Upgrading sshd?

[Jesse Sheidlower]

At 07:24 PM 9/16/03 +0300, you wrote:
>Hi all,
>
>Refering to the latest sshd vurnability 
>(http://slashdot.org/articles/03/09/16/1327248.shtml?tid=126&tid=172) I 
>was thinking of upgradeing my sshd as well. So I cvsup'ed my system (FBSD 
>4.8) and there seems to be a updated file for sshd. But how do I upgrade 
>sshd safly since when I type 'pkg_info |grep ssh' it return no packages. I 
>guess sshd is included somehow by the default install (??) but how can I 
>now upgrade it? I was thinking of portupgrade, but it needs a package to 
>upgrade...

There's a FreeBSD Security Advisory out that gives explicit details
on how to implement a fix for OpenSSH running as part of the core
system:

ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-03%3A12.openssh.asc

There seems to be a typo in one line; in the section on restarting sshd

(. /etc/rc.conf && ${sshd_program:-/usr/bin/sshd} ${sshd_flags})
                                        ^

should I think be sbin.

Jesse Sheidlower