openssh in 4.9

[Kris Kennaway]

On Fri, Oct 31, 2003 at 08:55:15AM +0000, Wayne Pascoe wrote:
> On Thu, Oct 30, 2003 at 10:22:06AM -0800, Kris Kennaway wrote:
> > Please read the security advisory.
> 
> I've read the advisory. It states a couple of workarounds (which I
> enabled at the time anyway) and also states that the problem is
> rectified in -STABLE beyond a certain date.
> 
> However, looking at the openssh advisory's, the only fix is to be
> running a version 3.7.1p1 or later. So I'm confused. Have the FreeBSD
> team backported these fixes into 3.5.1 ? 

Yes, that's why the FreeBSD advisory says the problem was rectified in
-STABLE beyond a certain date ;-)

> One of my problems is that some of my clients occasionally have 3rd
> parties perform penetration testing on our servers. I need an
> explanation for when the 3rd party comes back and says that I am running
> a vulnerable ssh.

Compare the version string to an unpatched openssh version...they are
not the same.

Kris
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20031031/9e92c6c2/attachment.bin