[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: OpenSSH Debian and the Trojan



Kris wrote:

> Just last night I updated my debian packages via ftp.debian.org and OpenSSH
> was updated to ssh 3.4p1-1 is it possible that this was Trojaned via the
> news from openssh this morning that there packages were Trojaned and could
> have it.

According to the published analysis, the trojan affects only the system
where the package is built, not the resulting binaries. Even if Debian's
ssh package had been built from a trojaned package, in this case users
of the resulting package would not be at risk. In any case, it appears
that Debian's ssh package was built from a non-trojaned source.

Just FYI, the period character "." is supposed to be used at the end of
each sentence, not just at the end of your message.

Craig

Attachment: pgpBrxvsENnmz.pgp
Description: PGP signature


Reply to: