Re: Heartbleed, clients and Android

[Eric Lacombe <goretux () gmail com>]

Hi,

Le mercredi 9 avril 2014 12:21:29, Hanno Böck a écrit :
[...]
> > > Because the latter
> > > would include Android. We are all pretty aware that android updates
> > > are in large parts nonexistent.
> >
> > I don't have much clue about Android, but I think I heard heartbeat
> > was disabled in Android, but I don't have a link right now. Also, I'm
> > unsure what actually use libssl in Android and what uses NSS.
>
> Seems Android disabled Heartbeat in 2012:
> https://android.googlesource.com/platform/external/openssl.git/+/android-4.1
> .2_r1
>
> Still leaves some android versions as potentially vulnerable.

A recent post from Google security blog

http://googleonlinesecurity.blogspot.fr/2014/04/google-services-updated-to-address.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed:
+GoogleOnlineSecurityBlog+(Google+Online+Security+Blog)

Regards,

        Eric