Critical security vulnerability in IceSSL for .NET
ZeroC discovered this issue during an internal code review. At this time, we have not received any report from users nor are we aware of any incident where this issue may have been exploited.
IceSSL is Ice's secure transport plugin, used to encrypt communications using SSL/TLS. This security vulnerability affects only IceSSL for .NET, used by applications written in C# and Visual Basic.
During an SSL connection attempt, the .NET run time invokes a callback supplied by IceSSL to validate the remote certificate chain. .NET includes information about the validation steps that it has already performed on the chain; the callback can decide whether or not to ignore these issues. If the callback rejects the certificate chain, .NET aborts the SSL connection attempt. Assuming IceSSL's validation callback accepts the certificate chain, an application-supplied certificate verifier (if installed) will be invoked to give an Ice application the opportunity to perform its own examination of the certificate chain.
With this vulnerability, IceSSL's validation callback ignores an untrusted root CA certificate condition, but only for a self-signed certificate chain. This means an attacker's self-signed certificate would not be rejected even though its root CA certificate is untrusted, however the certificate may still be rejected for other reasons.
If your application installs a certificate verifier, it is only called after IceSSL has successfully validated the remote certificate chain. A certificate verifier is not invoked if IceSSL rejects a certificate chain. With this vulnerability, your verifier implementation may be invoked for a self-signed certificate whose root CA certificate is untrusted.
This vulnerability is present in all versions of Ice for C# from 3.3.0 to 3.5.1.
We recommend that you patch any affected application as soon as possible. You can download patched versions of the IceSSL .NET DLL for Ice 3.3.1, Ice 3.4.2 and Ice 3.5.1 at:
IceSSL-Dev-3.3.1.zip (for source builds)
IceSSL-Dev-3.4.2.zip (for source builds)
Ice 3.4.2 source patch
IceSSL-Dev-3.5.1.zip (for source builds)
Ice 3.5.1 source patch
To patch your application, you just need to replace
IceSSL.dll with the patched
IceSSL.dll. You do not need to rebuild your application or change anything else.
The Ice 3.5.1 installer for Windows has also been updated to include the patched DLL.