrew Morton expressed some discomfort at the API change, but acknowledged that it was useful in that it forces people to think about whether every workqueue needs to run during a system suspend operation or not. This patch has not yet appeared in -mm, as of this writing.

Rik van Riel and Arjan van de Ven have put together a new patch which allows normal users to lock memory into physical RAM without root privilege. The RLIMIT_MEMLOCK resource limit puts an upper bound on how much memory can be locked, and its default value is zero. By raising this limit, system administrators can enable users to lock a single page (useful for cryptographic applications which do not want to see passphrases and clear text swapped to disk) or larger amounts (for CD writing tasks, for example). Various issues were raised regarding the security of this patch, but the latest version appears to have resolved them. This code should eventually replace the magic "mlock group" hack that was covered here last May.

Fistgen 0.1 has been released; this is the first version for the 2.6 kernel. The announcement describes fistgen as "a package of stackable templates," which may not be particularly illuminating to many readers. More information can be found at filesystems.org; one developer calls it "a yacc for filesystems." Using fistgen and a small amount of code, a set of filters can be set up to create a filesystem with a given set of characteristics. For example, this template describes a filesystem which encrypts data using the sophisticated "rot13" algorithm. The fistgen parser reads the template file and generates C code implementing the filesystem, which can then be loaded into the kernel.

John McCutchan has been working on his inotify patch for some time. Inotify is meant to be a replacement for the dnotify mechanism, used by processes which wish to be alerted when files are changed. The inotify patch takes a different approach; it creates a char device which supports a small set of ioctl() operations. After opening this device and using ioctl() to express interest in a particular set of files, a process need only read the device to get the change events for those files.

OpenSSI 1.0 is out. OpenSSI is a "single system image" clustering environment based on the 2.4 kernel; it includes member ship functions, the CFS and Lustre Lite filesystems, process management, and a cluster-wide device mechanism built on devfs. See the OpenSSI web page for more information.

The sysfs directory /sys/module contains, among other things, attributes for parameters exported by loaded modules. Dominik Brodowski noticed that, if these modules are built directly into the kernel, those parameters are not available via sysfs. If they were, they shouldn't be under /sys/module in any case, since the code in question is not part of a module. So he has posted a patch creating a new directory (/sys/parameters) and putting attributes there, for both modules and built-in code. This is a user-space API change, but it is unlikely that anything of any consequence depends on parameters under /sys/module at this point.

Jens Axboe has posted a new SCSI generic ("sg") implementation (called "bsg") which works through the block layer. This driver implements the SG_IO ioctl() call, and also allows communication through regular reads and writes. The latter functionality caused some complaints; when structures are passed between user and kernel space with read() and write() calls, it becomes very hard to convert them when the process is running in 32-bit mode on a 64-bit platform. For all that the developers dislike ioctl(), that interface does, at least, make it clear when and where a structure is being transferred across the user-kernel boundary. To address these complaints, the bsg driver may be restricted to the ioctl() mode only.

Comments (1 posted)

Patches and updates

Kernel trees

• Linus Torvalds: Linux 2.6.8-rc3. (August 3, 2004)

• Matt Mackall: 2.6.8-rc3-tiny1 for small systems. (August 4, 2004)

• Andrew Morton: 2.6.8-rc2-mm2. (August 2, 2004)

• Con Kolivas: 2.6.7-ck6. (August 2, 2004)

• Marcelo Tosatti: Linux 2.4.27-rc5. (August 4, 2004)

• Marcelo Tosatti: Linux 2.4.27-rc4. (August 1, 2004)

Build system

• Sam Ravnborg: kbuild: Various updates for 2.6.8. (August 2, 2004)

Core kernel code

• Ingo Molnar: voluntary-preempt-2.6.8-rc2-M5. (July 31, 2004)

• Ingo Molnar: voluntary-preempt-2.6.8-rc2-O2. (August 2, 2004)

• Con Kolivas: Staircase cpu scheduler 2.6.8-rc2-mm1. (August 2, 2004)

• Con Kolivas: Scheduler policies for staircase. (August 4, 2004)

• Con Kolivas: Schedrange. (August 4, 2004)

• Con Kolivas: Sched batch for staircase. (August 4, 2004)

• Con Kolivas: Isochronous scheduling for staircase scheduler. (August 4, 2004)

• Peter Williams: V-3.0 Single Priority Array O(1) CPU Scheduler Evaluation. (August 2, 2004)

• Perez-Gonzalez, Inaky: FUSYN Realtime & robust mutexes for Linux, v2.3.1. (August 4, 2004)

Development tools

• Marty Ridgeway: August release of LTP available. (August 4, 2004)

Device drivers

• Pavel Machek: Solving suspend-level confusion. (August 3, 2004)

• Jesse Barnes: add PCI ROMs to sysfs. (August 3, 2004)

• Alex Williamson: dev_acpi: device driver for userspace access to ACPI. (August 3, 2004)

• Jean Tourrilhes: Wireless drivers update for WE-17. (August 4, 2004)

• Jens Axboe: block layer sg, bsg. (August 4, 2004)

Documentation

• Angelo Dell'Aera: TCP Westwood+ references. (August 4, 2004)

Filesystems and block I/O

• Erez Zadok: fistgen-0.1 released (linux-2.6 support). (July 29, 2004)

• Maneesh Soni: sysfs backing store (Re-splitted). (July 31, 2004)

• John McCutchan: inotify 0.8. (July 31, 2004)

• Suparna Bhattacharya: Concurrent O_SYNC write support. (August 2, 2004)

• Ravikiran G Thirumalai: Lockfree fd lookup 0 of 5. (August 2, 2004)

• Ravikiran G Thirumalai: Lockfree fd lookup 1 of 5. (August 2, 2004)

• Ravikiran G Thirumalai: Lockfree fd lookup 2 of 5. (August 2, 2004)

• Ravikiran G Thirumalai: Lockfree fd lookup 0 of 5. (August 2, 2004)

• Ravikiran G Thirumalai: Lockfree fd lookup 4 of 5. (August 2, 2004)

Janitorial

• Jeff Garzik: fastroute dead code.... (August 3, 2004)

Memory management

• Dave Hansen: don't pass mem_map into init functions. (July 29, 2004)

• Arjan van de Ven: mlock-as-nonroot revisted. (July 29, 2004)

• Rik van Riel: mlock-as-user for 2.6.8-rc2-mm2. (August 4, 2004)

• Rik van Riel: token based thrashing control. (August 2, 2004)

• Paul Jackson: subset zonelists and big numa friendly mempolicy MPOL_MBIND. (August 3, 2004)

Networking

• Jean Tourrilhes: Wireless Extension v17 for Linus. (August 4, 2004)

Architecture-specific

• Andi Kleen: x86_64-2.6.8rc2-3 released. (August 2, 2004)

Miscellaneous

• Jon Smirl: OLS and console rearchitecture. (August 2, 2004)

• Aneesh Kumar K.V: OpenSSI 1.0.0 released!!. (August 2, 2004)

• Stephen Hemminger: iproute2 update. (August 3, 2004)

• Dominik Brodowski: export module parameters in sysfs for modules _and_ built-in code. (August 4, 2004)

• Dominik Brodowski: export module parameters in sysfs for modules _and_ built-in code: remove /sys/module/*parameters*. (August 4, 2004)

Page editor: Jonathan Corbet

Distributions

News and Editorials

A look at Gentoo 2004.2

Gentoo 2004.2 was released last week. As a relative Gentoo newbie, this writer decided this would be as good a time as any to slap Gentoo onto his Toshiba laptop for further study.

