Lion sshd vulneribility

Question

To keep PCI DSS Compliance for our home business our mac mini is probed quarterly for security vulnerabilities. We use ssh to remotely login. The Lion 10.7.3 ssh version supplied is OpenSSH5.6. When we attempt to login, Lion launches sshd (which reports as OpenSSH5.6). The security scans report a vulneribilty in OpenSSH5.6:
"Description: OpenSSH 5.6 is vulnerable Severity: Area of Concern CVE: CVE-2011-0539 Impact: This document describes some vulnerabilities in the OpenSSH cryptographic login program. Outdated versions of OpenSSH may allow a malicious user to log in as another user, to insert arbitrary commands into a session, or to gain remote root access to the OpenSSH server. Resolution Upgrade to [http://www.openssh.org] OpenSSH version 5.8 or higher, or install a fix from your operating system vendor. Vulnerability Details: Service: ssh"
If we use macports to upgrade to OpenSSH5.9, it only upgrades our user OpenSSH version, NOT the system OpenSSH version. Lion seems to allow only login to the system OpenSSH. The sshd version in Lion is a modified version of OpenSSH5.6.
We tried to replace the system version with the macports version but lost the ability to successfully login because we cannot properly coordinate authentication/password processing. The macports version includes the PAM and Kerberos dependencies.
We are looking for some help to keep us PCI DSS compliant and allow remote login using ssh.
Running OS X 10.7.3

Answer 1

I've continued to try to get the OpenSSH5.9p1 to run sshd and authenticate properly. I set it up on another port. Running it is easy but figuring out how to get the authentication process properly set up is a challenge so far.
I checked that the system was using the new versions:
$ which ssh sshd ssh-agent ssh-add
/opt/local/bin/ssh
/opt/local/sbin/sshd
/opt/local/bin/ssh-agent
/opt/local/bin/ssh-add
But from anywhere if I:
$ssh -p newport -v me@home_ip_address
OpenSSH_5.9p1, OpenSSL 1.0.1a 19 Apr 2012
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.9
debug1: match: OpenSSH_5.9 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.9
debug1: Next authentication method: password
me@home_ip_address's password:
debug1: Authentications that can continue: publickey,password,keyboard-interactive
Permission denied, please try again.
me@home_ip_address's password:
When I use the system version I am prompted with:
debug1: Next authentication method: keyboard-interactive
Password:
debug1: Authentication succeeded (keyboard-interactive).
I though password authentication was keyboard interactive. Maybe it's challenge  response authentication. I'm looking into this to see if that's what I need to change.
On a related topic I noticed that in debug mode there were identity files that had a different value at the end of the line. I'm not sure what that's telling me, particualrly the first one which is "1" in the user version and "-1" in the system version.
User process:
debug1: identity file /Users/me/.ssh/id_rsa type 1
debug1: identity file /Users/me/.ssh/id_rsa-cert type -1
debug1: identity file //Users/me/.ssh/id_dsa type 2
debug1: identity file /Users/me/.ssh/id_dsa-cert type -1
debug1: identity file /Users/me/.ssh/id_ecdsa type -1
debug1: identity file /Users/me/.ssh/id_ecdsa-cert type -1
System process:
debug1: identity file /Users/me/.ssh/id_rsa type -1
debug1: identity file /Users/me/.ssh/id_rsa-cert type -1
debug1: identity file /Users/me/.ssh/id_dsa type 2
debug1: identity file /Users/me/.ssh/id_dsa-cert type -1
debug1: identity file /Users/me/.ssh/id_ecdsa type -1
debug1: identity file /Users/me/.ssh/id_ecdsa-cert type -1
Any clues or pointers are appreciated.