FC4 source rpm of openssh-4.2p1 with added recent security fixes is available at ftp://ftp.harddata.com/pub/Legacy_srpms/. At least patches for cve-2006-4924 and cve-2006-5051 do not really differ from what you can find in recent RHEL updates so these can likely be applied (close to?) "as is" in earlier distros as well. Michal