Gentoo's installation process is, to put it mildly, different from most Linux distributions. Gentoo does not really offer an installer as such, but does have a process for installation that is well-documented.

At first glance, the quick install instructions for x86 machines gave the impression that it would be an extremely tedious process. In actuality, the install process for Gentoo was reasonably simple as long as the user is able to follow the directions and is willing to perform an install that requires more than point and click skills.

This writer wouldn't recommend installing Gentoo for anyone new (or newish) to Linux, but for Linux users with a decent amount of experience under their belt, installing Gentoo is no major feat. It's a bit time-consuming compared to other distributions, so be prepared to set aside a few hours to perform a Gentoo install from start to finish. Depending on the speed of your machine, and which stage you choose to begin from, the installation can easily consume a workday.

One of the things that was particularly nice about Gentoo's install was the ability to set up the SSH daemon after just a few steps, and log into the Gentoo system from my main desktop and finish the install from there -- allowing me to work on another project while doing the Gentoo install from an xterm, and to simply cut and paste most of the commands necessary to install Gentoo, rather than typing them.

One thing that did not endear me to Gentoo's installation process initially was the lack of a Vi-like editor by default. To install Gentoo, one needs to edit a few files in the process and the only available editor seems to be GNU nano. While having nano available is a good thing for users who aren't used to a Vi-like editor, most experienced Linux users expect a Vi-like editor to be present on almost any running Linux system.

For current Gentoo users, there's no need to go through the installation once again to reach 2004.2. Users who are on Gentoo 1.4, 2004.0 or 2004.1 can simply sync their Portage tree and run "emerge --update world."

The Portage system and Gentoo's management tools are what set Gentoo apart from other Linux distributions, and it takes a bit to get used to for those of us reared on package-based distributions like Slackware, Red Hat and Debian. (Ladislav Bodnar contributed a nice overview of Portage back in June.) Having only briefly toyed with Gentoo in the past, this writer spent quite a bit of time getting used to Portage. It is something of an acquired taste, but it works well and it's easy to see why so many Linux users are using Gentoo.

In fact, the Portage system actually came to the rescue about mid-way through the install. While editing the system's /etc/fstab, this writer became quite frustrated with trying to think in nano while editing the file. Instead of finishing the install with nano, a quick "emerge vim" made it possible to use Vim for the remainder of the install process.

Changes in the 2004.2 release are mostly incremental. One major change in this release is the inclusion of X.org-X11 as the default XServer for licensing reasons. This release also includes GNOME 2.6, KDE 3.2.2 and XFce 4.0.5. According to this week's Gentoo Linux Newsletter, GNOME 2.6.2, KDE 3.2.3 have been marked stable in the Portage tree, and XFce 4.0.6 will be there soon.

In all, Gentoo 2004.2 isn't a radical departure from previous versions of Gentoo. It's a good starting point for users who have been interested in using Gentoo, but haven't yet stepped up to the plate. For users who like to tweak things and get to know Linux in-depth, Gentoo is a user's paradise. For users who want something to work with minimal fuss, Gentoo is not the best way to go. That's not a criticism of the distribution, but a simple acknowledgment that Gentoo method is not a quick and easy way to install Linux.

The distribution is quite solid, and well-documented. In fact, Gentoo's documentation may be some of the best on the "market" -- it's easy to follow, and the Gentoo project has done a particularly good job at providing complete documentation for the installation and use of the system. While it is taking some time to get used to, this writer plans to continue using Gentoo on his laptop for some time to come.

Comments (11 posted)

Distribution News

Debian GNU/Linux

The Debian Weekly News for August 3, 2004 is out. Topics this week include Debian Birthday parties, sarge package removals, OSCON talks, and more.

A long message sent to debian-devel by sarge release manager Steve Langasek gives a timeline for a Debian sarge release on September 15. It also breaks the news that Steve Langasek and Colin Watson are the release managers - it seems that A.J. Towns finally got fed up and stepped down from that position. The base and standard packages have gone into a hard freeze now, with a goal of having zero release-critical bugs (down from just under 300 now) by September 12.

Igor Genibel has announced a new version of the Debian Developer Packages Overview.

Frank Lichtenheld presents Bits from the WNPP with an explanation of the new RFH (Request For Help) tag that has been added to the Work-needing packages report.

Comments (none posted)

Fedora Core

The Fedora News Updates is back. Issue #14 has a lengthy discussion of how Fedora packages the kernel source, along with articles on upgrading from FC1, translations, and more.

The Fedora schedule has been updated, now showing a one-week slip. The Test 2 freeze is now scheduled for September 1, with a test 2 release set for September 13.

The Fedora Steering Committee has proposed to transfer Fedora Core 1 to the Fedora Legacy Project at the point Fedora Core 3 Test 2 is released.

FC2 updates:

• man-pages-ja: updated Japanese man pages fix typo and wrong filename
• gimp: update to v2.0.3
• gnumeric: adds plugins

Comments (none posted)

Gentoo Weekly Newsletter - Volume 3, Issue 31

The Gentoo Weekly Newsletter for the week of August 2, 2004 is out. This week's top news is the release of Gentoo Linux 2004.2 for AMD64, HPPA, SPARC and X86.

Full Story (comments: none)

UserLinux plans anounced

Bruce Perens has sent out an announcement (click below) regarding a press conference to happen at LinuxWorld. His plans for UserLinux include a "mass beta" starting September 1, tracking the Debian sarge release, and a "pure AMD64" UserLinux release.

Full Story (comments: 6)

Mandrakelinux

Mandrakelinux has an updated drakxtools package fixing many bugs.

Full Story (comments: none)

Slackware Linux

The slackware-current changelog shows just a few changes this week. Automake, binutils and gdb have been upgraded.

Comments (none posted)

New Distributions

StartCom Linux

StartCom Ltd., a small software house located in Israel, has announced the release of StartCom Enterprise Linux. Based on Red Hat Advanced Server source code, StartCom Linux is meant to offer a free and supported alternative to previous users of Red Hat Linux systems. StartCom plans to release four flavors of StartCom Linux: Enterprise Linux, the MultiMedia Edition, the Office Edition and the Developer Edition. StartCom Linux Enterprise AS-3.0.0 was released August 2, 2004.

Full Story (comments: none)

New Mexico Software Releases Santa Fe Desktop Linux

New Mexico Software, Inc. has announced the first release of Santa Fe Desktop Linux. This is a Debian-based, non-technical desktop distribution that can be run from a live CD or installed to hard disk.

Comments (none posted)

IsaMorph

IsaMorph is a highly specialized GNU/Linux Live CD. It's based on Morphix and features the interactive theorem prover Isabelle, for a complete theorem proving environment. IsaMorph joins the list at version 0.2.1, released July 29, 2004.

