0

Our software we develop uses the Indy internet component suite in Delphi. Indy has capabilities for OpenSSL. Since the Heartbleed incident, we're wondering if we need to take action.

We distribute 2 DLL's with our software which are for OpenSSL (which Indy uses): ssleay32.dll and libeay32.dll.

Question: Do we need to get and distribute updated/fixed versions of these DLL's? Or will this be patched with Windows Updates?

This is using Indy version 10, and the DLL's don't have any version information, just shows 1.0.0.0 and a date of 9/20/2010.

Essentially, is the problem on the software level or the operating system level?

9
  • You have not provided enough information. You don't indicate what version of OpenSSL your using only certain versions are vulnerable. Only you can determine if your using a vulnerable version. If you are it means that you should revoke the certificates after you update the client.
    – Ramhound
    Apr 12 '14 at 1:59
  • I honestly know nothing about it, just that Indy has it integrated into it and an Indy component we use requires these DLL's. Also, the version doesn't matter with my question. I'm basically asking is the problem exposed in any version of any OpenSLL implementation, or is it something in Windows. Apr 12 '14 at 2:01
  • You need to determine all of that before we can help. You can't just simply update the files, if this component except a certain version, it will no longer work.
    – Ramhound
    Apr 12 '14 at 2:04
  • @Ramhound I know I can't just replace the files. Please see the edits in my question. What really matters is whether the issue requires fixes in the application or the operating system. Apr 12 '14 at 2:14
  • Your edits don't provide the information I required to answer the question. If you are asking "or the operating system" it means you don't understand the Heartbleed bug.
    – Ramhound
    Apr 12 '14 at 2:24
1

The biggest problem with "Heartbleed bug" will be on the server side (websites). Though clients are affected too, it is much less possible that someone will misuse that.

You can use Indy original SSL distribution from http://indy.fulgan.com/SSL/ You can find "openssl-1.0.1g" here which are the latest and fixed libraries. It should be fully compatible with Indy. You can just replace files and forget about this problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.