From owner-freebsd-security Tue Jul 2 5:50:32 2002 Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 94E5137B400 for ; Tue, 2 Jul 2002 05:50:30 -0700 (PDT) Received: from newmail.skyrunner.net (newmail.skyrunner.net [208.133.44.6]) by mx1.FreeBSD.org (Postfix) with ESMTP id 4C19543E3B for ; Tue, 2 Jul 2002 05:50:29 -0700 (PDT) (envelope-from peter@skyrunner.net) Received: from micron (athena.skyrunner.net [208.150.25.130]) by newmail.skyrunner.net (8.11.2/8.11.0/SuSE Linux 8.11.0-0.4) with SMTP id g62CpaK04024 for ; Tue, 2 Jul 2002 08:51:36 -0400 From: "Peter Brezny" To: Subject: CERT Advisory CA-2002-18 OpenSSH Vulnerabilities in Challenge Response Date: Tue, 2 Jul 2002 08:47:37 -0400 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0) Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V5.00.3018.1300 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org I've been trying to get clear on whether or not freebsd-stable (4.6-STABLE FreeBSD 4.6-STABLE #0: Sat Jun 29 00:37:13 EDT 2002) has resolved the problem listed in CA-2002-18 from CERT. it doesn't appear so since it's running Openssh_2.9 and http://openssh.org/txt/preauth.adv clearly says that freebsd is vulnerable. I _THOUGHT_ i found something on the freebsd site stating that OpenSSH_2.9 FreeBSD localisations 20020307 was not vulnerable, however, I can't find it now. Since there doesn't appear to be a security advisory or notice from the freebsd security team on this one yet, what's the best thing to do? Manually update to openssh 3.4? Is an update to the base system in the works? TIA Peter Brezny Skyrunner.net To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message