Category Archives: Community

Community related news

Apache Log4j vulnerability (CVE-2021-44228)

On Thursday, December 9, 2021, the Apache Log4j project disclosed a critical security vulnerability which may result in remote code execution on systems running Log4j. The exploit has been aptly named Log4Shell (CVE-2021-44228).

Log4j is a logging component which runs under Java on many different platforms, and is useful not only for Java applications, but for other programs, as well. It is commonly bundled with unrelated software, simply as a means of providing a standard logging engine.

Arca Noae has completed a scan of our internal systems and has determined that we are not affected by this vulnerability. Further, ArcaOS has never included any Log4j components, and is also unaffected. However, because the exploitable feature in Log4j has existed for some time, it is possible that Java and other applications may have been installed under ArcaOS which utilize Log4j, and these systems may be at risk.

The feature used for the Log4Shell exploit is in the JNDI (Java Naming and Directory Interface) lookup class which was added to Log4j several years ago during the 2.0 beta cycle. Log4j versions through 2.3 required only Java versions up to 1.6, and so may be utilized by some OS/2-compatible applications.

Risk assessment

To determine whether any of your OS/2 systems may be at risk, start by searching all accessible volumes for log4j-*.jar. If any are found, determine the version of Log4j by examining the content of META-INF/MANIFEST.MF in the core jar file:

[c:\] unzip -c log4j-core.jar META-INF/MANIFEST.MF | less

Note the Implementation-Version line content.

Edge servers as well as firewalled systems running various applications may be at risk, as queries may be submitted to the Log4j engine from other applications and potentially from outside the network.

Mitigation

Although the exploit has been addressed in Log4j 2.16.0, because versions above 2.3 are not currently compatible with OS/2’s available Java Runtime Engine, it is necessary to mitigate the condition by removing the JndiLookup class from the classpath, e.g.:

[c:\] zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class

Additional information

Older (pre-2.0-beta9) versions of Log4j lack this lookup class, and do not appear to be at risk for Log4Shell (though some earlier security advisories may have been issued). Further research may be needed based upon the version(s) of Log4j which may be in use on these earlier systems. Also, this is not the only security advisory for Log4j 2.0-beta9 – 2.3. This notification is only related to CVE-2021-44228.

Links

https://nvd.nist.gov/vuln/detail/CVE-2021-44228
https://nakedsecurity.sophos.com/2021/12/10/log4shell-java-vulnerability-how-to-safeguard-your-servers/
https://www.kb.cert.org/vuls/id/930724

Arca Noae Package Manager version 1.0.7 has been released

Arca Noae is pleased to announce the immediate availability of an updated Arca Noae Package Manager for ArcaOS, OS/2, and eComStation. (1.0.7)

This is update includes several minor fixes and a few critical enhancements:

Clear repo filter when selecting Installed RPM view.
Add 30s timeout to all curl commands.
Fix parsing of package name when it contains a period.
Ensure Python 2 is always used, now that Python 3 packages may be installed.
Initial commit of Russian translation.
Detect when CONFIG.SYS is modified.
Various UI fixes and tweaks.

Arca Noae Package Manager is available in English with Spanish, French, Italian, German, Dutch, Russian, and Swedish language packs. Some of these have been refreshed for this release.

ANPM 1.0.7 requires WarpIN 1.0.24 or higher for installation. This WarpIN package is available from Hobbes.

This open source utility is available to everyone, free of charge.

Please review the wiki for important first-time installation and upgrade notes and other tips.

Adding Let’s Encrypt’s new root and intermediate certificates to Mozilla applications

On September 30, 2021, Let’s Encrypt’s DST Root CA X3 cross-sign expired, leaving many web browsers to report that sites using Let’s Encrypt SSL certificates were “untrusted” or “unknown.”

Let’s Encrypt did, in fact, implement a new root and intermediate certificates some time ago, but after the built-in certificate stores in the Mozilla applications shipped with all versions of ArcaOS 5.0 to date (5.0 through 5.0.6) were configured. Thus, these new certificates were not included in those builds, and as a result, the new root certificate is indeed unknown.

The fix is relatively simple, and a rather common procedure for all browsers and email clients. To bring your Firefox, Thunderbird, and SeaMonkey certificate stores up to date, and learn how to do this for other new certificates as they become available, we’ve added a new wiki page, here.

Edited to add links to further information (off-site):

Let’s Encrypt – Chain of Trust
Let’s Encrypt – DST Root CA X3 Expiration (September 2021)

Tune in to Warpstock 2021 Online

Warpstock 2021 will happen online at 12:00pm EDT (16:00 UTC) this Saturday, September 18.

Sessions will be a mix of live and prerecorded presentations, in 45-50-minute slots, scheduled to start on the hour.

David Azarewicz, Lewis Rosenthal, and Alex Taylor will be among those presenting this year on a variety of topics of interest concerning ArcaOS 5.0 and 5.1, device drivers, UEFI, GPT, and more.

Questions may be posed via YouTube Chat as well as IRC during the event.

The WarpEvents YouTube channel is the place to watch the event stream.

The URL for the #warpstock IRC channel is: ircs://irc.libera.chat:6697/warpstock (TLS encrypted),
or irc://irc.libera.chat/warpstock (plain text), or https://web.libera.chat/ (web interface, type #warpstock into Channel field).

The conference is entirely free this year, and no registration is necessary.

