1

The title pretty much says it. Do the security patches to address the gotofail security issue in multiple Apple products employing SSL change the User Agent string for the respective systems? And, of course, what is the demarcation point between patched systems and unpatched systems with the build number in the UA string? I don't have iDevices lying around to empirically test this, so I'm hoping some of the professionals here know the answer. Ideally, I'd like to be able to mitigate the risk of users hitting an OWA server with unpatched devices over public wireless networks by rejecting unpatched user agents.

Yes, I know this is not foolproof, but I'm trying to protect against ambivalent users, not malicious ones.

1

The user agent string will allow you to select possible candidate browsers; only select browsers on select operating systems can be vulnerable. But it can't detect whether or not the operating system has been patched, since that detail is not reported in the UA string.

A site has been set up to allow you to test your browser yourself:

https://gotofail.com/

This check attempts to load a resource using a key that doesn't match the certificate. If the resource loads without warning, then the browser is vulnerable. If it fails, then the browser correctly detected the mismatch.

gotofail.com test example output

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.