From a Red Hat security advisory: “A vulnerability has been found in the ptrace code of the kernel (ptrace is
the part that allows program debuggers to run) that could be abused by
local users to gain root privileges.”

Linus releases the latest kernel prepatch; changelog below. Download from your favorite mirror site.

pre5:
                   - Greg KH: usbnet fix
                   - Johannes Erdfelt: uhci.c bulk queueing fixes

                  pre4:
                   - Al Viro: mnt_list init
                   - Jeff Garzik: network driver update (license tags, tulip driver)
                   - David Miller: sparc, net updates
                   - Ben Collins: firewire update
                   - Gerd Knorr: btaudio/bttv update
                   - Tim Hockin: MD cleanups
                   - Greg KH, Petko Manolov: USB updates
                   - Leonard Zubkoff: DAC960 driver update

                  pre3:
                   - Jens Axboe: clean up duplicate unused request list
                   - Jeff Mahoney: reiserfs endianness finishing touches
                   - Hugh Dickins: some further swapoff fixes and cleanups
                   - prepare-for-Alan: move drivers/i2o into drivers/message/i2o
                   - Leonard Zubkoff: 2TB disk device fixes
                   - Paul Schroeder: mwave config enable
                   - Urban Widmark: fix via-rhine double free..
                   - Tom Rini: PPC fixes
                   - NIIBE Yutaka: SuperH update

                  pre2:
                   - Alan Cox: more merging
                   - Ben Fennema: UDF module license
                   - Jeff Mahoney: reiserfs endian safeness
                   - Chris Mason: reiserfs O_SYNC/fsync performance improvements
                   - Jean Tourrilhes: wireless extension update
                   - Joerg Reuter: AX.25 updates
                   - David Miller: 64-bit DMA interfaces

                  pre1:
                   - Trond Myklebust: deadlock checking in lockd server
                   - Tim Waugh: fix up parport wrong #define
                   - Christoph Hellwig: i2c update, ext2 cleanup
                   - Al Viro: fix partition handling sanity check.
                   - Trond Myklebust: make NFS use SLAB_NOFS, and not play games with PF_MEMALLOC
                   - Ben Fennema: UDF update
                   - Alan Cox: continued merging
                   - Chris Mason: get /proc buffer memory sizes right after buf-in-page-cache

Commentary from Gartner’s Richard Stiennon: “[Microsoft security manager Scott Culp’s] attempt to
blame “information security professionals” for the recent spate of
vulnerabilities in Microsoft products is at best disingenuous.
Perhaps, it also represents an attempt to deflect criticism from the
company that built those products.” From CNET News.com.

Linux Weekly News posts Conectiva’s apache advisory. Updates are available to fix the following problems: “A intentionally malformed Host: header could allow any file with
a .log extention to be overwritten due to a problem in the
split-logfile script.” … “When Multiviews are used to negotiate the directory index, under
certain conditions a request for the URI /?M=D could return a
directory listing rather than negotiated content.”

– By Dan Berkes –
Quarterly earnings announcements from Sun, IBM, and Apple this week helped the tech sector, not to mention the rest of the market, lurch slightly ahead this Friday. Also: Apple gets sued for not selling enough computers, and TiVo inks a deal to put digital recorders in Sony’s consumer electronics.The major U.S. indexes moved ahead for the close of business on Friday, but closed slightly downward from the end of the previous week’s trading. The Dow ones Industrial Average rose 38.30 points Friday to close out the week at 9.204.11, down 140 from last Friday’s close at 9,344.16. The Nasdaq composite inched up 18.11 points, closing out the week at 1,671.31, down 32 from last Friday’s close of 1,703.40.

Concerns over the nation’s ability to withstand a bioterrorism attack continued this week, with investors nervous over the latest news of Anthrax detected in New Jersey postal workers and an employee at CBS News. Also contributing to a trading day analysts said could have been better was the news that U.S. forces are on the ground in Afghanistan.

Running the numbers
Those reactions, however, were muted by the big announcements in the tech business this week. Earnings announcements from major players in the U.S. technology markets were released this week, and even if the results were mixed, investor enthusiasm was not. Virtually every company listed, however, said the Sept. 11 events had a significant impact on quarterly results.

• Apple Computer announced its fiscal 2001 fourth quarter results, posting a net profit of $66 million, or 19 cents per share, a 61 percent drop from 2000’s fourth quarter profits of $170 million and 47 cents per share. Revenues were $1.45 billion for the quarter, 22 percent less than fourth quarter 2000. Apple reported a net loss of $25 million on revenues of $5.36 billion for the year. In related news Apple CFO Fred Anderson said his company would likely report a small loss for its budding retail empire, rather than the break-even results it wanted.

• IBM announced its third-quarter earnings, reaping $1.6 billion or 90 cents per share on total revenues of $20.4 billion, beating most analysts’ expectations. Earnings were on the decline, however, losing 17 percent from third quarter 2000 when the company reported $2 billion in earnings (1.08 per share) on revenues of $21.78 billion. Consulting and outsourcing services, along with increased hardware sales undoubtedly fueled by Big Blue’s $1 billion Linux investment, seem to have contributed nicely to the bottom line.

