as a point of reference: this is the reason that major vendors dont usually accept patches ad-hoc.

Something like this company wide would be a major PITA.

How can I tell whether OpenSSL was upgraded when I did this? I still get the following results:

  # ssh -V
  OpenSSH_4.6p1 Debian-5ubuntu0.5, OpenSSL 0.9.8e 23 Feb 2007

  # openssl
  OpenSSL> version
  OpenSSL 0.9.8e 23 Feb 2007

Those are the same results I got before I upgraded. Does that mean that I'm not running the new versions, or is there some sub-version information that isn't printed? Something definitely did change, because <ssh-vulnkey> is now installed, and it runs.

Yes, there is deb package specific version info that won't show up in the vendor commands. Try 'dpkg -l openssh-server', or look in the Debian changelog for the package. For example:

$ dpkg -l openssh-server
||/ Name Version Description
+++-==============-==============-============================================
ii openssh-server 1:4.7p1-10 secure shell server, an rshd replacement

The part after the dash (-10) is the Debian specific release number. It says this is the 10th version of the Debian package for openssh 4.7p1.

_________________
The irony is that Bill Gates claims to be making a stable operating system and Linus Torvalds claims to be trying to take over the world.
-- seen on the net