Problem with 2.5.1p1 client protocol v2

[Chris Adams]

I have installed 2.5.1p1 on two systems, one running Digital Unix 4.0F
and the other running Red Hat Linux 7.0.  I am having trouble connecting
using the 2.5.1p1 client and the version 2 protocol.

Here is a connect attempt from the Linux box (this is after I blew away
my ~/.ssh directory to make sure there was no "cruft" in it).  Note that
this also has the all zero key fingerprint that someone else just
reported.

************************************************************************
Script started on Mon Feb 19 22:28:27 2001
cmadams:1:~$ ssh -2 -v -v -v fly
OpenSSH_2.5.1p1, SSH protocols 1.5/2.0, OpenSSL 0x0090581f
debug: Reading configuration data /etc/ssh/ssh_config
debug: ssh_connect: getuid 500 geteuid 0 anon 0
debug: Connecting to fly [208.147.154.56] port 22.
debug: Allocated local port 1022.
debug: Connection established.
debug: identity file /usr/local/home/cmadams/.ssh/id_dsa type 3
debug: Remote protocol version 1.99, remote software version OpenSSH_2.5.1p1
debug: match: OpenSSH_2.5.1p1 pat ^OpenSSH
Enabling compatibility mode for protocol 2.0
debug: Local version string SSH-2.0-OpenSSH_2.5.1p1
debug: Seeding random number generator
debug: send KEXINIT
debug: done
debug: wait KEXINIT
debug: got kexinit: diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
debug: got kexinit: ssh-dss,ssh-rsa
debug: got kexinit: 3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes128-cbc,aes192-cbc,aes256-cbc,rijndael128-cbc,rijndael192-cbc,rijndael256-cbc,rijndael-cbc at lysator.liu.se
debug: got kexinit: 3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes128-cbc,aes192-cbc,aes256-cbc,rijndael128-cbc,rijndael192-cbc,rijndael256-cbc,rijndael-cbc at lysator.liu.se
debug: got kexinit: hmac-sha1,hmac-md5,hmac-ripemd160,hmac-ripemd160 at openssh.com,hmac-sha1-96,hmac-md5-96
debug: got kexinit: hmac-sha1,hmac-md5,hmac-ripemd160,hmac-ripemd160 at openssh.com,hmac-sha1-96,hmac-md5-96
debug: got kexinit: none,zlib
debug: got kexinit: none,zlib
debug: got kexinit: 
debug: got kexinit: 
debug: first kex follow: 0 
debug: reserved: 0 
debug: done
debug: mac_init: found hmac-sha1
debug: kex: server->client 3des-cbc hmac-sha1 none
debug: mac_init: found hmac-sha1
debug: kex: client->server 3des-cbc hmac-sha1 none
debug: Sending SSH2_MSG_KEX_DH_GEX_REQUEST.
debug: Wait SSH2_MSG_KEX_DH_GEX_GROUP.
debug: Got SSH2_MSG_KEX_DH_GEX_GROUP.
debug: bits set: 1004/2049
debug: Sending SSH2_MSG_KEX_DH_GEX_INIT.
debug: Wait SSH2_MSG_KEX_DH_GEX_REPLY.
debug: Got SSH2_MSG_KEXDH_REPLY.
The authenticity of host 'fly (208.147.154.56)' can't be established.
RSA key fingerprint is 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'fly,208.147.154.56' (RSA) to the list of known hosts.
debug: bits set: 1041/2049
xfree: NULL pointer given as argument
debug: Calling cleanup 0x8060670(0x0)
cmadams:2:~$ 
Script done on Mon Feb 19 22:28:39 2001
************************************************************************

I can successfully connect to the 2.5.1p1 server using protocol version
2 if I use a OpenSSH 2.3.0p1 client, but the 2.5.1p1 client always fails
when trying protocol version 2 (even when connecting to a 2.3.0p1
server).

Any ideas?
-- 
Chris Adams <cmadams at hiwaay.net>
Systems and Network Administrator - HiWAAY Internet Services
I don't speak for anybody but myself - that's enough trouble.