[gentoo-dev] OpenSSH Security Fix.

[Chris Davies]

Hi,

I haven't seen anything in bugs or this list about this, so here is the 
news:
CERT have issued an advisory about OpenSSH, the bug in question enables 
existing users to gain root privelidges.
The advisory is here: http://www.pine.nl/advisories/pine-cert-20020301.txt
The fix is to upgrade to the latest OpenSSH (3.1p1) ASAP.
May I politely suggest that a new ebuild be constructed post-haste? :)
Anyway, for those at risk, I have constructed an emergency ebuild and 
digest file, so you may upgrade immediately.
The files can be found here: http://www.cdavies.org/gentoo/

Put the digest file in /usr/portage/net-misc/openssh/files and the 
ebuild in /usr/portage/net-misc/openssh and rerun emerge openssh.

If anyone thinks it is worthwhile, I will also post this message to the 
gentoo users list, but at present I'm not going to do that.
Thanks,
C.Davies
(c.davies@×××××××.org)