JFYI,
portable OpenSSH < 3.7p1 is _not_ vulnerable.

----- Forwarded message from Damien Miller -----

Date: Tue, 23 Sep 2003 06:40:25 -0600 (MDT)
From: Damien Miller <djm@>
To: openssh-unix-announce@
Subject: Multiple PAM vulnerabilities in portable OpenSSH

This document can be found at:  http://www.openssh.com/txt/sshpam.adv

[...]
----- End forwarded message -----

-- 
ldv