Author: JT Smith
Category:
- Open Source
Author: JT Smith
Category:
Author: JT Smith
Category:
Author: JT Smith
Category:
Author: JT Smith
Category:
Author: JT Smith
Category:
Author: JT Smith
A buffer overflow vulnerability affecting the PPP code in the Linux kernel, Netscape and up to 20 packages in some Linux distributions has been found in the popular compression library zlib. The potential is for crackers to gain remote access to computer systems using zlib, but a fix is available.
Dave Wreski, corporate manager for Open Source security company Guardian Digital and publisher of LinuxSecurity.com, says there’s no known exploit for the vulnerability, but it’s a serious issue because of the sheer number of programs relying on zlib or a variant of it statically linked into their binaries.
“That means that you can’t just rebuild or fix zlib and then reboot the system and have it re-dynamically link against the library,” Wreski says. “You have to actually recompile the binary.”
LinuxSecurity.com has posted an article with links to security advisories and other information and an an advisory to Guardian Digital’s EnGarde Linux, including a fix for the six affected packages in EnGarde. Quoting that advisory: “The zlib shared library may attempt to free() a memory region more than
once, potentially yielding a system exploitable by certain programs that
use it for decompression. Because certain packages include their own
zlib implementation or statically link against the system zlib, several
packages need to be updated to properly fix this bug.”
Packages affected also include X11, rsync and programs that do network compression, Wreski says. Netscape includes network compression in its Navigator package.
“The potential is certainly for root compromise,” Wreski says. “Because it’s network compression, it’s conceivable that it could be a remote root exploit as well.” For example, if you were using Netscape and connected to a Web site with malicious code, you could be vulnerable, he adds.
Linux vendors and the CERT Coordination Center are working together get the word out about the vulnerability.
Category:
Author: JT Smith
Author: JT Smith
Author: JT Smith
Category:
Author: JT Smith
Browser of the year – Konqueror AND Mozilla
————————-
This was one of the closest awards. We have a dead tie between Konqueror and Mozilla, both had 21.98%. Netscape and Opera were right behind them with 19.23% and 18.68% respectivly.
Distribution of the Year – Red Hat
—————————–
Red Hat was a pretty stong winner here with 35.29%. Mandrake was not too far behind.
Database of the Year – MySQL
—————————
No surprise here. MySQL was the clear winner with 64.65%. The one surprise was that Oracle tied PostgreSQL for second.
FTP Server of the Year – ProFTPD
—————————-
ProFTPD was a solid winner in this category with 40.48%. But WU-FTPD came in second. Have a taught you nothing?
Web Server of the Year – Apache
—————————–
This was by far the most lop-sided battle. Apache came in with a whopping 96.90% of the votes. wow!
Desktop Environment of the Year – KDE
——————————————
KDE came out much stronger then I thought it would with 68.90% of the votes. Gnome was second, with my personal favorite Ximian a quite distant third.
Window Manager of the Year – Enlightenment
————————————
Another very close race. Enlightenment came out just ahead with 25.56%. Coming in a close second and third were Sawfish (21.05%) and Window Maker (20.30%).
Editor of the Year – Vim
———————-
Vim came out ahead with 34.11%. The surprise here to me was that pico got almost as many votes as Emacs.
Office Suite of the Year – Star Office
—————————–
Star Office ran away with this one with 66.67%. Koffice was a distant second with 22.50%.
Mail Client of the Year – Kmail
—————————
I think KDE (31.13%) being so popular skewed this one a little. Trusty old pine came in second (18.54%) while the very slick Evolution came in third (14.57%).
Game of the Year – Quake III
———————-
Quake III came out ahead here with 39.37%. Return to Castle Wolfenstein (26.77) was a respectable second.
Thanks again to all that voted. Time to start thinking about your nominee’s for next year.
–jeremy
LinuxQuestions.org.