Can I reliably identify Apple devices that have not patched against the gotofail vulnerability based on user agent string?

Question

The title pretty much says it. Do the security patches to address the gotofail security issue in multiple Apple products employing SSL change the User Agent string for the respective systems? And, of course, what is the demarcation point between patched systems and unpatched systems with the build number in the UA string? I don't have iDevices lying around to empirically test this, so I'm hoping some of the professionals here know the answer. Ideally, I'd like to be able to mitigate the risk of users hitting an OWA server with unpatched devices over public wireless networks by rejecting unpatched user agents.

Yes, I know this is not foolproof, but I'm trying to protect against ambivalent users, not malicious ones.

Answer 1

The user agent string will allow you to select possible candidate browsers; only select browsers on select operating systems can be vulnerable. But it can't detect whether or not the operating system has been patched, since that detail is not reported in the UA string.

A site has been set up to allow you to test your browser yourself:

https://gotofail.com/

This check attempts to load a resource using a key that doesn't match the certificate. If the resource loads without warning, then the browser is vulnerable. If it fails, then the browser correctly detected the mismatch.