Red Hat Linux Gets Top Government Security Rating
557513
Red Hat Linux received a new level of security certification that should make the software appealing to government agencies.
453769
(InfoWorld) - Red Hat Linux has received a new level of security certification that should make the software more appealing to some government agencies. Last week IBM was able to achieve EAL4 Augmented with ALC_FLR.3 certification for Red Hat Enterprise Linux, putting it on a par with Sun Microsystems' Trusted Solaris operating system, said Dan Frye, vice president of open systems with IBM. "This is the highest level of security function that anybody has," Frye said. "We have delivered LSPP [Labeled Security Protection Profile] functionality in Red Hat Enterprise Linux 5, and we have certified that at the EAL4 level of assurance." This rating is awarded by the government-funded National Information Assurance Partnership's (NIAP) Common Criteria Evaluation and Validation Scheme for IT Security program, which evaluates the security of commercial technology products. Red Hat Linux has been certified EAL4 Augmented with ALC_FLR.3 on IBM's mainframe, System x, System p5, and eServer systems. This level of security certification is not usually required for enterprise contracts, but it is mandatory for some programs within government agencies such as the U.S. Department of Defense and the U.S. National Security Agency, Frye said. Linux had already been certified at the EAL4 level, but this is the first time that the operating system has received the LSPP certification, which relates to its access-control features. Linux developers have been working to add these "SE Linux" access control features into the operating system for several years now. SE Linux shipped as part of Red Hat Enterprise Linux 5, and now it has been certified for government use, Frye said. "You now have a level of fine-grained control for everybody," he added. "You can set security based on groups or based on individuals." In addition to LSPP, Red Hat Linux has also been certified with Role Based Access Control Protection (RBAC), and that too is noteworthy, said Red Hat. "Historically, OS vendors have required you buy a separate branched OS to get something that is LSPP and RBAC certified," the company said in a statement. "This is something completely unique for commercial operating systems because the support for multilevel security is native to the OS." According to Frye, the certification is "big news for the Linux industry" because it shows that open source software can be used for sensitive computing tasks. "If anyone had any doubts that you could do this with an open source operating system, we've proved them wrong."
139524
InfoWorld - The release of Red Hat Enterprise Linux 5 in March should strengthen Red Hat&#39;s lead in the open-source software market and fend off challenges from Oracle, Microsoft, and Novell, an industry analyst said.
768312
Ziff Davis - Everyone knew the worst kept secret of LinuxWorld: that Red Hat would be introducing its latest server Linux, Red Hat Enterprise Linux 4. What wasn't expected was that Red Hat would use the announcement to attack Sun and Solaris.
276308
Red Hat is reporting that they have been hit with an email security scam. The Raleigh, NC-based company issued a security alert to customers warning of fake emails being sent to users that are purportedly
153234
Red Hat Inc. is adding Netscape Directory Server and Netscape Certificate Management System to its software arsenal through a $25 million deal with America Online Inc.
446777
A number of changes have been made to Security Enhanced Linux in Fedora Core 3--here's what you should know.
188714
InfoWorld - The introduction of a new version of its Linux distribution and new JBoss software helped Red Hat increase profit to $16.2 million, or $0.08 a share, on revenue of $118.9 million in its fiscal first quarter ended May 31, the company reported Wednesday.
385296
Linux distributor Red Hat Inc has appointed a vice president of desktop infrastructure technologies, a new position demonstrating its renewed commitment to Linux as a desktop operating system.
322407
Users of Red Hat Linux have been targeted by a fraudulent electronic mail advising recipients to install a &quot;security update&quot; containing mailicious code.
14275
Leading distributor of Linux open source solutions to the enterprise Red Hat, Inc has entered into a definitive asset purchase agreement with America Online, Inc to acquire certain assets of Netscape Security Solutions.
51874
Red Hat Inc. has announced the general release of the third update to its Enterprise Linux operating system, as well as a new partnership with recent Linux convert Unisys Corp.
348139
SEPTEMBER 30, 2004  - Linux vendor Red Hat Inc. is adding security and authentication tools from Netscape Security Solutions to its software arsenal through a deal with America Online Inc.
608521
Security researchers have uncovered "critical" security flaws in a version of the Linux kernel used by a large number of popular distributions.
568824
Red Hat Enterprise Linux 3 Update 3 limits how much damage a hacker could do. The company said the release is ahead of schedule and not a reaction to any specific threat.
556622
A five-company consortium has been awarded a â¬7 million three-year contract by the French Ministry of Defence to build a Linux-based multi-level secure operating system.
464075
Security researchers have uncovered "critical" security flaws in a version of the Linux kernel used by a large number of popular distributions.The three bugs allow unauthorized users to read or write to kernel memory locations or to access certain resources in certain servers, according to a SecurityFocus advisory.They could be exploited by malicious, local users to cause denial of service attacks, disclose potentially sensitive information, or gain "root" privileges, according to security experts.The bug affects all versions of the Linux kernel up to version 2.6.24.1, which contains a patch. Distributions such as Ubuntu, Turbolinux, SuSE, Red Hat, Mandriva, Debian and others are affected.The problems are within three functions in the system call fs/splice.c, according to an advisory from Secunia."In the 2.6.23 kernel, the system call functionality has been further extended resulting in ... critical vulnerabilities," said iSEC Security Research in an advisory.Secunia disagreed about the bugs' seriousness, giving them a less critical ranking.Exploit code for the vulnerabilities has been released publicly on the hacker site milw0rm.com, and Core Security Technologies has also developed a commercial exploit for the bugs, researchers said.Researchers advised system administrators to update their kernels immediately.Last month, a U.S. Department of Homeland Security bug-fixing scheme uncovered an average of one security glitch per 1,000 lines of code in 180 widely used open-source software projects.Secunia also previously discovered that the number of security bugs in open-source Red Hat Linux operating system and Firefox browsers, far outstripped comparable products from Microsoft last year.