there is an OpenSSH advisory along with a patch to buffer.c describing the
vulnerability.

http://www.openssh.com/txt/buffer.adv


On Tue, 16 Sep 2003, Mark wrote:

>Date: Tue, 16 Sep 2003 04:52:11 -0500 (CDT)
>From: Mark <mindfunk@mindfunk.net>
>To: netbsd-help@netbsd.org
>Subject: SSH vuln
>
>
>Does anyone have any _credible_ info on the openssh vulnerability?
>Everything I've seen has been a "so-n-so said" kind of thing.
>
>namaste,
>Mark
>
>PS - An entry way to all the fuss is @
>http://slashdot.org/articles/03/09/16/1327248.shtml?tid=126&tid=172
>
>