Nessus scan of FreeBSD 5.2.1 shows old version of ssh

[Bill Moran]

Ray Seals <rseals at vdsi.net> wrote:

> I just ran a Nessus scan against one of my machines.  The scan triggered
> on a version of ssh older than 3.7.1.
> 
> I ran /usr/bin/ssh -v and found that I have version 3.6.1p1.  I'm
> looking for the best way to upgrade this.  Can I just install and run
> 'portupgrade' on SSH?  What are some of the "gotcha" points on doing
> this?

You're about the third person in as many months who's pointed out how
stupid Nessis.

The version in FreeBSD is NOT vulnerable, it's just that Nessis isn't
aware of all the various version numbers that have had this problem
patched.

If you want to silence Nessis, however, the other responder had some
good suggestions.

-- 
Bill Moran
Potential Technologies
http://www.potentialtech.com