[vox] The OpenSSH "exploit" is still being discussed...

[ME]

Just an FYI, there has been discussion on /. (slashdot) about a "new
openssh exploit in the wild"

Some people have posted statements about a worm.

Though a new version of openssh (3.7.1p1) is out, and I think Debian
(stable) , and RedHat both now have new packages out to provide fix for
the buffer allocation issue that some think are being exploited, there is
dissention among people about this patched code actually being the hole
that is alegedly being exploited.

So there is a hole, and it is exploitable or it isn't.
And there is either a worm exploiting this hole or there isn't.

Either way, you may wish to consider upgrading as a form of insurance, but
consider that if there is a hole being exploited, it is possible that this
fix is not the fix for the exploit in the wild (assuming it exists.)

Clear as mud?
Heh

-ME