Re: Versions vs vulnerabilities
From: Darren Tucker (dtucker_at_dodgy.net.au)
Date: 01/28/04
- Next message: Doug Summers: "Re: Connection closing on AIX 5.1 - UPDATE"
- Previous message: Gary Armstrong: "Versions vs vulnerabilities"
- In reply to: Gary Armstrong: "Versions vs vulnerabilities"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Wed, 28 Jan 2004 22:05:41 +0000 (UTC)
In article <1075325214.834548@news-1.nethere.net>,
Gary Armstrong <garyarm_remThis_at_testedgeinc.com> wrote:
>Is there a place to look up a particular version of openssh against
>known vulnerabilities?
>
>My version 3.5p1-6 isn't the latest, but if there are no significant
>holes, I'd just as soon stay here.
Ask your vendor (the "-6" indicates that they have made a number of
changes).
Vanilla OpenSSH < 3.7.1 has a buffer handling problem:
http://www.openssh.com/txt/buffer.adv
Your vendor may have applied a patch to address this.
In addition, Portable versions 3.7p1 and 3.7.1p1 have a problem with
PAM: http://www.openssh.com/txt/sshpam.adv
--
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69
Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.
- Next message: Doug Summers: "Re: Connection closing on AIX 5.1 - UPDATE"
- Previous message: Gary Armstrong: "Versions vs vulnerabilities"
- In reply to: Gary Armstrong: "Versions vs vulnerabilities"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
