When I run rkhunter -c I'm getting...

- GnuPG 1.4.2 [ Unknown ]
- GnuPG 1.2.1 [ Old or patched version ]
- OpenSSL 0.9.7a [ Old or patched version ]
- OpenSSH 3.6.1p2 [ Old or patched version ]

I'm running RHEL3 and up2date does not seem to have any updates for these. Can someone point me in the right direction as to how to update these?

up2date -u

As long as that is updated you are fine. The issue lies with how rkhunter checks for vulnerable version, it simply checks version numbers. Redhat on the other hand patches things but does not update the version numbers, it is a huge pain but that is how it goes. you are fine as long as up2date shows you are updated.

Thanks!