openssl-0.9.6c-2.woody.0 not vulnerable, right?

["Alan Su" <alsu@cs.ucsd.edu>]

i just want to check on something here.  when i first upgraded to
woody, i read <http://www.debian.org/security/2002/dsa-136>.  this
advisory seems to indicate that the 0.9.6c version of openssl that is
in woody has been patched to eliminate the widely-discussed
vulnerability in openssl versions before 0.9.6e.  in other words, i
believe that even though the base version of the openssl code that was
used to build this package is vulnerable, the code was patched before
the package was built.

the cert advisory released today
(<http://www.cert.org/advisories/CA-2002-27.html>) appears to describe
a worm which exploits this vulnerability, and i'd just like to make
sure that the assumptions i'm making are correct.  thanks!

-alan