Category Archives: ArcaOS

Apache Log4j vulnerability (CVE-2021-44228)

On Thursday, December 9, 2021, the Apache Log4j project disclosed a critical security vulnerability which may result in remote code execution on systems running Log4j. The exploit has been aptly named Log4Shell (CVE-2021-44228).

Log4j is a logging component which runs under Java on many different platforms, and is useful not only for Java applications, but for other programs, as well. It is commonly bundled with unrelated software, simply as a means of providing a standard logging engine.

Arca Noae has completed a scan of our internal systems and has determined that we are not affected by this vulnerability. Further, ArcaOS has never included any Log4j components, and is also unaffected. However, because the exploitable feature in Log4j has existed for some time, it is possible that Java and other applications may have been installed under ArcaOS which utilize Log4j, and these systems may be at risk.

The feature used for the Log4Shell exploit is in the JNDI (Java Naming and Directory Interface) lookup class which was added to Log4j several years ago during the 2.0 beta cycle. Log4j versions through 2.3 required only Java versions up to 1.6, and so may be utilized by some OS/2-compatible applications.

Risk assessment

To determine whether any of your OS/2 systems may be at risk, start by searching all accessible volumes for log4j-*.jar. If any are found, determine the version of Log4j by examining the content of META-INF/MANIFEST.MF in the core jar file:

[c:\] unzip -c log4j-core.jar META-INF/MANIFEST.MF | less

Note the Implementation-Version line content.

Edge servers as well as firewalled systems running various applications may be at risk, as queries may be submitted to the Log4j engine from other applications and potentially from outside the network.

Mitigation

Although the exploit has been addressed in Log4j 2.16.0, because versions above 2.3 are not currently compatible with OS/2’s available Java Runtime Engine, it is necessary to mitigate the condition by removing the JndiLookup class from the classpath, e.g.:

[c:\] zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class

Additional information

Older (pre-2.0-beta9) versions of Log4j lack this lookup class, and do not appear to be at risk for Log4Shell (though some earlier security advisories may have been issued). Further research may be needed based upon the version(s) of Log4j which may be in use on these earlier systems. Also, this is not the only security advisory for Log4j 2.0-beta9 – 2.3. This notification is only related to CVE-2021-44228.

Links

https://nvd.nist.gov/vuln/detail/CVE-2021-44228
https://nakedsecurity.sophos.com/2021/12/10/log4shell-java-vulnerability-how-to-safeguard-your-servers/
https://www.kb.cert.org/vuls/id/930724

ArcaOS 5.0.7 now available

In our continuing commitment to ArcaOS 5.0 (Blue Lion), Arca Noae is pleased to announce the general availability of ArcaOS 5.0.7, the seventh maintenance release of the 5.0 line.

ArcaOS 5.0.7 includes refreshed driver content, updated kernel and included software, as well as installation boot fixes since 5.0.6 was released in 2020. If you have experienced difficulty installing previous releases of ArcaOS on your hardware, 5.0.7 may address your issue(s). If installing from USB stick, the image may be created using any major operating system at hand (Windows, Linux, MacOS, and of course, OS/2, eComStation, and ArcaOS). Once built, the USB stick can be inserted into any USB port in the target system to boot into the ArcaOS installer/updater.

For a complete list of updates in this release, see the ArcaOS wiki. Be sure to review the README.TXT, as well, as this contains critical information to ensure that you get up and running fast, and includes tips for getting things adjusted right away.

This update is included with your valid ArcaOS 5.0 Support & Maintenance subscription at no additional charge. To download your fresh ISO, simply visit your customer portal page, select the Orders & Subscriptions link on the navigation panel to the left, then click on the order for your ArcaOS 5.0 license. Once there, click the download link to request a fresh ISO, and wait for your notification email.

If your ArcaOS 5.0 Support & Maintenance subscription has already expired, and you missed your window of opportunity to renew at regular rates, you may still renew at less than the cost of a new ArcaOS license.

ArcaOS Desktop updated to 1.0.14

Dynamic Icons [Edit: Download links have been properly adjusted as of this writing, and should all be working. Apologies for any inconvenience.]

