Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The title pretty much says it. Do the security patches to address the gotofail security issue in multiple Apple products employing SSL change the User Agent string for the respective systems? And, of course, what is the demarcation point between patched systems and unpatched systems with the build number in the UA string? I don't have iDevices lying around to empirically test this, so I'm hoping some of the professionals here know the answer. Ideally, I'd like to be able to mitigate the risk of users hitting an OWA server with unpatched devices over public wireless networks by rejecting unpatched user agents.

Yes, I know this is not foolproof, but I'm trying to protect against ambivalent users, not malicious ones.

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

The user agent string will allow you to select possible candidate browsers; only select browsers on select operating systems can be vulnerable. But it can't detect whether or not the operating system has been patched, since that detail is not reported in the UA string.

A site has been set up to allow you to test your browser yourself:

https://gotofail.com/

This check attempts to load a resource using a key that doesn't match the certificate. If the resource loads without warning, then the browser is vulnerable. If it fails, then the browser correctly detected the mismatch.

gotofail.com test example output

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.