Security bugs are reported here via bugzilla

[Seth Woolley <seth AT tautology.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I only see the 3.7p1 announcment on their email lists, but 3.7.1p1 is on
their ftp server.  I've updated it in all grimoires here after gpg
checking it, compiling, and testing it ('ssh 127.0.0.1' worked).

unpacked tar md5: d0aafddfc487f18e29de98c5111f2784

Seth

On Wed, 17 Sep 2003, Niki Guldbrand wrote:

> Hi All.
>
> OpenSSH 3.7.1p1 has been released and it has changes to the same area as
> the last exploit proactive fix has...
>
> Nik
>
> On Tue, 2003-09-16 at 03:40, Seth Woolley wrote:
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > New vuln?  Full Disclosure has two threads so far:
> > http://lists.netsys.com/pipermail/full-disclosure/2003-September/010103.html
> > http://lists.netsys.com/pipermail/full-disclosure/2003-September/010135.html
> >
> > The second one is of note.  See anything there that I don't?  I'm waiting
> > for a response to the second thread for confirmation.
> >
> > But we're on 3.6.1p2 right now... think we're safe?
> >
> > Seth
> >
> > On Mon, 15 Sep 2003, Craig Van Tassle wrote:
> >
> > > There has been some reports of a new vuln for openssh 3.6p1.  As far as
> > > I know the vuln is only for 3.6p1 and 3.6p2 is save.
> > >
> > >
> > > _______________________________________________
> > > SM-Security mailing list
> > > SM-Security AT lists.ibiblio.org
> > > http://lists.ibiblio.org/mailman/listinfo/sm-security
> > > ------------ Output from gpg ------------
> > > gpg: WARNING: using insecure memory!
> > > gpg: please see http://www.gnupg.org/faq.html for more information
> > > gpg: Signature made Mon Sep 15 17:04:30 2003 PDT using DSA key ID 
> > > 63223FE3
> > > gpg: BAD signature from "Craig Van Tassle <craig AT codestorm.org>"
> > >
> > >
> >
> > - --
> > Seth Alan Woolley <seth at tautology.org>, SPAM/UCE is unauthorized
> > Key id 7BEACC7D = 2978 0BD1 BA48 B671 C1EB 93F7 EDF4 3CDF 7BEA CC7D
> > Full Key at seth.tautology.org and pgp.mit.edu. info: www.gnupg.org
> > -----BEGIN PGP SIGNATURE-----
> > Version: GnuPG v1.2.2 (FreeBSD)
> >
> > iD8DBQE/Zmoq7fQ833vqzH0RAuw1AKCrBfCOYisWUqMUhfNDP1hA1KSZyACfQvlZ
> > jORXgBQ76UAyc8GjA/imHmE=
> > =X8Ca
> > -----END PGP SIGNATURE-----
> >
> > _______________________________________________
> > SM-Security mailing list
> > SM-Security AT lists.ibiblio.org
> > http://lists.ibiblio.org/mailman/listinfo/sm-security
>

- --
Seth Alan Woolley <seth at tautology.org>, SPAM/UCE is unauthorized
Key id 7BEACC7D = 2978 0BD1 BA48 B671 C1EB 93F7 EDF4 3CDF 7BEA CC7D
Full Key at seth.tautology.org and pgp.mit.edu. info: www.gnupg.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (FreeBSD)

iD8DBQE/Z/4Z7fQ833vqzH0RAopfAJ9uFDPIYnjBVfFKCFFs74VfaXRUJQCfdxA5
uIUd/3BC0jmj9rrFGGNThcU=
=3qt8
-----END PGP SIGNATURE-----