I just received a computer security bulletin from another (reliable) source stating that there are indications of an exploit in the wild for versions of OpenSSH prior to 3.7.1. It says the exploit can produce denial of service or administrative control of the target system. Sshd on my FreeBSD-STABLE system from last Saturday says it is version 3.5p1. I understand that FreeBSD patches old versions of OpenSSH instead of substituting new ones, but my question is whether sshd version "OpenSSH_3.5p1 FreeBSD-20030924" has these vulnerabilities fixed. Is it as secure as OpenSSH 3.7.1? -- M/S 258-5 |1024-bit PGP fingerprint:|tweten@nas.nasa.gov NASA Ames Research Center | 41 B0 89 0A 8F 94 6C 59| (650) 604-4416 Moffett Field, CA 94035-1000| 7C 80 10 20 25 C7 2F E6|FAX: (650) 604-4377 Not an official NASA position. You can't even be certain who sent this!
Dave Tweten <tweten@nas.nasa.gov> writes:> I understand that FreeBSD patches old versions of OpenSSH instead of > substituting new ones,That depends, but upgrading is generally a lot more work (and introduces other risks). It is however highly unlikely that we will ever upgrade OpenSSH in 4.x to 3.7.1, as it does not support Kerberos IV, which we still want to support in 4.x.> but my question is whether sshd version > "OpenSSH_3.5p1 FreeBSD-20030924" has these vulnerabilities fixed.We do not know of any vulnerabilities in FreeBSD-STABLE's OpenSSH. If you have any information we don't, we'd be very much obliged if you could forward it to <secteam@freebsd.org>.> Is it > as secure as OpenSSH 3.7.1?As far as we know, yes. DES -- Dag-Erling Sm?rgrav - des@des.no