Comments (1 posted)

Minor distribution updates

AGNULA/DEMUDI 1.2.0-rc1 is out

AGNULA/DeMuDi 1.2.0-rc1, the Debian-based GNU/Linux distribution for audio/video, has been released. This release candidate sports tighter integration with Debian, using the Sarge Debian Installer and the CDD (Custom Debian Distributions) framework. Click below for more information.

Full Story (comments: none)

Devil-Linux v1.2 Beta 2 is available!

Devil-Linux has released v1.2 Beta 2. "The new release fixes all the reported problems from the previous Beta and adds various program updates."

Full Story (comments: none)

Linux Netwosix Official Support IRC Channel

Linux Netwosix has announced a new IRC Support Channel for users seeking help with Linux Netwosix.

Full Story (comments: 1)

Lycoris Announces AI2, New Application Environment for Desktop/LX

Lycoris has announced that AI2, its new application environment for Linux, will be made available exclusively in Desktop/LX 1.4. AI2 (A-I-squared), which stands for Advanced Application Integration Infrastructure.

Full Story (comments: none)

Mediainlinux

Mediainlinux, formerly known as Medialinux, has a new web site and a new version 2 release with major feature enhancements. "Changes: Mediainlinux is now OpenMosix enabled, and will be introduced at the Siggraph 2004 in Los Angeles from 10 to 12 of August. Most of the work has been derived from Cluster Knoppix, and all packages are up to date."

Comments (none posted)

New Quantian release 0.5.9.3 available

Quantian release 0.5.9.3 is available. "Quantian 0.5.9.3 adds over 360 GNU R packages from the CRAN and BioConductor archives, the GNU geda electronics design software, an almost complete debian-med suite, the complete scalapack development suite, atlas3 and lam development packages, fancy GL screensavers, lots of recommended documentation packages as well as a general update of over 300 Debian packages bringing the size of the iso to over 1.5gb corresponding to 4.4gb uncompressed."

Full Story (comments: none)

Distribution reviews

A Linux Desktop for Die-Hard Windows Users (eWeek)

eWeek reviews Xandros Desktop OS Business Edition 2.5. "Xandros comes ready to work with both NT PDC (Primary Domain Controller) domains and W2K and Server 2003 AD (Active Directory) networks. This isn't just hype. I currently run Xandros on my main laptop and a secondary workstation on my hybrid Windows network, and I have no trouble working with NT, W2K and Server 2003 drive and printer resources. You'll have endlessly more trouble trying to get XP Home working with either PDC or AD-style networks."

Comments (none posted)

Yellow Dog Linux on Power Mac G5

IBM developerWorks installs Yellow Dog Linux on a Power Macintosh G5 machine. "This article explores how to set up a dual-boot environment with Yellow Dog Linux/Y-HPC and OSX on G5 systems, including issues to watch for during installation and configuration. Note that the name of the higher performance distribution we are using is Y-HPC; this refers currently to the beta 64-bit product and will later be used for Terra Soft's production-ready 64-bit product. The company's 32-bit product is known as Yellow Dog Linux (YDL) and, for use on G5 machines, is also considered to be in beta."

Comments (none posted)

Page editor: Rebecca Sobol

Development

Groovy, a Java-like Scripting Language

Groovy is a relatively new scripting language that resembles Java, it is built on top of the Java Virtual Machine (JVM). The main developers are James Strachan and Bob McWhirter.

One of the main features of Groovy is that it is very easy for Java programmers to learn. The Groovy FAQ explains: "One of the main design goals of Groovy is to be a scripting language for Java developers to use. So we wanted to reuse both Java's semantics and the whole set of J2SE APIs rather than introduce a port of a different language with different semantics and APIs to learn and implement/maintain."

Some of the basic features of Groovy include:

• It is a JRE-compliant scripting language.
• It is an agile development language.
• The core syntax is based on Java.
• It supports existing Java objects and libraries.
• Groovy is interpreted, compilation is performed at run time.
• It supports command line operation.
• Variables are dynamically typed.
• Tuples, lists, maps, and closures are part of the basic syntax.
• Closures are used for passing blocks of executable code.
• Regular expressions are supported with ~"..." expressions.
• Groovy provides operator overloading capabilities.

Some of Groovy's built-in components include:

• GroovyMarkup for native support of XML, HTML, SAX and other markup languages.
• The GPath path expression language.
• Support for writing Java servlets (Groovlets).
• GroovySql for working with SQL databases.
• GroovyBeans, a simplified interface to Java Beans.
• The Groovy Template Engines provide a templating framework.
• Groovy supports scripting in Ant.

Groovy is available under a BSD / Apache style license. The most recent release of Groovy is version 1.0-beta-5, it was released on May 12, 2004. The code is available for download here. Dependencies include Java 1.4, the Groovy jar, and the ASM library.

If you are interested in learning more about Groovy, take a look at Andrew Glover's introductory article on IBM's developerWorks entitled Feeling Groovy.

Comments (5 posted)

System Applications

Audio Projects

Speex 1.1.6 Released

Development version 1.1.6 of Speex, a voice codec, is out. Changes include a fixed jitter buffer, denoiser tuning, a better echo canceler, gapless playback, run-time identification of speex versions, and more.

Comments (none posted)

Database Software

IBM contributes 'Cloudscape' database

IBM has announced that it will be contributing a version of its "Cloudscape" Java relational database to the Apache Software Foundation, under the name "Derby." "Derby is a Java-based relational database with a two megabyte footprint that is fully embeddable and requires zero administration support. The software is ideal for developers, enabling them to easily build and deploy applications and workloads that do not require an enterprise-class database system." The code will be available "over the next few weeks."

Full Story (comments: 3)

PostgreSQL Weekly News

The August 1, 2004 edition of the PostgreSQL Weekly News is online with OSCon coverage and other PostgreSQL database information.

Full Story (comments: none)

Libraries

Pango-1.4.1 released

Version 1.4.1 of Pango, a library for layout and rendering of text, is out. "Pango-1.4.1 contains numerous bug fixes as compared to Pango-1.4.0, in particular for rendering of Indic languages. It also contains OpenType support for the Thai shaper."

Full Story (comments: none)

Mail Software

Bogofilter 0.92.4 is out

Version 0.92.4 of Bogofilter, a spam mail filter, is out. "Bogofilter-0.92.4 has been been promoted from "current" status to "stable" status. Since the last stable release there have been documentation updates and minor enhancements and bug fixes."

Full Story (comments: none)

Sendmail 8.13.1 is available

Version 8.13.1 of Sendmail has been announced. "It contains fixes for problems that have been found after release of 8.13.0 as well as some portability enhancements."

Comments (none posted)

Security

Secure programming with the OpenSSL API (IBM developerWorks)

Kenneth Ballard works with OpenSSL on IBM's developerWorks. "Learning how to use the API for OpenSSL -- the best-known open library for secure communication -- can be intimidating, because the documentation is incomplete. Fill in the gaps, and tame the API, with the tips in this article. After setting up a basic connection, see how to use OpenSSL's BIO library to set up both a secured and unsecured connection. And learn a bit about error detection as well."

