freebsd 5.2.1 openssh hole

Jason M. Leonard fuzz at ldc.upenn.edu
Mon May 24 14:02:05 PDT 2004


On Mon, 24 May 2004, JJB wrote:

> Send email to FBSD OpenSSH port maintainer and tell then the port is
> out of date.

But only do so if you want to look like a complete moron.

(from a box with a recent ports tree)
dogfish# ssh -V
OpenSSH_3.8.1p1, OpenSSL 0.9.7d 17 Mar 2004

OpenSSH 3.8.1p1 is the latest version available from OpenSSH.

The ports tree included with a -RELEASE is the ports tree for that
release.  It isn't going to be changed.  If you want ports more recent
than the release date, update your ports collection.


:Fuzz

>
> -----Original Message-----
> From: owner-freebsd-questions at freebsd.org
> [mailto:owner-freebsd-questions at freebsd.org]On Behalf Of Thomas May
> Sent: Monday, May 24, 2004 3:23 PM
> To: freebsd-questions at FreeBSD.org
> Subject: freebsd 5.2.1 openssh hole
>
> Hi,
>
>
>
> i have installed the new version 5.2.1 and the ports collection from
> yesterday. i have checked the server
>
> with nessus and I got a security hole warning.
>
>
>
> You are running a version of OpenSSH which is older than 3.7.1
>
>
>
> Versions older than 3.7.1 are vulnerable to a flaw in the buffer
> management
>
> functions which might allow an attacker to execute arbitrary
> commands on
> this
>
> host.
>
>
>
> What can I do ? I have installed openssl from the ports tree, but I
> got the
> same error.
>
>
>
>
>
>
>
>
> ---
> Outgoing mail is certified Virus Free.
> Checked by AVG anti-virus system (http://www.grisoft.com).
> Version: 6.0.689 / Virus Database: 450 - Release Date: 21.05.2004
>
> _______________________________________________
> freebsd-questions at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-questions
> To unsubscribe, send any mail to
> "freebsd-questions-unsubscribe at freebsd.org"
>
> _______________________________________________
> freebsd-questions at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-questions
> To unsubscribe, send any mail to "freebsd-questions-unsubscribe at freebsd.org"
>


More information about the freebsd-questions mailing list