[cobalt-security] Re: SSH Packages

["Rhys Lewis" <rhys@xxxxxxxxxx>]

> Have you checked out the ones at Solarspeed.net?
>
> http://www.solarspeed.net/downloads/index.php
>
> James
>

I've looked there and various other places, but they seem to be built on
vulnerable versions.  For example the solarspeed.net one uses
OpenSSL-0.9.7b, which is affected as described here:

http://www.openssl.org/news/secadv_20040317.txt

The advisory was 17 March 2004, but most package sites don't seem to have
been updated since last year.  Perhaps it's because Sun has EOLed the RAQs?

If the worst comes to the worst I could uninstall the package and try to
compile it myself, but I seem to remember there were libraries it needed,
and they needed libraries and so on...

Rhys