Comments (none posted)

Web Site Development

ZopeMag Weekly News

The July 18-28, 2004 edition of the ZopeMag Weekly News is online with lots of Zope and Plone related articles.

Comments (none posted)

Desktop Applications

Accessibility

gnopernicus 0.9.7 is out

Version 0.9.7 of gnopernicus, a GNOME desktop screen reader for the visually impaired, is available with several new user interface features and capabilities.

Full Story (comments: none)

Desktop Environments

A GNOME 2.8 preview

Davyd Madeley has put up a "What's new in GNOME 2.8?" page with lots of pictures of new widgets which will appear in the next major GNOME release.

Comments (5 posted)

gnome-applets 2.7.1 released

GNOME-Applets version 2.7.1 is available. Changes include several battery applet changes, translation work, and more.

Full Story (comments: none)

KDE-CVS-Digest (KDE.News)

The July 30, 2004 issue of the KDE-CVS-Digest is online with the following content summary: "New KDE system sounds. Digikam has a histogram viewer, new camera kioslave, image editor, HSL balance correction plugin. Kexi adds two run modes; final mode and design mode. New icons for Juk, Kommander, new splash screen for KDE. Plus many bug fixes in preparation for the release."

Comments (none posted)

Electronics

Gnetman – A GNU Netlist Manipulation Library

A new release of Gnetman, dated July 30, 2004, has been released. "The gnetman project has one simple goal: Enabling interoperability between open-source EDA tools."

Comments (none posted)

Financial Applications

SQL-Ledger 2.4.1 released

Version 2.4.1 of SQL-Ledger, a web-based accounting system, has been announced. Changes include a new date selection menu for reports, bug fixes, and more.

Comments (none posted)

Games

gnome-games 2.7.6 is available

Version of 2.7.6 of gnome-games, a collection of games for the GNOME desktop, has been released. Here are the changes: "Only one new item that should grab your attention: David Bellot's pure SVG card theme. Be warned that this theme is complex and is liable to expose speed issue and rendering bugs."

Full Story (comments: none)

Mapacman 1.0 is out

Version 1.0 of Mapacman has been released on the PyGame site. "Mapacman is a multiplayer online pacman game. It requires pygame and the pyarianne packages. Arianne is a multiplayer online network engine designed for turn based and real time games."

Comments (none posted)

Creating Games with Pygame (Linux Journal)

Patrick Rutledge works with PyGame in a Linux Journal article. "Python is an excellent language for rapid application development and prototyping. With Pygame, a wrapper built around SDL, the same can be true for games. In addition, because its built on top of Python and SDL, Pygame is highly portable. The only downside is it can be too slow for some computationally intensive types of games. If your game is too slow, the particular sub-routine(s) bringing down your execution speed can be rewritten in C/C++. This article is intended to be a short introduction and by no means covers all there is to know about Pygame. Using a simple Space Invaders-type game, I present what I feel are the fundamentals of Pygame."

Comments (none posted)

GUI Packages

Gazpacho 0.3.0 announced

Version 0.3.0 of Gazpacho, a GUI builder for GTK+, is out. Changes include UI manager editor support, support for run without install, bug fixes, and more.

Full Story (comments: none)

GLib 2.4.5 released

Version 2.4.5 of GLib is available. "This is a bug fix release and is source and binary compatible with 2.4.0. The main reason for this release is a bug in the routines converting between filenames and URIs, which can cause problems when used with filenames which are not encoded in UTF-8."

Full Story (comments: none)

Gtk2-Perl 2.7.90 released

Version 2.7.90 of Gtk2-Perl, the Perl bindings for GTK+, is available.

Full Story (comments: none)

Interoperability

Wine Traffic

The July 30, 2004 edition of Wine Traffic is out with the latest Wine (Wine Is Not an Emulator) news.

Comments (2 posted)

Multimedia

GStreamer Plugins 0.8.3 released

Version 0.8.3 "Water" of the GStreamer Plugins are out with lots of bug fixes and improved translations.

Full Story (comments: none)

Music Applications

Rosegarden-4 0.9.9 released - now officially in beta!

Beta release 0.9.9 of Rosegarden-4, an audio/MIDI sequencer, is out. "This release is feature complete for 1.0 and marks the start of official beta testing."

Full Story (comments: none)

News Readers

Liferea 0.5.2c announced

Version 0.5.2c of Liferea, the Linux Feed Reader, is out with bug fixes and an updated Czech translation.

Full Story (comments: none)

Office Applications

gcalctool v4.4.16 released

Stable version 4.4.16 of gcalctool, the default GNOME desktop calculator, is out. This is the third in a series of bug-fix releases this week.

Full Story (comments: none)

Office Suites

OpenOffice.org Newsletter

The July, 2004 OpenOffice.org Newsletter is out with lots of new information on the OpenOffice.org office suite.

Full Story (comments: none)

RSS Software

BLAM! 1.2.1 released

Version 1.2.1 of BLAM!, an RSS reader, is available. "Some people reported having problems with finding the default values in GConf which caused BLAM! to not start properly. This release should fix that".

Full Story (comments: none)

Web Browsers

Firefox, Thunderbird, and Mozilla releases

MozillaZine reports that Firefox 0.9.3, Thunderbird 0.7.3, and Mozilla 1.7.2 have been released. In each case, the new release contains fixes for a set of recently discovered security issues.

Comments (none posted)

New Epiphany Releases

It's been a busy week for the Epiphany developers. Epiphany 1.2.7 (stable) and Epiphany 1.3.4 (development) are available.

Also, Epiphany Extensions 1.0 (stable) and Epiphany Extensions 1.1.2 (development) have been released.

Comments (none posted)

Independent Status Reports (MozillaZine)

The August 2, 2004 Mozilla Independent Status Reports are online. "This latest set of reports includes updates from cuneAform, Flipper, MAF, JRex, MAB, Mozilla Enterprise, MozManual, and more."

Comments (none posted)

Mozilla Security Bugs Bounty Program Launched (MozillaZine)

The Mozilla Foundation has announced a Security Bug Bounty Program. "Under the new scheme, any user who reports a critical security vulnerability in end-user Mozilla software will receive a US$500 reward. The program is being funded by Linux distributor Linspire (formerly Lindows.com) and Internet entrepreneur and space tourist Mark Shuttleworth"

Comments (none posted)

Third Alpha Milestone Added to Mozilla 1.8 Cycle (MozillaZine)

A third alpha milestone is now being planned for Mozilla 1.8. "This change is intended to prevent the final 1.8 release from clashing with the launches of Mozilla Firefox 1.0 and Mozilla Thunderbird 1.0. The updated Mozilla Development Roadmap targets Mozilla 1.8 Alpha 3 for a Friday 13th August release."

Comments (none posted)

Miscellaneous

Blogfish 0.2 "Hard Core Prawn" is out

Version 0.2 of Blogfish is out with some new features. "Blogfish is a Gnome panel applet. It allows you to spread your blog URL, website URL or random thoughts to other users, with the help of tiny, internet-enabled fish. Good memes survive; bad ones are voted down and go belly up."

Full Story (comments: none)

Languages and Tools

C

GCC Newsletter

The July 29, 2004 edition of the GCC Newsletter is out with the latest discussions on the Gnu Compiler Collection.

