What does the phone's rom have to do with this? I've unlocked sprint treos for verizon. You just have to reprogram the prl on the cdma chip. No firmware/OS modification involved. Has something drastically changed, or does the op just not understand?
"The flaw, which lies in version 4.7 of OpenSSH on Debian/GNU Linux"
"Patterson said his group had worked with OpenSSH developers to mitigate the flaw, and that OpenSSH version 5.2 contained countermeasures."
They are unclear on whether or not it's only debian's repos that are affected, so I'd suggest upgrading to 5.2 or later.