Do both client and server need to implement OpenSSL protections to protect from CBC attacks In regards to the protections implemented in OpenSSL 0.9.6d (described in section 2. http://www.openssl.org/~bodo/tls-cbc.txt). My understanding is that the mechanism prepends an empty record when sending data in order to make the IV unpredictable. however the client->server and server->client maintain separate IV data.

If relying on this mechanism to protect against CBC vulnerabilities (such as BEAST) is it required that both client and server have this mechanism enabled?
Yes, both the client and the server must have this mechanism enabled to get full protection from BEAST and similar attacks.

In particular, if the client is a browser with scripting capabilities, it is the client side implementation that must send empty packets before each content packet. Enabling this feature server side only, just means that the server will send such empty packets. This will provide no protection from script based attacks against browsers.