Comments (none posted)

Caml

Caml Weekly News

The Caml Weekly News for July 27 - August 3, 2004 is available with the latest Caml language developments.

Full Story (comments: none)

Java

Keeping Up with the Java Joneses (O'ReillyNet)

Ian F. Darwin looks at Java 1.5 on O'Reilly. "Ian Darwin covers a variety of new Java 1.5 features, including J2SE 1.5 threading, the return of printf, and the IDEs NetBeans and Eclipse. Ian wraps up this article with resources to help you keep up with the rest of the Java Joneses."

Comments (none posted)

Perl

This Week on perl5-porters (use Perl)

The July 26 - August 1, 2004 edition of This Week on perl5-porters is online with the latest Perl 5 development news.

Comments (none posted)

PHP

PHP Weekly Summary for August 2, 2004

The PHP Weekly Summary for August 2, 2004 is out. Topics include: 5.0.1 ahead, segfault reports, PHP 5 installer, sort() behaviour, Java extension, splitting the atom, and fstat caching.

Comments (none posted)

Python

python-dev Summary

The python-dev Summary for July 1-15, 2004 is available with news of the latest Python language developments.

Full Story (comments: none)

Dr. Dobb's Python-URL!

Dr. Dobb's Python-URL! for August 2, 2004 is available. Take a look for dozens of Python language articles and resources.

Full Story (comments: none)

A look at DParser for Python (IBM developerWorks)

David Mertz investigates DParser on IBM's developerWorks. "Get an introduction to DParser, a simple but powerful tool for parsing, written by J. Plevyak. Then learn about DParser for Python, which gives Python programmers a seamless interface to DParser, and see how it compares to other parsers covered in previous installments. In a manner similar to Spark or PLY, grammar rules are input to DParser using Python function documentation strings."

Comments (none posted)

Tcl/Tk

Dr. Dobb's Tcl-URL!

The August 2, 2004 edition of Dr. Dobb's Tcl-URL! is online with the week's Tcl/Tk article links.

Full Story (comments: none)

XML

Decomposition, Process, Recomposition (O'Reilly)

Uche Ogbuji comments on ways to deal with potential XML problems. "The most common effect of this lack of attentiveness often leads people to very dangerous practices such as acting as if XML is an ASCII or even byte-oriented format. I have warned sharply about the ugly effects of such confusion in a few previous articles in this column. Another common effect I've seen is the tendency to create multi-megabyte or even gigabyte monolithic XML files. XML is so flexible for data representation because of its nature as an annotated hierarchy. But this very nature also makes efficient processing quite difficult, especially with regards to scaling according to number of nodes."

Comments (none posted)

XML-Java Data Binding Using XMLBeans (O'ReillyNet)

Hetal C. Shah explores XMLBeans on O'Reilly. "XMLBeans, currently in the Apache incubation process, is a promising framework for providing XML/Java data binding unmarshalling well-formed XML into Java objects, and marshalling Java objects into XML files."

Comments (none posted)

Improve performance in your XML applications, Part 2 (IBM developerWorks)

Elena Litani and Michael Glavassevich continue their IBM developerWorks series on XML performance with part two. "In this installment of a three-part series describing best practices for writing XML applications, authors Elena Litani and Michael Glavassevich explain how to improve your SAX and DOM applications' performance by using the Xerces2 implementation. They also include code samples to show you how to improve your application's performance by reusing parser instances."

Comments (none posted)

Caveat Incumbent (O'Reilly)

Edd Dumbill writes about XHTML and ebXML on O'Reilly's XML.com. "In this week's XML-Deviant, we take a look at two conversations on the XML-DEV mailing list that highlight XML's disruptive aspect -- more specifically, the disturbance XML can cause to the dominant incumbent in a technology area in which XML is being introduced."

Comments (none posted)

Editors

gedit 2.7.90 released

Version 2.7.90 of gedit, the GNOME text editor, has been released. Changes include bug fixes, improved translations and a new encoding selection command line option.

Full Story (comments: none)

IDEs

YaPIDE 0.1 released

Initial release 0.1 of YaPIDE (Yet Another PIC IDE) is out. "YaPIDE aims to be a fully featured Microchip PIC simulator for Linux (and probably other UNIXes). YaPIDE is a GUI only application. If you need a commandline based PIC simulator there is the excellent GPSIM. The simulator kernel currently supports the PIC 16F628." Add this to the collection of PIC tools covered in last week's development page.

Comments (none posted)

Cooking with Eclipse, Part 2 (O'ReillyNet)

O'Reilly has published part two in a book excerpt series by Steve Holzner. "In this second batch of recipes from O'Reilly's Eclipse Cookbook, find out how to connect Eclipse to a CVS repository and how to use Swing and AWT inside of SWT for Eclipse 3.0."

Comments (none posted)

Page editor: Forrest Cook

Linux in the news

Recommended Reading

Andrew Morton's Speech at OLS - Transcript (Groklaw)

Groklaw has put together a transcript of Andrew Morton's OLS keynote. Worth a look if you weren't able to be there in person.

Comments (none posted)

O'Reilly Radar: OSCON 2004 (O'ReillyNet)

O'Reilly covers the OSCON 2004 keynote by Tim O'Reilly. "Tim's remarks focused on what is currently on his radar. He discussed Internet applications and social software, and ended with the announcement that O'Reilly will be producing the third annual MySQL Conference this year in Santa Clara, California."

Some photos from the first day of the event have been published.

Comments (1 posted)

Trade Shows and Conferences

Red Hat chief calls for idealism, reform, sharing (News.com)

News.com covers the keynote by Matthew Szulik, Red Hat CEO. "In a one-hour meeting, Szulik said, Indian President A.P.J. Abdul Kalam told the Red Hat chief of his enthusiasm for boosting education in India with open-source software. But Szulik told attendees that he continues to struggle to get his own local schools even to learn how to pronounce Linux."

Comments (1 posted)

Two Degrees of Freedom (O'ReillyNet)

Here is some O'ReillyNet coverage of OSCON. "The second morning keynote at the O'Reilly Open Source Convention in Portland, Oregon began with a clip from Star Trek: The Next Generation. George Dyson had brought the segment to introduce his father Freeman Dyson. The audience watched both the screen and the reaction of the elder Dyson to the Star Trek plot, which centered on the discovery of a Dyson Sphere..."

O'ReillyNet also has the inevitable OSCON photos available.

Comments (none posted)

OSCON highlights new kind of community, componentized Linux, and GNOME desktop (NewsForge)

Here's some OSCON coverage from NewsForge. "Talk of a new type of software development community that spills into more traditional communities such as towns, churches and country clubs was matched with a new kind of pick-and-choose, componentized Linux distribution, and renewed efforts to push Gnome to desktop success at OSCON's second to last day."

Comments (4 posted)

Sun To Demo SunRay Linux at LinuxWorld (eWeek)

eWeek takes a look at Sun's LinuxWorld offerings. "Sun Microsystems Inc. will demonstrate a new version of its SunRay thin-client computing technology for Linux at this week's LinuxWorld conference here. The company is also announcing the release of its C, C++ and Fortran development tools for Linux."

