Date: Tue, 16 Sep 2003 21:10:23 +0100 (BST) From: Jan Grant <Jan.Grant@bristol.ac.uk> To: Kris Kennaway <kris@obsecurity.org> Cc: stable@freebsd.org Subject: Re: Release Engineering Status Report Message-ID: <Pine.GSO.4.58.0309162109180.14343@mail.ilrt.bris.ac.uk> In-Reply-To: <20030916192659.GA11518@rot13.obsecurity.org> References: <xzpr82graow.fsf@dwp.des.no> <JCEIKJMCANNPGKFKGLKLAEPGDPAA.mikej@trigger.net> <20030916171436.GA12867@ei.bzerk.org> <200309161416.17241.craig@meoqu.gank.org> <20030916192659.GA11518@rot13.obsecurity.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, 16 Sep 2003, Kris Kennaway wrote: > On Tue, Sep 16, 2003 at 02:16:17PM -0500, Craig Boston wrote: > > On Tuesday 16 September 2003 12:14 pm, Ruben de Groot wrote: > > > Fortunately, there's allready a patch in the source tree: > > > > > > http://www.freebsd.org/cgi/cvsweb.cgi/src/crypto/openssh/buffer.c.diff?r1=1 > > >.1.1.6&r2=1.1.1.7&f=h > > > > Yes, fortunately the patch is there. I noticed however that in the version > > committed to the RELENG_4_8 branch, RCSID wasn't changed, so it's not > > possible to use ident to tell if your libssh needs to be patched or not (both > > old and new say 1.16)... Was that an oversight or should I be using some > > other method to determine if I'm running a vulnerable version or not? > > Err, the RCS ID is updated automatically upon CVS checkin..is that > really what you mean? Yes, it is. The updated openssh/buffer.c has this near the top, still: [[ RCSID("$OpenBSD: buffer.c,v 1.16 2002/06/26 08:54:18 markus Exp $"); ]] ... the fix around line 100 has been merged; this change hasn't. -- jan grant, ILRT, University of Bristol. http://www.ilrt.bris.ac.uk/ Tel +44(0)117 9287088 Fax +44 (0)117 9287112 http://ioctl.org/jan/ Boycott Arabic numerals! What have they ever done for us?
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.GSO.4.58.0309162109180.14343>