Heartbleed and OpenSSL

Viscosity Support (macOS)
1

Hi:

In light of the Heartbleed bug I’m looking at my windows and mac clients. For auditing purposes I need to be able to document how it is determined if a client needs to be upgraded. Specifically, my question is: in MacOS what openssl libraries does Viscosity use?

Currently on a Mavericks box, Mavericks has OpenSSL 0.9.8y. The box is also running Viscosity 1.4.6 (1156).

Does it use the system library 0.9.8y version of OpenSSL and thus I’m safe (0.9.8 branch doesn’t appear to be impacted)
or
Does Viscosity use it’s own OpenSSL library somewhere? If so, could someone please point me to where it is so I can manually look up the version (assuming it’s not directly compiled into the binary).

If it is directly compiled into the binary, where could I find documentation that indicates which binary versions run which versions of OpenSSL?

(The questions above also apply to Viscosity for Windows. I’ll x-post this in the Windows section in case it’s a different team monitoring that forum.

Thanks much everyone!

2

Hi vpnuser,

Version 1.4.7 of Viscosity for Mac and Windows use OpenSSL 1.0.1e, which is an affected version. Version 1.4.8 of Viscosity for Mac has been recently released which addresses the issue by upgrading to the latest version of OpenSSL (1.0.1g). The Windows version has not yet been released, however it will be very shortly, and a beta version can be downloaded in the meantime from:
https://www.sparklabs.com/forum/t/beta-latest-build-of-viscosity-for-windows/362/1

Viscosity uses its own statically compiled version of OpenSSL and does not use the 0.9.8 dynamic libraries included with Mac OS X. As far as I am aware there is no easy method to extract the version of OpenSSL being used from OpenVPN (unfortunately its version string does not list it). However a fairly safe assumption is that we’ve used the latest stable version of OpenSSL at the time OpenVPN was compiled (you’ll see the build date listed in the log in Viscosity’s Details window). Alternatively you can always shoot a quick email our way and we can confirm what version is being used.

Regards,
James

3

Fantastic - thank you very much for the detailed explanation. Will work perfectly.

Much appreciated.