Comments (none posted)

KDE at USENIX 2004 Annual Technical Conference (KDE.News)

KDE.News covers the recent USENIX Annual Technical Conference in Boston. "The conference also featured a lot of other interesting talks. To name only a few: Matthias Ettrich presented the technical changes in Qt 4, in the plenary session Bruce Schneier held a thought-inspiring talk about how security-tradeoffs influence our lives and how we might be able to handle this in a sensible way and Rob Pike gave some insight in the amazing technology Google uses to power their search engine."

Comments (none posted)

The SCO Problem

New date for SCO v IBM hearing (Register)

The SCO vs IBM motion hearing has been delayed until September 15, according to the Register. "A new court date has been set for the SCO v IBM motion hearing. Originally scheduled for 4 August, the hearing has been moved to 2pm on 15 September. Coming after eighteen months of legal wrangling, the September hearing will be a defining moment in the dispute, with SCO having by far the most to lose."

Comments (none posted)

SCO tries to revive Unix System Labs name (LinuxWorld)

LinuxWorld reports on SCO's attempt to register the "Unix System Laboratories" trademark. "The Open Group, a San Francisco consortium that owns the trademark to the term Unix, claims that registering the name Unix System Laboratories would not only conflict with the Open Group's Unix trademark but would also violate a license between SCO and the Open Group, which allows SCO to use the term Unix. 'We'll be taking the issue up with the Patent and Trademark Office and objecting strenuously, and we'll be taking the issue up with SCO because it's a breach of the license they already hold with us,' said Graham Bird, vice president of marketing with the Open Group."

Comments (4 posted)

SCOForum 2004 - Day 2 (Groklaw)

For all of you who wish you could be at SCOForum, Groklaw has a lengthy summary of reports from the second day there. "What I gather from reading between the lines of reports in the media and general feedback is that they seem to have gotten a clue they are unlikely to win in the courts, and so they are trying to get the world to forget the litigation and see them as a Unix company with a future instead. They don't 'need' to sue any more customers at this time, they are saying. I guess that means, if you buy their new products, they won't sue you like they sued IBM, AutoZone and DaimlerChrysler. Not at this time." Our buddy Rob Enderle apparently spoke on "free software and the fools who use it."

Comments (none posted)

Fun with SCO headlines

Here's a small set of SCO articles, mostly reporting from SCOForum. There's little there which isn't better expressed in Groklaw's summary, but the headlines tell a lot about how the company is perceived at this point.

• SiliconValley.com: SCO chief winning his battle with reality.
• The Register: Neutered SCO no longer on the offensive. ("Somebody get Mr. Clean a Viagra. This is a clear case of depression caused by premature indemnification.")
• TechWorld: Linux is mine, all mine, cackles distracted SCO head.

...and so on. SCO used to get a free ride in the media, but those days would appear to be done.

Comments (2 posted)

Companies

Dell Releases New Linux Workstations (Internetnews.com)

Internetnews.com reports that Dell is selling two new 64 bit machines with Red Hat Enterprise Linux 3 installed. "Dell is jumping on Intel's Extended Memory 64-bit Technology (EM64T) bandwagon pretty hard these days, but it is really moving product with the help of Linux. The Round Rock, Texas-based computer maker listed two new workstations at its online store Wednesday. The Dell Precision 470n and 670n workstations run on Intel's latest Xeon Nocona processors with its coordinating Tumwater chipset."

Comments (3 posted)

HP beefs up Linux portfolio (vnunet)

Vnunet covers HP's LinuxWorld announcements. "The vendor will expand its thin client t5000 desktop workstation range into Linux territory for the first time, and will extend support for Linux on Integrity servers configured beyond four-way and open out its reference architecture to include open source software."

Comments (none posted)

IBM to make Java database open source (News.com)

News.com covers IBM's plans to create an open source project around Cloudscape, a specialized Java database. "Cloudscape is a niche product in IBM's overall data information line and has tiny market share compared with its multibillion-dollar DB2 franchise. IBM has used Cloudscape as an embedded data store as part of its Workplace desktop application line."

Comments (none posted)

IBM pledges no patent attacks against Linux (News.com)

News.com reports from a LinuxWorld speech by an IBM executive. "'IBM has no intention of asserting its patent portfolio against the Linux kernel, unless of course we are forced to defend ourselves,' said Nick Donofrio, senior vice president for technology and manufacturing, drawing applause in a speech at the LinuxWorld Conference and Expo." It's not the strongest statement one could hope for, but it is a step in the right direction.

Comments (8 posted)

Novell to debut server Linux update (News.com)

News.com takes a look at Novell's plans to release SuSE Linux Enterprise Server 9. "The server Linux update will incorporate the new 2.6 kernel at its heart, sources said. Although Novell has already launched a version of Linux that uses the kernel, SLES is a flagship edition that comes with extensive support and partnerships with software and hardware companies."

Comments (none posted)

Sun mulls buying Novell (News.com)

News.com has picked up a rumor that Sun Microsystems is toying with the idea of buying Novell. ""With our balance sheet, we're considering all our options," Sun Chief Operating Officer Jonathan Schwartz said in an interview Sunday regarding the possibility of acquiring Novell. "What would owning the operating system on which IBM is dependent be worth? History would suggest we look to Microsoft for comparisons.""

Comments (16 posted)

Linux Adoption

Bread, milk and a Linux PC (ZDNet)

ZDNet France finds Mandrakelinux at the grocery store. "Called "Compubox" by the supermarket, the PC is available from Carrefour's Internet site to shoppers from France, Belgium, Luxembourg and Monaco, with the machines rumored to be sold in one or two Carrefour stores beginning in August."

Comments (1 posted)

Linux at Work

Open Source and NASA's Mars Rover (O'Reilly)

Ann Barcomb examines the use of open-source software in NASA's Mars Rover program. "In addition to this cornucopia of Java, applications such as MySQL, Linux, CVS, and Emacs reduced the workload of the team. Open source software (OSS) was vital to the success of the project because it conserved team resources. In combination with commercial, off-the-shelf (COTS) hardware, open source software reduced costs, simplified the overall system design, and allowed access to outside experts."

Comments (1 posted)

Interviews

OSDL woos end users and ISVs (vnunet)

Vnunet interviews OSDL's William Weinberg. "What are we likely to see coming out of OSDL in the near future?
More aggressive recruiting, and increasing the number of end-user companies that are members. A number of financial institutions and other vertically focused companies have announced their membership. Lots of companies want to come to the table but some of them are reluctant to publicise their membership or otherwise publicise their Linux adoption."

Comments (none posted)

Resources

Connect KDE apps using D-BUS (IBM developerWorks)

IBM developerWorks connects applications with D-BUS. "The typical desktop has multiple applications running, and they often need to talk to each other. DCOP is a solution for KDE, but it is tied to Qt, and so is not used in other desktop environments. Similarly, Bonobo is a solution for GNOME, but it is quite heavy, being based on CORBA. It is also tied to GObject, so it is not used outside of GNOME. D-BUS aims to replace DCOP and Bonobo for simple IPC and to integrate these two desktop environments. Because the dependencies for D-BUS are kept as small as possible, other applications that would like to use D-BUS don't have to worry about bloating dependencies."

