There has been a big vulnerability discovered in OpenSSL today, are android applications affected, and what can we do to get a secure version?
What about people with older devices (such as the HTC desire HD I have) that are on old android versions (2.3.5), is it possible (for example) to get a up to date browser that doesn't use the installed openSSl, or to get security releases to old versions of android?
Android devices are only susceptible to this bug if they connect to servers which have not updated their server-side OpenSSL components. If the server component of OpenSSL is secure, no data is leaked. Therefore the main focus of this vulnerability is to server admins, not individual users.
Most probably this can be fixed with app updates as a temporary fix, but it will be incorporated to future OS updates. The release of OS upgrades is impossible to predict yet and depends on the manufacturer and carriers.
From the article you posted:
OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable
OpenSSL 1.0.1g is NOT vulnerable
OpenSSL 1.0.0 branch is NOT vulnerable
OpenSSL 0.9.8 branch is NOT vulnerable
According to the Security Enhancements in Android 4.2 article, Android started using OpenSSL 1.0.1 as of version 4.2. This means that older Android versions (like 2.3.x on your device) are probably not vulnerable to this attack. It's really difficult to say for certain, since there is no definitive way to find out the actual version of OpenSSL used, since each vendor is free to modify it and implement their own version numbering if they so wanted.