Join us for Warpstock Europe 2021 Online

Warpstock Europe 2021 will begin online at 14:00 UTC this coming Saturday, June 5. (For quick reference, that’s 10am EDT/7am PDT in the US and Canada, and 16:00 CET.)

Sessions will be a mix of live and prerecorded presentations, with the presenters available to answer questions in realtime, submitted during the event via IRC. See the Warpstock Europe website for details.

The Warpstock Europe YouTube channel is the place to watch the event stream. This channel should be viewable with any ArcaOS release, using Firefox or SeaMonkey, or any other device or OS you might want to use.

IRC Channel on Freenode: #WSE2021.

The conference is entirely free this year, and no registration is necessary.

Both Lewis Rosenthal and Alex Taylor will be among those presenting this year.

Arca Noae Package Manager version 1.0.6 has been released

Arca Noae is pleased to announce the immediate availability of an updated Arca Noae Package Manager for ArcaOS, OS/2, and eComStation. (1.0.6)

This is update includes an array of substantial enhancements:

Fixed several errors in storing and retrieving credentials for secure repositories.
Added unresolvable RPMs to deferred-package logic.
Identify secure repositories in repository manager even when disabled.
Prevent duplicate yum repository names.
Added support for updating PKGPROC.LST.
Downgrading a package now incorporates PKGPROC.LST logic.
Various UI fixes and tweaks.

Arca Noae Package Manager is available in English with Spanish, French, Italian, German, Dutch, and Swedish language packs.

ANPM 1.0.6 requires WarpIN 1.0.24 or higher for installation. This WarpIN package is available from Hobbes.

This open source utility is available to everyone, free of charge, regardless whether you have an Arca Noae software subscription or an ArcaOS license.

Please review the wiki for important first-time installation and upgrade notes and other tips.

Tune in to Warpstock 2020 Online

Warpstock 2020 will happen online at 9:00am EST (14:00 UTC) this Saturday, November 7, for those in North America and western Europe, and sessions will repeat in a second block beginning at 8:00pm EST (01:00 UTC, Sunday, November 8) for those in the Asia/Pacific region and eastern Europe. Each block should only be 3-4 hours in length.

Sessions will be a mix of live and prerecorded presentations, with the presenters available to answer questions in realtime, submitted during the event via IRC or YouTube chat.

The WarpEvents YouTube channel is the place to watch the event stream. This channel should be viewable with any ArcaOS release, using Firefox or SeaMonkey, or any other device or OS you might want to use.

IRC Channel: irc://freenode/warpstock

The conference is entirely free this year, and no registration is necessary.

Both David Azarewicz and Lewis Rosenthal will be among those presenting this year.

A brief, but very heartfelt thank-you to all of our friends

I don’t often post personal notes on the Arca Noae blog, but as I have been spending some time reviewing our sales over the past couple of months, I noticed something important, and I didn’t want this to go unmentioned.

While the world has been turned upside down for many of us, and for still others, finding new and different ways to work and to put food on the table has been challenging (not to mention staying healthy and well-distanced from COVID-19). Yet somehow, some way, quite a few ArcaOS, eCS, and OS/2 users have managed to not only renew support but to purchase additional licenses and – perhaps most importantly – purchase sponsoring units for our friends and hard-working developers.

Make no mistake, the whole Arca Noae team will come through this just fine. However, we’ll come through just a little better off, though, with friends like you out there. I — we — greatly appreciate everything you do for our hard-working developers, customer service staff, and admins striving to make our computing platform of choice even better.

So, from all of us, THANK YOU. Stay safe and healthy as we continue to weather this storm together. There truly are better days ahead, and we have some great things in store for 2020 (and we’re still working hard on them).

Lewis Rosenthal
Managing Member
Arca Noae, LLC

Join Us at Warpstock 2019 in Orlando

Warpstock 2019 will be held November 8-10 at the Country Inn & Suites, Orlando Airport. Arca Noae staff and developers will be there with the latest ArcaOS news and how-to sessions, as well as a host of other OS/2 experts ready and willing to share their knowledge and expertise.

Register in the next 24 hours (before June 1) and receive a $30 Early Bird discount on a full conference registration or $20 on a daily conference registration! Spouses/family members/guests/office mates attending sessions also receive great discounts, and non-attending guests are FREE. Students with valid student ID are welcome to attend sessions at no charge, with full benefits! (This is a great opportunity for Computer Science majors and aspiring young developers and engineers to gain some exposure to a platform which is still in use in the manufacturing, finance, and insurance sectors around the globe today.)

Arca Noae Package Manager version 1.0.4 has been released

Arca Noae is pleased to announce the immediate availability of an updated Arca Noae Package Manager for ArcaOS, OS/2, and eComStation. (1.0.4)

While this is technically a minor update, it includes an array of substantial enhancements:

Implemented editing of secure repositories.
Implemented passing of long (>900 char) parameter lists by pipe instead of going through CMD (for package export).
Install from file now goes through yum engine, thereby enabling dependencies and update/downgrade/reinstall.
Ensured that special characters in encrypt/decrypt commands are not intercepted by CMD.
Make sure reinstall, update, and downgrade also enable DLL conflict checking.
Even more improved message formatting.
Expanded help guide.
Updated included libraries.
Various bug fixes and other minor improvements.

Arca Noae Package Manager is available in English with Spanish, French, Italian, German, Dutch, and Swedish language packs.

This open source utility is available to everyone, free of charge, regardless whether you have an Arca Noae software subscription or an ArcaOS license.

Please review the wiki for important first-time installation and upgrade notes and other tips.