OpenSSL 0.9.7a seems to be vulnerable (was: Re: LKM Trojan)

["scootgirl.com" <zolkat79 dslextreme com>]

----- Original Message ----- 
From: "Rahul Sundaram" <rahulsundaram gmail com>
To: "For users of Fedora Core releases" <fedora-list redhat com>
Sent: Tuesday, November 30, 2004 4:22 PM
Subject: Re: LKM Trojan


> Hi
>
>
> > I used to have lots of false positives , so I just quit using chkrootkit
> > (as my machine isnt all that sensitive and I secured it the best I 
> > can..)..
>
> rkhunter (ww.rootkit.nl) can be a  nice alternative




Hi Rahul,

I used that tool and it said everything on my system was OK except the 
following:

[16:55:09] Scanning OpenSSL...
[16:55:09] /usr/bin/openssl found
[16:55:09] Version 0.9.7a seems to be vulnerable (if unpatched)!

I wonder if this is a false positive since I use the up2date tool 
frequently. If not, where can I get this patch?

Thanks,

Karen
http://scootgirl.com/