Arca Noae is pleased to announce the immediate availability of ArcaOS Desktop (ANXWP) 1.0.14 in English, German, Dutch, Spanish, Italian, Japanese, and Russian. This is a maintenance release containing bug-fixes and updates that have accumulated over the last year. The primary improvements include:

XShutdown

Power-off options have been simplified. The ACPI/APM shutdown option has been removed since the system always uses ACPI if it is available.
The shutdown sound which failed to play in Lite versions has now been restored.
The XShutdown dialog has been updated to suppress the list of BIOS-bootable partitions when booted in UEFI mode. It should also do a better job of handling situations where the data it collects from AirBoot is corrupt.

Folder Refresh

This feature has been completely rewritten to ensure that every filesystem update is reflected in the display within 1.5 seconds. The rewrite also fixes a bug where the code might try to delete a file that had been deleted then recreated.

Russian NLS (NEW)

Initial Russian language support has been provided by Yurii Zamotailo.

In addition, included is a minor update to Arca Noae Removable Media Monitor which suppresses attachment notifications (and subsequent failure messages) when USB floppy drives and some USB optical drives are plugged in.

See the Version Information topic of the ArcaOS Desktop Users Guide and Reference located in the Help Center for more details about this release.

If you have ArcaOS, this software is available for download from the Arca Noae website as part of the Support & Maintenance subscription for your ArcaOS product. Please log into your account and see your ArcaOS order details page to access your software.

If you are still running OS/2 and/or eComStation this is a great reason to consider moving up to ArcaOS. This update includes reserved features licensed for use exclusively with ArcaOS.

ArcaOS 5.0.6 updates for 2020-11-14

Dynamic Icons Two packages included in ArcaOS 5.0.6 have been updated, and are now available as part of the Support & Maintenance subscription for your ArcaOS product. Please log into your account and see your ArcaOS order details page to access your software. Specifically, these are:

Archive Tool 1.04.0 (updated from 1.03.03)
DVD Tools 1.08.0 (updated from 1.07.01)

These packages include minor fixes and enhancements over their previous versions, and while recommended, are not considered critical updates. Each package displays a changelog during installation to make it easy to see what’s new.

These are eCo Software applications which utilize the eCo Software Runtime libraries. Updating these runtime packages is recommended for the best user experience. (These packages have been updated since the release of ArcaOS 5.0.6.)

More updates are on the way to the Support & Maintenance subscription channel as we continue our work on the next release of ArcaOS. Watch for more announcements right here.

If you are still running OS/2 and/or eComStation systems and haven’t yet moved up to ArcaOS, this is a great reason to do so now. If you’ve already made the switch, but haven’t renewed renewed your support subscription, this is also a good time. Not sure what’s coming next? Have a look at our product roadmap pages.

Arca Noae announces GUID for OS/2 Type 1 GPT partitions

In our last post concerning GPT in ArcaOS, we discussed the first phase of support and how our specification allows for multiple partitions up to 2TB in size. As every GUID (Globally Unique Identifier) partition type requires a GUID, we have set:

90B6FF38-B98F-4358-A21F-48F35B4A8AD3

as the GUID for OS/2 Type 1 partitions.

Any GPT partition using this GUID should ultimately be recognizable by any GPT-aware operating system as belonging to ArcaOS.

Although this is now just a simple proclamation, it is, in point of fact, a major advancement for the platform, and sets the stage for our initial GPT support, currently planned for release with ArcaOS 5.1 in 2021.

Arca Noae makes no guaranty as to availability of GPT support for ArcaOS 5.1. When available, GPT support will be an ArcaOS feature only, with no plans to make the technology available for other OS/2 distributions.

Don’t have ArcaOS yet? Now is a great time to pick up a license or two and replace those aging Warp 4 or eComStation installations and get to know what’s new and improved. If you’ve never run OS/2 before, you’ll be amazed. If you last used OS/2 in the 1990’s, you’ll be even more amazed. ArcaOS runs the vast majority of existing OS/2 Warp 4 software, because it really is OS/2 – just better. ArcaOS supports more modern hardware than any other OS/2 distribution available today, making hardware upgrades much easier than ever before. An ArcaOS 5.0 license now means steep discounts on future upgrades, including 5.1.

