* Jim Norton (jrn@oregonhanggliding.com) [030916 17:24]:

Where would one find the patch for Suse 8.1?

SuSE-8.1: Full rpm: ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/openssh-3.4p1-214.i586.rpm Patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/openssh-3.4p1-214.i586.patch.rpm Source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/src/openssh-3.4p1-214.src.rpm -- Ben Rosenberg ---===---===---===--- mailto:ben@whack.org ----- If two men agree on everything, you can be sure that only one of them is doing the thinking.

On Wed, 17 Sep 2003 10:52 am, Ben Rosenberg wrote:

SuSE-8.1: ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/openssh-3.4p1-214.i586.rpm ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/openssh-3.4p1-214.i586.patch.rpm ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/src/openssh-3.4p1-214.src.rpm

Suse 8.2 ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/openssh-3.5p1-106.i586.rpm ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/openssh-3.5p1-106.i586.patch.rpm ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/src/openssh-3.5p1-106.src.rpm Note also that openssh-askpass has a new version: ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/openssh-askpass-3.5p1-106.i586.rpm Looking at the changelog: # rpm -q --changelog openssh-3.5p1-106 * Tue Sep 16 2003 - postadal@suse.cz - fixed race condition in allocating memory [#31025] (CAN-2003-0693) - disabled privilege separation, which caused some problems [#30328] * Thu Sep 04 2003 - postadal@suse.cz The number mentioned (CAN-2003-0693) is the bug number in the alert. Could somebody closer to the source confirm that these patches do cover the problem detailed in: http://www.openssh.com/txt/buffer.adv michaelj -- Michael James michael.james@csiro.au System Administrator voice: 02 6246 5040 CSIRO Bioinformatics Facility fax: 02 6246 5166

* Henry Tang (Wed, Sep 17, 2003 at 01:07:45PM -0700)

SuSE-7.3?

there's an openssh-2.9.9.rpm in a similar location 7.3/rpm/i386/sec1/openssh.rpm IIRC Kind regards, -- Gerhard den Hollander Phone :+31-10.280.1515 ICT manager Direct:+31-10.280.1539 Jason Geosystems BV Fax :+31-10.280.1511 gdenhollander@Fugro-Jason.com POBox 1573 visit us at http://www.Fugro-Jason.com 3000 BN Rotterdam JASON.......#1 in Reservoir Characterization The Netherlands This e-mail and any attachment is/are intended solely for the named addressee(s) and may contain information that is confidential and privileged.

On Wednesday 17 September 2003 03:59 pm, Ben Rosenberg wrote:

* Gerhard den Hollander (gerhard@fugro-jason.com) [030917 12:45]:

...

* Henry Tang (Wed, Sep 17, 2003 at 01:07:45PM -0700)

...

SuSE-7.3?

there's an openssh-2.9.9.rpm in a similar location 7.3/rpm/i386/sec1/openssh.rpm IIRC

FYI. Look at the build and date of the OpenSSH RPM for 7.3 to determine if it's the patched version. SuSE doesn't update version numbers, but instead patchs existing version numbers as not to break anything that their pkgs depend on. You may know this. But I figured I'd say it for the benefit of those who don't. :)

-- Ben Rosenberg ---===---===---===--- mailto:ben@whack.org -----

Continuing with this subject, will there be further OpenSSH updates from SuSE as there were from the other distros. I understand that OpenBSD, Debian and others release two more serious bug fixes today, but I haven't heard anything from SuSE yet. Anyone got more news on this? Lee -- --- KMail v1.5.3-3 --- SuSE Linux Pro v8.2 --- Registered Linux User #225206 On any other day, that might seem strange...

On Wednesday 17 September 2003 11:10 pm, Ben Rosenberg wrote:

* BandiPat (penguin0601@earthlink.net) [030917 19:17]:

...

Continuing with this subject, will there be further OpenSSH updates from SuSE as there were from the other distros. I understand that OpenBSD, Debian and others release two more serious bug fixes today, but I haven't heard anything from SuSE yet.

Anyone got more news on this?

Well, according to what I've heard. The 3.7 release didn't fix the issue..the screwed it up. So instead of just saying " we f**ked up " and releasing a 3.7a version..they did 3.7.1. I would assume since SuSE has patched the 3.5p1 source themselves that since we do not have yet another build of 3.5 then SuSE got it right the first time. :)

I wouldn't not check for updates but unless it's announced that their patch didn't work. I would think SuSE's pkg is good. Number versions are sometimes a sticky situation with SuSE...as I mentioned above. It does take some getting use to.

-- Ben Rosenberg ---===---===---===--- mailto:ben@whack.org -----

Thanks Ben, those were my thoughts as well. Version numbers are just that, numbers and seldom reflects that state one's programs are in these days. I think I quit wondering about those about a year after I started using Linux. ;o) As I remember some of the SuSE guys mentioning they would not release the patch until tested, I'm sure SuSE will alert us to any other fixes that need to be done. Regards, Lee -- --- KMail v1.5.3-3 --- SuSE Linux Pro v8.2 --- Registered Linux User #225206 On any other day, that might seem strange...

* Ben Rosenberg (Wed, Sep 17, 2003 at 12:59:18PM -0700)

* Gerhard den Hollander (gerhard@fugro-jason.com) [030917 12:45]:

...

* Henry Tang (Wed, Sep 17, 2003 at 01:07:45PM -0700)

...

SuSE-7.3?

there's an openssh-2.9.9.rpm in a similar location 7.3/rpm/i386/sec1/openssh.rpm IIRC

FYI. Look at the build and date of the OpenSSH RPM for 7.3 to determine if it's the patched version.

I guess I should have mentioned that .. it's the 16september version. (16september 2003 that is).

Currently listening to: 06_STARGAZER Gerhard, == The Acoustic Motorbiker == -- __O Some scientists claim that hydrogen, because it is so plentiful, =`\<, is the basic building block of the universe. I dispute that. (=)/(=) I say there is more stupidity than hydrogen and that is the basic building block of the universe.