Comments (15 posted)

Plug OpenOffice.org into PostgreSQL (NewsForge)

NewsForge makes a connection between a PostgreSQL database and OOo. " Setting up the connection is pretty easy: just download the driver and configure a few things. You'll be able to connect with both Writer and Calc. I'll cover connecting with the word processor, using a PostgreSQL database that I had on my laptop. You can apply the same procedure for Calc."

Comments (none posted)

Windows, Linux grapple in Great Gadget Smack-Down! (LinuxDevices)

LinuxDevices is running a comparison of embedded Linux and Windows on real-world devices. "We therefore have decided to hold the first-ever "Great Gadget Smack-Down," pitting OS vs. OS. Not on paper, according to oft-conflicting market share estimates, feature and architecture claims, or purported time-to-market benefits -- but instead, where it really counts: based on which OS powers the coolest and best gadgets."

Comments (none posted)

Reviews

Four alternative Linux window managers (NewsForge)

NewsForge looks at AfterStep, Enlightenment, IceWM, and FVWM. "KDE and GNOME combine window managers with suites of applications to create comprehensive work environments. As complete as they are, it's easy to forget that there are other graphical ways to work on a Linux desktop. Sometimes a lighter-weight window manager is in order, such as for laptop usage, children's use, or quick startup applications. Here are four "alternative" window managers that are mature, fast, and functional."

Comments (16 posted)

Miscellaneous

Linux Scare Tactics (Forbes)

Here's a Daniel Lyons piece in Forbes with a rather cynical view of the OSRM's report on possible patent issues in the Linux kernel. "Linux advocates howl that SCO is running a shakedown racket. They point out that SCO still won't say which parts of Linux contain stolen SCO code, nor will SCO name Linux users it claims are paying license fees to SCO. Similarly, OSRM says there are 283 patents that Linux may violate, but won't say what those patents are. (OSRM says it will tell customers who insist, but warns this could make customers vulnerable to claims of 'willful infringement,' which could lead to triple damages.)"

Comments (33 posted)

Page editor: Forrest Cook

Announcements

Non-Commercial announcements

Mozilla Foundation Looking for Volunteers (MozillaZine)

The Mozilla Foundation is looking for volunteers to help get Firefox 1.0 on computing magazine CDs.

Comments (none posted)

Commercial announcements

Press releases from LinuxWorld

LinuxWorld is in full swing at the Moscone Center in San Francisco, with the usual flurry of press releases. Here are a few of the announcements we've seen today:

• The Eclipse Foundation has announced the creation of a Test and Performance Tools Platform Top Level Project.
• Netline Internet Service has announced it will release its Open-Xchange Server under the GNU General Public License.
• The Gelato Federation has joined the Free Standards Group and ported Eclipse 3.0 to Linux-Itanium.
• Wyse Technology has announced a thin client based on the 2.6 kernel, the company has joined OSDL and the company is collaborating with AMD to provide the AMD Geodeprocessor in its Linux-based thin client devices.
• RealNetworks has announced the final GOLD versions of RealPlayer 10 for Linux and Helix Player.

Comments (1 posted)

Culled from the LinuxWorld flood

LinuxWorld has once again proven itself to be second to none for the generation of press releases. Here are a few of today's offerings:

• Novell has announced SUSE LINUX Enterprise Server 9 which will include the JBoss Application server. Novell has also announced new partner initiatives.
• Pen&Internet has released riteForm, an advanced recognition solution for processing handwritten forms and notes on mobile pen-enabled devices on Linux.
• VERITAS Software a new member of OSDL, showcases its Linux offerings.
• BEA Systems, Inc. touts the wonders of Apache Beehive.
• Open Country is focused on managing the Linux-powered enterprise. The company is working with Progeny to provide customers with legacy Red Hat system updates.
• MySQL AB and MontaVista Software announced an extended partnership.
• CodeWeavers shows off the iTunes support to be included in the next release of CrossOverOffice.
• Penguin Computing joined PathScale's FastPath(TM) Partner program.

Comments (none posted)

A selection from the PR flood

The LinuxWorld press release machine continues to crank out the hype. Here is a subset of what the corporate world would like us to know:

• Aduva has released "OnStage 2.2," a Linux system deployment and management utility.

• Computer Associates has announced the release of the Ingres database under the "CA Trusted Open Source License," and a $1 million offer for developers who "create solutions that enable users of Oracle, Microsoft SQL Server, Sybase Adaptive Enterprise Server, IBM DB2 Universal Database, Informix and/or MySQL to migrate to the Ingres r3 database platform."

• Covalent Technologies has contributed its ASP.NET module to the Apache Software Foundation.

• HP has announced a Linux-based notebook system, Linux on its "Integrity Superdome" servers, an impending EAL 3+ certification for its systems, and a set of "reference architecture solution stacks."

• MySQL AB has a new set of "enterprise-class" technical support offerings.

• Network Appliance has announced support for SUSE Linux Enterprise Server 9.

• Pogo Linux is offering an AMD64-based notebook system with Linux installed.

• Red Hat and Black Duck Software have some sort of joint offering which will let companies monitor licensing compliance when developing with free software.

• Red Hat has made its "Red Hat Application Server" product available.

• Sun Microsystems has augmented Solaris 10 with "Project Janus," a feature which allows Solaris to run Linux binaries.

Comments (none posted)

Linare Offers Professional Edition

Linare Corporation has announced availability of the Linare Linux Professional Edition distribution. "Features include a user-friendly installer, advanced User Interface with new theme, reliable Linux kernel v. 2.6, KDE 3.2.2 graphical desktop environment, Open Office, Evolution Email and other utilities. Professional edition includes one year of phone and email support."

Full Story (comments: none)

MySQL AB Launches MySQL Hosting Powered by Rackspace

MySQL has announced that it is working with Rackspace to provide a MySQL database hosting service. "MySQL Hosting is provided in partnership with Rackspace, the fastest-growing managed hosting specialist in the world. Designed for Web sites and other MySQL database applications, MySQL Hosting provides a secure, scalable hosting environment with a 99.9 percent uptime guarantee, along with a commercial MySQL license and technical support."

Comments (none posted)

Red Flag announces an Intel-compiled distribution

Red Flag has announced the availability of a version of its distribution built with Intel's proprietary compiler. The distribution comes with a "60-day evaluation copy" of the compiler as well.

Comments (15 posted)

Unisys Delivers Industrial Strength Linux

Unisys Corporation has announced the availability of Linux on the company's ES7000 servers. Unisys is working with Novell, Inc. and Red Hat, Inc. to provide the business, government and scientific communities with services and support for Linux-based solutions.

Full Story (comments: 5)

Enea Embedded Technology Announces Enea Orchestra

Enea Embedded Technology has announced their Enea Orchestra Distributed Systems Platform and Development Environment.

Comments (none posted)

New Books

"Perl 6 and Parrot Essentials" Released by O'Reilly

O'Reilly has published the book Perl 6 and Parrot Essentials by Allison Randal, Dan Sugalski, and Leopold Totsch.