Arca Noae’s plan for supporting GPT disk layouts in ArcaOS

Through the release of ArcaOS 5.0.6, all OS/2 distributions have only supported MBR (Master Boot Record) partitioning schemes, that is, up to four partitions on a disk, with the possibility of creating multiple logical volumes in one extended partition. This partitioning scheme is also limited to a maximum of 2TB per disk.

The GPT (GUID Partition Table) breaks out of these restrictions by supporting an almost unlimited number of partitions (without the need for logical volumes) and disks exceeding 2TB.

Supporting GPT is another major step for multiboot configurations where the disk has already been partitioned using this style, which will allow ArcaOS to install alongside other GPT-aware operating systems (Windows 10, modern Linux distros, etc.), without the need to install a second MBR-partitioned disk or to wipe, re-partition, and reformat all volumes on the existing disk.

Arca Noae’s approach to supporting GPT will be multi-phased, with the first phase of development currently underway and anticipated for release with ArcaOS 5.1. The design specification of our initial GPT support is to allow for partitions up to the current 2TB maximum size, with multiple partitions of this size possible on disks larger than 2TB. Our specification further provides that ArcaOS be able to create, delete, and modify GPT partitions which are identified by their GUIDs as being “OS/2-type” partitions, and lastly, that GPT support be available for both traditional BIOS (for data volumes) and UEFI-based systems (for boot and data volumes).

Have a question? Be sure to read our FAQs

We’ve discussed the wealth of specific information available in our wiki pages in previous blog posts here and here, but there is still another resource available to get quick answers to “how do I…” and other questions: the Arca Noae FAQ.

Searching the FAQ is easy: just type one or more terms into the search box at the top. To browse questions and answers by category, select one of the available categories from the list, and scroll. Another way to search the entire Arca Noae website is to just use the site search box to the right of most pages.

If a FAQ answer has been helpful, please be sure to let us know by clicking the appropriate feedback link at the bottom.

If you happen to find something which doesn’t seem quite right (outdated or perhaps in need of further explanation), please drop us a note to let us know. If you have a suggestion for something to add, please tell us. We continually add questions as they are asked more frequently (hey, it’s a FAQ, after all), and we’ll be sure to consider any suggestions.

Just as the links to the wiki and the ticket system, the FAQ is available from the Support dropdown on the main menu.

Further progress on Arca Noae’s UEFI support for ArcaOS

The UEFI Forum In our last post on this topic,we reported that much UEFI development work remained to be completed, primarily regarding DOS and Win-OS/2 sessions. Today, that work has advanced considerably, with more DOS and Win-OS/2 apps and games now running under ArcaOS on a wider range of systems than ever before. In fact, on systems which are incapable of providing usable DOS and Win-OS/2 sessions when booted in BIOS mode, DOS and Win-OS/2 run splendidly when booted in UEFI mode, thanks to the environment we create. This should provide a truly amazing experience for all retro-gamers seeking the ability to run classic DOS and Windows games in a native environment without the overhead of a virtualization layer.

Some of the classic DOS and Windows games which work well under current ArcaOS betas in UEFI mode include (note video modes and environments listed, as well):

