Well OpenBSD was never vulnerable. :-)
The problem is that Linux' malloc implementation doesn't by default protect against people calling free() twice in a row on the same memory. The *BSD family does.
There is a tunable environment variable MALLOC_CHECK_ which can be set in Linux to values from 0-2 to detect simple errors like this and optionally do nothing, report on STDERR, or crash. Set that in obvious global places, update zlib, and restart. That will block *most* of this, and help with several other problems.
In general for statically linked stuff, I would focus on machines and applications which are exposed to the network or files from there. (Like, say, OpenSSH.) As it stands, you can deliver a DoS this way, but exploitability seems somewhat remote. Since local users can do a local DoS fairly easily (unless you have paranoid ulimits set), remote users are the main risk.
And perhaps it would be a good idea to have OpenBSD on any machine directly on the general network? :-)
Cheers,
Ben
