From owner-freebsd-security@FreeBSD.ORG Tue Sep 16 08:09:26 2003 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 463D316A4B3 for ; Tue, 16 Sep 2003 08:09:26 -0700 (PDT) Received: from corb.mc.mpls.visi.com (corb.mc.mpls.visi.com [208.42.156.1]) by mx1.FreeBSD.org (Postfix) with ESMTP id 667D643FB1 for ; Tue, 16 Sep 2003 08:09:25 -0700 (PDT) (envelope-from hawkeyd@visi.com) Received: from sheol.localdomain (unknown [208.42.101.193]) by corb.mc.mpls.visi.com (Postfix) with ESMTP id 00789F264 for ; Tue, 16 Sep 2003 10:00:56 -0500 (CDT) Received: (from hawkeyd@localhost) by sheol.localdomain (8.11.6p2/8.11.6) id h8GF0ue16824 for freebsd-security@freebsd.org; Tue, 16 Sep 2003 10:00:56 -0500 (CDT) (envelope-from hawkeyd) X-Spam-Policy: http://www.visi.com/~hawkeyd/index.html#mail Date: Tue, 16 Sep 2003 10:00:56 -0500 From: D J Hawkey Jr To: freebsd-security@freebsd.org Message-ID: <20030916150056.GA16806@sheol.localdomain> References: <20030916134347.GA30359@madman.celabo.org> <20030916145525.GB90755@madman.celabo.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20030916145525.GB90755@madman.celabo.org> User-Agent: Mutt/1.4.1i Subject: Re: OpenSSH heads-up X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: hawkeyd@visi.com List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Sep 2003 15:09:26 -0000 On Sep 16, at 09:55 AM, Jacques A. Vidrine wrote: > > Here's the meat of it: > > ---- begin excerpt ---- > This is the 1st revision of the Advisory. > > This document can be found at: http://www.openssh.com/txt/buffer.adv > > 1. Versions affected: > > All versions of OpenSSH's sshd prior to 3.7 contain a buffer > management error. It is uncertain whether this error is > potentially exploitable, however, we prefer to see bugs > fixed proactively. > > 2. Solution: > > Upgrade to OpenSSH 3.7 or apply the following patch. > ---- end excerpt ---- How far away are we from a FreeBSD SA? When the patch(es) are ready for all the other supported releases? Dave -- ______________________ ______________________ \__________________ \ D. J. HAWKEY JR. / __________________/ \________________/\ hawkeyd@visi.com /\________________/ http://www.visi.com/~hawkeyd/