From owner-freebsd-questions Tue Jun 25 12:59: 5 2002 Delivered-To: freebsd-questions@freebsd.org Received: from mta02-svc.ntlworld.com (mta02-svc.ntlworld.com [62.253.162.42]) by hub.freebsd.org (Postfix) with ESMTP id 4552837B49E for ; Tue, 25 Jun 2002 12:58:45 -0700 (PDT) Received: from lungfish.ntlworld.com ([80.4.0.215]) by mta02-svc.ntlworld.com (InterMail vM.4.01.03.27 201-229-121-127-20010626) with ESMTP id <20020625195844.KXD4626.mta02-svc.ntlworld.com@lungfish.ntlworld.com>; Tue, 25 Jun 2002 20:58:44 +0100 Received: from tuatara.goatsucker.org (tuatara.goatsucker.org [192.168.1.6]) by lungfish.ntlworld.com (8.11.6/8.11.6) with ESMTP id g5PJwhV00616; Tue, 25 Jun 2002 20:58:43 +0100 (BST) (envelope-from scott@tuatara.goatsucker.org) Received: (from scott@localhost) by tuatara.goatsucker.org (8.12.3/8.12.3/Submit) id g5PJwevL003406; Tue, 25 Jun 2002 20:58:40 +0100 (BST) (envelope-from scott) Date: Tue, 25 Jun 2002 20:58:40 +0100 From: Scott Mitchell To: Christopher Schulte Cc: Lord Raiden , Marco Radzinschi , FreeBDS-Questions Subject: Re: Upcoming OpenSSH vulnerability (fwd) Message-ID: <20020625205840.B381@fishballoon.dyndns.org> References: <5.1.1.6.2.20020624224948.02923518@pop3s.schulte.org> <20020624234646.G22328-100000@mail.radzinschi.com> <4.2.0.58.20020625134233.009992b0@pop.netzero.net> <5.1.1.6.2.20020625124040.041c50f0@pop3s.schulte.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <5.1.1.6.2.20020625124040.041c50f0@pop3s.schulte.org>; from schulte+freebsd@nospam.schulte.org on Tue, Jun 25, 2002 at 12:45:33PM -0500 X-Operating-System: FreeBSD 4.6-STABLE i386 Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On Tue, Jun 25, 2002 at 12:45:33PM -0500, Christopher Schulte wrote: > At 01:43 PM 6/25/2002 -0400, Lord Raiden wrote: > > Ok, well we're still running OpenSSH 3.1 from the last security > > upgrade recommendation. Should we go straight to 3.3 or wait for the > > final fix? With previous ssh vulnerabilities I've been able to just patch the base system, by rebuilding the world or using the patch included with the advisory. However, to get to 3.3 it looks like I'd need to install a port. There are two OpenSSH ports: security/openssh and security/openssh-portable What's the difference between these two ports? Which one should I install to deal with this vulnerability? The right answer to my second question may of course be, "wait for the announcement on -security" TIA, Scott -- =========================================================================== Scott Mitchell | PGP Key ID | "Eagles may soar, but weasels Cambridge, England | 0x54B171B9 | don't get sucked into jet engines" scott.mitchell@mail.com | 0xAA775B8B | -- Anon To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message