1869 (VGA 320×200)
Caesar 2 (VESA)
Many CGA games
C&C: Red Alert (VGA 320×200)
Civilization 1 (EGA/VGA 320×200)
Civilization 2 (Win-OS/2)
Colonization (VGA 320×200)
Commander Keen
Conquest of the New World (VESA)
Fallout (VESA)
Heretic (VGA 320×200)
Heroes of Might and Magic 2 (VESA)
High Seas Trader (VGA 320×200)
HomeAlone (VGA mode-x 320×200)
King’s Bounty (VGA 320×200)
King`s Quest II, IV (EGA 320×200)
Legions (Win-OS/2)
Lemmings (CGA/EGA 320×200)
Master of Magic (VGA mode-x 320×200)
Master of Orion (VGA mode-x 320×200)
Master of Orion 2 (VESA)
Merchant Prince (VGA 320×200)
Outpost 1 (Win-OS/2)
Outrun (CGA/EGA 320×200)
Planet X3 – (VGA 320×200, CGA 320×200, CGA 640×200)
Pool (CGA/EGA 320×200)
Quake (VGA 320×200)
Settlers 2 (VESA)
SimCity (EGA)
SimCity 2000 (VESA)
Space Quest I, III (EGA/VGA 320×200)
TES: Daggerfall (VGA 320×200)
Tie Fighter (VGA 320×200)
WarCraft (VGA 320×200)
Wolfenstein3d (VGA mode-x 320×200)
X-COM: UFO (VGA 320×200)

In addition, same very popular development and office titles are running quite well, such as:

Borland C 3.1
Boralnd Pascal 7.0
Image Alchemy
MS Word 5.5
Multimate 4.0
Lotus 1-2-3 3.4 and 4.0
Lotus Symphony
Q&A Write
QPV 1.7 (image viewer)
Quattro Pro 5.6
WordPerfect 6.0
WordStar 7.0

Both full screen and windowed DOS, Win-OS/2, and OS/2 sessions are operable, and OS/2 applications continue to run fine under UEFI in our testing, as well.

Installation in UEFI mode has also advanced considerably. Current betas install under traditional BIOS or UEFI from the same media, whether DVD or bootable USB stick. The current mode of the system is auto-detected without the need for user intervention. When released with ArcaOS 5.1 (anticipated sometime in 2021), this should provide for a truly effortless installation.

ArcaOS 5.1 will be an upgrade from ArcaOS 5.0. For a more complete list of planned enhancements for 5.1, please visit our ArcaOS Roadmap page. ArcaOS 5.1 will also continue to fully support traditional BIOS-based systems; UEFI is meant to expand device support for the latest generations of hardware.

Visited the Arca Noae wiki pages recently?

A few months ago, in another blog post, we discussed some things to do before opening a support ticket, including visiting the wiki pages to check for the latest technical and how-to information for your product.

These pages are regularly updated, so even if you’ve looked over them before, they’re worth a re-read.

Web searches are fine, but unfortunately, much of the available information pertaining to OS/2 is either dated or more specifically related to non-ArcaOS distributions or non-Arca Noae drivers. Your first, best place for information on Arca Noae products is right here.

If you happen to find something which doesn’t seem quite right (screenshots or directions outdated), please drop us a note to let us know. If you have a suggestion for something to add (a tip, how-to, or even a missing wiki), please tell us. We keep a running list of pages to update and add, and we’ll be sure to consider any requests we receive.

As always, and as frequently mentioned here, before opening a trouble ticket, be sure to check the wiki pages (self-help is often the best help).

ArcaOS 5.0.6 now available

Arca Noae is pleased to announce the general availability of ArcaOS 5.0.6, the sixth maintenance release of ArcaOS 5.0 (Blue Lion).

ArcaOS 5.0.6 includes refreshed content and fixes since 5.0.5 was released. If you have experienced difficulty installing previous releases of ArcaOS on your hardware, 5.0.6 may address your issue(s). If installing from USB stick, the image may be created using any major operating system at hand (Windows, Linux, MacOS, and of course, OS/2, eComStation, and ArcaOS). Once built, the USB stick can be inserted into any USB port in the target system to boot into the ArcaOS installer/updater.

This update is included with your valid ArcaOS Support & Maintenance subscription at no additional charge. To download your fresh ISO, simply visit your customer portal page, select the Orders & Subscriptions link on the navigation panel to the left, then click on the order for your ArcaOS license. Once there, click the download link to request a fresh ISO, and wait for your notification email.

If your ArcaOS Support & Maintenance subscription has already expired, and you missed your window of opportunity to renew at regular rates, you may still renew at less than the cost of a new ArcaOS license.