Comment on OpenSSL Security Advisory: TLS heartbeat read overrunComments−0x012yAre Android or iOS affected? Android seems to ship openssl 1.0.Could a malicious server attack clients? Perhaps expose a browser's cookie jar or other saved passwords in memory?The number of installed openssl clients across all devices and computers must be quite large.−lxgr12yIt seems that Android has dodged this bullet by compiling OpenSSL with NO_HEARTBEATS: https://twitter.com/agl__/status/453472368589942785−welder12yYes, the vulnerable code is used by both client and server so any client using openssl is affected.−biafra12yWhich parts of Android really use OpenSSL to do TLS with this heartbeat feature enabled?The browsers? All Apps running on Dalvik? All apps running on ART?−hrrsn12yOpenSSL doesn't seem to be installed on my jailbroken iPhone.
Comments
Are Android or iOS affected? Android seems to ship openssl 1.0.
Could a malicious server attack clients? Perhaps expose a browser's cookie jar or other saved passwords in memory?
The number of installed openssl clients across all devices and computers must be quite large.
It seems that Android has dodged this bullet by compiling OpenSSL with NO_HEARTBEATS: https://twitter.com/agl__/status/453472368589942785
Yes, the vulnerable code is used by both client and server so any client using openssl is affected.
Which parts of Android really use OpenSSL to do TLS with this heartbeat feature enabled?
The browsers? All Apps running on Dalvik? All apps running on ART?
OpenSSL doesn't seem to be installed on my jailbroken iPhone.