3

This question already has an answer here:

There has been a big vulnerability discovered in OpenSSL today, are android applications affected, and what can we do to get a secure version?

What about people with older devices (such as the HTC desire HD I have) that are on old android versions (2.3.5), is it possible (for example) to get a up to date browser that doesn't use the installed openSSl, or to get security releases to old versions of android?

marked as duplicate by Flow Apr 8 '14 at 20:47

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

3

Android devices are only susceptible to this bug if they connect to servers which have not updated their server-side OpenSSL components. If the server component of OpenSSL is secure, no data is leaked. Therefore the main focus of this vulnerability is to server admins, not individual users.

Most probably this can be fixed with app updates as a temporary fix, but it will be incorporated to future OS updates. The release of OS upgrades is impossible to predict yet and depends on the manufacturer and carriers.

1

From the article you posted:

OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable
OpenSSL 1.0.1g is NOT vulnerable
OpenSSL 1.0.0 branch is NOT vulnerable
OpenSSL 0.9.8 branch is NOT vulnerable

According to the Security Enhancements in Android 4.2 article, Android started using OpenSSL 1.0.1 as of version 4.2. This means that older Android versions (like 2.3.x on your device) are probably not vulnerable to this attack. It's really difficult to say for certain, since there is no definitive way to find out the actual version of OpenSSL used, since each vendor is free to modify it and implement their own version numbering if they so wanted.

Not the answer you're looking for? Browse other questions tagged or ask your own question.