Full Story (comments: none)

"Learning PHP 5" Released by O'Reilly

O'Reilly has published the book Learning PHP 5 by David Sklar.

Full Story (comments: none)

Resources

Paul Graham on great hackers

Paul Graham has posted an essay on "great hackers," derived from his OSCON keynote. "When you decide what infrastructure to use for a project, you're not just making a technical decision. You're also making a social decision, and this may be the more important of the two. For example, if your company wants to write some software, it might seem a prudent choice to write it in Java. But when you choose a language, you're also choosing a community. The programmers you'll be able to hire to work on a Java project won't be as smart as the ones you could get to work on a project written in Python. And the quality of your hackers probably matters more than the language you choose. Though, frankly, the fact that good hackers prefer Python to Java should tell you something about the relative merits of those languages."

Comments (35 posted)

OSRM does a kernel patent review

Open Source Risk Management, the company selling litigation insurance policies for Linux users, has announced the results of a review of patents potentially affecting the Linux kernel. This review was done by Dan Ravicher of the Public Patent Foundation. "In conclusion, he found that no court-validated software patent is infringed by the Linux kernel. However, Ravicher also found 283 issued but not yet court-validated software patents that, if upheld as valid by the courts, could potentially be used to support patent claims against Linux. In response, OSRM will be expanding its risk mitigation and insurance offerings to cover this quantifiable risk."

Comments (3 posted)

PHP Tunisie

The php.net site mentions a new French language PHP magazine from Tunisia, PHP Tunisie. "PHP Tunisie has just released the second issue of its monthly french PHP Magazine. In this issue you'll find a large plan on PostgreSQL, Databases abstractions with PHP, your mini template engine, an article on images generation with PHP, the migration towards PHP5 with EasyPHP1.7... And many other articles and latests PHP news."

Comments (none posted)

Giving Lightning Talks (O'Reilly)

Mark Fowler gives some tips on presenting lightning talks. "Lightning talks are a great way to start speaking, but they do come with their own potential problems. Even the seasoned presenter makes mistakes when presenting and has had lightning talks go horribly, horribly wrong. Luckily, Perl audiences are very forgiving when this happens — after all, it's happened to half the audience at sometime too, so it's nothing to get too worked up about. However, there are a few things you can consider when writing your talk that will prevent you from sabotaging your own talk before it even begins."

Comments (none posted)

Contests and Awards

2004 Editors' Choice Awards (Linux Journal)

The winners of Linux Journal's 2004 Editors' Choice Awards have been published. LWN.net even makes a cameo appearance this time around.

Comments (1 posted)

2004 White Camel Award Winners (use Perl)

Use Perl has posted an announcement for the winners of the 2004 White Camel Award. Jon Orwant, Brian d Foy, and Dave Cross have received the honors.

Comments (none posted)

Event Reports

Notes from OSCON

Danny O'Brien (of NTK fame) has posted an extensive series of notes from OSCON. Worth a read. "Parrot licensing will cast you all into hell, he tells the audience, and lo they are sore afraid. Go ye through the Parrot source, and stick there proper copyright notices. Don't put 'all rights reserved', on fear of your mortal soul, because that the Lord RMS doth not think that it doth mean what thou thinkest it means. Put it instead under the GPL or the Artistic License. But don't put it under the Artistic License, put it under the Clarified Artistic License, for the Artistic License as it stands is sorely artistic, and lo it is ambiguous in many areas. And Brad Kuhn did come down from on high and suggest that the CAL be the license for Perl6, and he spake truth, for ye will be sent to Hell if you do not heed him! For he is the prophet of RMS, and the one who is to come that is greater, who is known as Hurd, and whose todo list is legion. (I am paraphrasing a fair bit here)."

Comments (1 posted)

FSMSI 2004 Proceedings available

Slides and audio recordings from the European seminar on Free Software for Multimedia Streaming over the Internet are available online. The event took place in Paris, France on June 23 and 24, 2004.

Full Story (comments: none)

Proceedings of lightning talks from LSM 2004 Lisp track

The Lisp track lightning talk proceedings from the Libre Software Meeting 2004 are online.

Full Story (comments: none)

Upcoming Events

Talk on Developing Hypermedia Applications with Mozilla (MozillaZine)

Andy Edmonds has announced his tutorial on Developing Hypermedia Applications with Mozilla. It will take place on August 9, 2004 in Santa Cruz, CA at the ACM Hypertext conference. "In addition to a wide survey of Mozilla technologies I'll be digging deep into powerful constructs like compound documents, combining SVG and XBL, and monitoring browser events. Myk Melez and Chris Aillon will be joining me to dig deeper into Mail and XPCOM."

Comments (none posted)

O'Reilly and MySQL AB to Co-Present 2005 MySQL Users Conference

O'Reilly has announced that it will co-present the 2005 MySQL Users Conference along with MySQL AB. The event will take place in Santa Clara, CA on April 18-21, 2005.

Full Story (comments: none)

Events: August 5 - September 30, 2004

Date	Event	Location
August 5, 2004	LinuxWorld Conference & Expo	(Moscone Center)San Francisco, California
August 5 - 8, 2004	UKUUG 2004 Linux Technical Conference	Leeds, England
August 21 - 29, 2004	KDE Community World Summit 2004(aKademy)	(Filmakademie Ludwigsburg)Ludwigsburg (Stuttgart Region), Germany
September 2 - 3, 2004	Python for Scientific Computing(SciPy)	(CalTech)Pasadena, CA
September 2 - 4, 2004	2nd Swiss Unix Conference	(Technopark)Zurich, Switzerland
September 9 - 10, 2004	Linux Expo Shanghai	(Shanghai Exhibition Center)Shanghai, China
September 13 - 16, 2004	Embedded Systems Conference	(Hynes Convention Center)Boston, MA
September 15 - 17, 2004	YAPC::Europe 2004	Belfast, Northern Ireland
September 20 - 23, 2004	New Security Paradigms Workshop(NSPW)	(White Point Beach Resort)Nova Scotia
September 20 - 22, 2004	Plone Conference 2004	Vienna, Austria.
September 22 - 24, 2004	OpenOffice.org Conference(OOoCon 2004)	(Humboldt University)Berlin, Germany
September 22 - 24, 2004	php|works 2004	(Holiday Inn Yorkdale Hotel & Conference Centre)Toronto, Canada
September 27 - October 1, 2004	4th International SANE Conference(SANE)	(Amsterdam RAI Centre)Amsterdam, The Netherlands
September 27 - 29, 2004	ConSec '04	(J.J.Pickle Research Center)Austin, Texas
September 29 - October 1, 2004	OSCOM 4	(Swiss Federal Institute of Technology)Zurich, Switzerland

Comments (none posted)

Web sites

Four New Mozilla Sites Launch (MozillaZine)

MozillaZine has announced the launching of four new web sites: the Mozilla AOM Reference, The Rumbling Edge weblog, the Mozilla Network, and Firedfox, a parody site.

Comments (none posted)

Software announcements

This week's software announcements

Here are the software announcements, courtesy of Freshmeat.net. They are available in two formats:

• Sorted alphabetically,
• Sorted by license.

Comments (none posted)

Page editor: Forrest Cook