• Red Hat Inc. filed its 10Q this week, divine the numbers as needed. From the report: “Total revenue decreased 15.7% to $21.1 million in the three months ended August 31, 2001 from $25.1 million in the three months ended August 31, 2000. Revenue from international operations totaled $5.0 million during the three months ended August 31, 2001 as compared to $3.6 million for the three months ended August 31, 2000.

• Sun Microsystems on Thursday posted a $158 million net loss, or 5 cents per share, for its first 2002 fiscal quarter. Revenues were $2.86 billion, down 43 percent from the same period last year.

TiVo signs up Sony
Linux digital video recorder maker TiVo this week licensed its technology to Sony Corp. The agreement will allow Sony to use TiVo’s personal video recording technology in a wide array of consumer electronics devices ranging from television sets to the next-generation PlayStation.

Apple gets sued
Legal eagles Millberg Weiss has filed a class action lawsuit against Apple Computer on behalf of an institutional investor. According to the lawsuit, Apple claimed that new computer designs, including the G4 Cube and upgraded iMacs, would result in Apple achieving strong revenue and earnings per share growth in its fourth quarter for 2000. Revenue and earnings actually declined for that period.

A class period for a lawsuit was filed by attorneys at Charles J. Piven, also alleging violations of federal securities laws. Piven’s press release doesn’t give details about its complaint with Apple, but the stock purchase dates to qualify for class inclusion are similar to Millberg Weiss.

Investor urges H-P, Compaq to abandon merger
New York investment firm Matrix Asset Advisor sent a letter to the boards of Hewlett-Packard and Compaq last week asking them to abandon their planned $19.7 billion merger. The letter apparently echoes the comments made by financial analysts who have said they don’t think it offers enough strategic advantages, and that the risks of alienating customers and losing sales are too high. Matrix says it owns 531,675 shares of H-P and 826,846 shares of Compaq. The letter prompted renewed speculation that angry shareholders — who have yet to vote on the merger — may try to scuttle the deal.

Survey says: Borland number one in Linux development
Borland Software couldn’t help but brag about it. According to a recently concluded Evans Data Corporation development survey, its Borland Kylix rapid application development tool was ranked as the most-used integrated development environment by Linux developers. Borland’s spin on the results says that the company is winning over Windows developers who previously considered Linux development tools to be “primitive.”

Caldera International did its bit to spread the Kylix gospel this week, rolling out a press release trumpeting Borland’s certification of Kylix 1 with Caldera’s OpenLinux Workstation 3.1.1. Certification should be beneficial to the Linux product lines of both companies.

Here’s how selected Open Source and related stocks closed this week:

Company Name	Symbol	10/19 Close	10/12 Close
Apple	AAPL	18.30	18.01
Borland Software Int’l	BORL	11.30	10.40
Caldera International	CALD	0.30	0.30
Hewlett Packard	HWP	18.27	18.35
IBM	IBM	102.65	100.84
MandrakeSoft	4477.PA	e2.61	e3.10
Red Hat	RHAT	3.99	3.94
Sun Microsystems	SUNW	8.83	10.04
TiVo	TIVO	5.65	3.80
VA Linux Systems	LNUX	1.29	1.11
Wind River Systems	WIND	14.65	14.56

Linux Weekly News posts the Debian advisory for gftp: “Version 2.0.6a of gftp displays the
password in plain text on the screen within the log window when it is
logging into an ftp server. A malicious collegue who is watching the
screen could gain access to the users shell on the remote machine.

This problem has been fixed by the Security Team in version 2.0.6a-3.2
for the stable Debian GNU/Linux 2.2.

We recommend that you upgrade your gftp package.”

Anonymous Reader writes “MP3 Newswire has posted the essay that ‘Beale Screamer’, the coder who claims to have broken the Version-2 Microsoft digital rights management (DRM) scheme, included with the download of the command-line utility he created. It is well written and a compelling read.”

It’s at ApacheWeek. Among the items: ”

The last fortnight has seen a high volume of traffic concerning input filtering in 2.0, particularly regarding mod_ssl. Although
the debate became heated at times, some changes to the bucket brigade interface were eventually decided upon.

This week the Apache HTTP Test suite was exercised against Apache 2.0; after enough bugs were fixed that all the tests
passed, the tree was tagged in preparation for a new release, 2.0.26.”

It’s posted at LWN.net. Among the items: “DotGNU Portable.NET:
This part of DotGNU contains a C# compiler, runtime engine, and
related tools. There is as always good, steady progress.”

“The world’s dominant software company is not making it any easier to draft an already squeezed state budget, officials say.

Microsoft Corp’s plans to change its licensing agreements, and higher fees are expected to drive up the cost of keeping the state’s computer systems running.

No firm figures are available, but a ballpark estimate puts the additional cost at $15 million a year, officials said.” More at the Wichita Eagle.