Re: [cobalt-users] SSH Exploit?

[Peter Batenburg <peter@xxxxxxxxxx>]

Hello,

Thats not true. Cobalt rpms from pkg.nl.cobalt.com install openssh 2.1.1:
$ ssh -v
SSH Version OpenSSH_2.1.1, protocol versions 1.5/2.0.

Thats different than ssh1:
OpenSSH
OpenSSH versions prior to 2.3.0 are vulnerable.
OpenSSH versions 2.3.0 and above are not vulnerable, source changes in
deattack.c that fix this problem were incorporated into the source tree on
October 31st, 2000.

so update: 
ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-2.3.0p1.tar.gz



At 08:31 9-2-2001 -0800, you wrote:
> The vulnerability was found to only effect version 1.2.30 , cobalt
> has version 2.1.1 of the pkg download site.
>
> Mike
> ----- Original Message -----
> From: "Weihan Leow" <wleow@xxxxxxxxxxx>
> To: <cobalt-users@xxxxxxxxxxxxxxx>
> Sent: Friday, February 09, 2001 7:42 AM
> Subject: [cobalt-users] SSH Exploit?
>
>
> > I saw something about sshd on bugtraq.  Should we be alarmed?  Is cobalt
> > going to come out with another pkg for us to update sshd?
> >
> > http://www.securityfocus.com/vdb/bottom.html?vid=2345
> >
> > -Weihan