MobileIron and Good confirm invulnerability to "Heartbleed" OpenSSL attack (updated with more providers)

Your rating: None (3 votes)

We've been following the recent disclosure of a massive OpenSSL bug and its affect on MDM. This is a potentially major issue for device management. Due to the trust chain of Apple's APNS, an exposed MDM server may require all devices to be unenrolled and reenrolled by hand.

We've heard good news so far (excuse the pun) from two three four providers:

Good Technology says:

Good Technology has confirmed that the versions of OpenSSL used by all Good servers and applications are not subject to the Heartbleed vulnerability.

MobileIron says (courtesy of EnterpriseiOS user MaciekSA):

  • All released versions of VSP, Sentry, Connector, Atlas, Connected Cloud and cloud-hosted BYOD portal are NOT affected by the vulnerability and NO action is required by our customers.
  • The on-premise BYOD Portal MAY by affected by the vulnerability, depending on the version of OpenSSL that is packaged with your version of Linux currently installed on your BYOD Portal server.

Update 4/10 5:50p: Maas360 is also fine.

Update 4/10 10:43p: AirWatch is also unaffected. See this VMWare KB article.

Update 4/11 4:02a: TARMAC is also unaffected. See this notice in German.

Update 4/14 2:25p: SOTI is also unaffected. See this notice.

I've reached out to other vendors but have not yet heard a response. If you have any news please share below, and I will update the thread.

It is worth repeating that the vulnerability is not the fault of the MDM vendor and not the fault of Apple. It's in a library of cryptographic functions that is very commonly used within other applications.

Recent Activity