Re: ssh-1.2.27 remote buffer overflow - exploitable (VD#7)

[Niels Provos]

In message <[EMAIL PROTECTED]>, "Michael H. Warfield" wr
ites:
>       So I would guess it's 1.5 on the protocol.  If you look at the
>psst page, <http://www.net.lut.ac.uk/psst/> you will see a reference to
>lsh which is an ongoing project to impliment the 2.0 protocol.  I'm
>assuming that, since that's a related project to OpenSSH, that the
>2.0 stuff will eventually work its way into OpenSSH.
OpenSSH uses protocol versions 1.3 and 1.5.

At the moment it is fairly unlikely that 2.0 will ever be supported.
2.0 is a very complicated protocol that is not in wide use. It will be
easier to role out another protocol version that only includes the
necessary cryptographic fixes, like a cryptographically strong hash
for integrity.

Niels.