Actually, John, I beg to differ. It appears that you are running version 1.2.26 of either SSH.com or possibly OpenSSH. Either way, both are vulnerable to this particular exploit.
See the following link (probably wrapped): http://www.corest.com/pressroom/advisories_desplegado.php?idxsection=10&idx=81 Shortly after the original advisory, I updated my sshd.lrp package to include the trivial patch for this exploit. I believe I started with Debian's slink version openssh_1.2.3-9.2, and patched from there. My package is slightly different from the original ssh*.lrp's in that I have the client included as well, so the update version(doesn't overwrite ~/.ssh or hostkeys) weighs in at approx 320KB verses under 200KB for the original daemon lrp version. Mind you, removing the client and/or modifying sshd.list will bring it back to the smaller size. I don't know what the current LEAF version is(no time to play), but if there is an interest in my updated package and I knew where to send it, I'll gladly do so. BTW, I tested it with $ ssh -v -l `perl -e '{print "A"x88000}'` localhost as mentioned in the similar advisory from http://www.securiteam.com/securitynews/5LP042K3FY.html and it appeared to function properly. HTH, Doug. John Klar wrote: > > On Wed, 31 Oct 2001, David Douthitt wrote: > > > What version of OpenSSH is being used in LEAF projects? > > I run and older version of LRP that returns the following string: > SSH-1.5-1.2.26 > > If I interpret everything correctly this should be OK, but I should really > upgrade it anyway. > > > It's a good thing it is "extremely difficult." However, I think OpenSSH > > 2.3.0 is rather old; isn't OpenSSH up to 2.5.x now? > > Internally I have a RH-6.2 box that has a version of OpenSSH that returns: > SSH-1.99-OpenSSH-2.1 > > This is a problem and will be dealt with. > > _______________________________________________ > Leaf-devel mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/leaf-devel _______________________________________________ Leaf-devel mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/leaf-devel
