WARNING! Civ4 Ships With Critical Security Vulnerabilities!

[CivIndeed]

Originally posted by Error404
Very very interesting answers... really! But you forgot just a thing or two...

1. First of all: you've to be connected. It could be. But it could be not. And if I'm not connected what's the vulnerability? *None at all*. Maybe you'll find this solution a bit crude but I find it very interesting...

No, you dont have to be connected. At the very least, Civ 4 is locally exploitable. At the very most, its remotely exploitable.

Reading works - read the original post and linked security advisories again.

2. We are talking about vulnerabilities of DOS attack. Not a dark person controlling my computer secretly and doing what he/she wants from the other corner of the world without possibility of my defence. Someone could make a non-right-handled-error-request to my civ4.exe application (that must be running - *must be*, it's not enough to have it installed) and make it crash. Do you realize how many *billions* other program could make it???? (I mean a DOS attack)

Actually, again, we are talking about (potentially) a "dark person controlling my computer". Thats what "remotely exploitable with the ability to execute arbitrary code" means.

If you had read the original post..and the linked security advisories...

Heres another one, just for "fun":

http://secunia.com/advisories/15949/

"Impact: DoS, System access

Where: From remote

Solution Status: Vendor Patch"


"The vulnerability is caused due to a boundary error in inftrees.c when handling corrupted compressed data streams. This can be exploited to crash any application that uses the zlib library, or potentially to execute arbitrary code with privileges of the vulnerable application.

The vulnerability has been reported in version 1.2.2. Prior versions may also be affected."

zlib version 1.2.2 ships with Civ 4.

3. Even if I'm connected and I'm running my cIV game in singleplayer, this hacker have to bypass my firewall - a very restrictive firewall I do not autorize any program to access internet if I'm not the one using it. So a DOS attack directed to the civ4.exe application is completely harmless without my will.

You seem to not understand/forget that the attack could (would most likely) happen within the context of an already established multiplayer session - since its application layer data, the firewall would pass the bad data packets along with all the other packets to Civ 4, since the bad data packets appear otherwise normal and legit.

Yes, not playing multi would reduce the attack surface, but you would still be locally vulnerable - a corrupted play by email file, a corrupted save game file, corrupted mod file, etc etc.

In conclusion, the only possibility remaining is when I'm playing an on-line game.

Incorrect. Locally and remotely exploitable (depending on the application). What do you think zlib is there for? Nose picking? They use it to compress data for saved games, network data transfer, etc etc.

And dont forget that the PYTHON24.DLL file also contains insecure zlib code - built right into it.

And what could be happen? My computer will crash. Ok, I lived 30 years with Windows that makes it possible every single moment of my life, I can stand it. ehehe

Two possibilities:
1) Civ 4 crashes/closes.
2) Civ 4 crashes/closes and/or arbitrary code execution occurs, leading to remote system control

You folks really need to learn to read, and read comprehensively.

P.S.
However, as I said in my first post, those news you brought are usefull indeed and I've already updated everything. I was only complaining about the tone you used to say it... let's say just a little bit catastrophic for me...

When you are more concerned about the messenger rather than the message..well..good luck in life.

P.P.S.
I'm sorry for my - not so bright - english, it's not my native language...

Just keep in mind that its going to limit and frustrate your attempted communications.

[CivIndeed]

Originally posted by Cambo67
CivIndeed, you certainly know how to antagonise people....

You also show a complete ignorance of how software actually works, and what can be accessed via the 'Net.



Cambo
(PC Engineer & MilSim programmer)

Well, its a good thing you made your case for my ignorance.

You should explain to everyone the specifics of my ignorance.

Clearly though, you are not ignorant of how software actually works - it says "PC Engineer & MilSim programmer", and, just like your previous declaration without substantiation, if you declare it, it must be true.

Next.

[CivIndeed]

Originally posted by Stromprophet


I love this part.

You can talk all you want about these technical issues. (Which I don't give a crap I've been playing a lot and nothing has happened, even if it did I make enough money in a week to buy a brand new computer and I wouldn't give a crap.)

Yes yes, another self declared computer millionaire. One in every thread.

And yes, its true, i can talk about "these technical issues" - well, until i cant. Death, dismemberment, account banning, etc, all have a major impact on internet communications for the individual.

More specifically about playing the game.

I just know the forthcoming intelligence will be overwhelming......

Unless you are Kaak, or Eyes. Or someone who played on the ladders for Civ I, II, and III and actually achieved number 1. I don't want to hear it.

The ladders for Civ 1 eh? Oh, right, i forgot about the multiplayer add-in that allowed you (assuming you had 2MB of LIMS 4.0 Expanded Memory available (version 3.2 was not compatible), and a 1200 Baud Hayes compatible modem in direct connect mode) to make absurd silly claims that cant possibly be true and make absolutely no sense in this physical reality.

Oh oh, oh, right..the...Civ 1 ladder...in his basement! He and his buddy Fred would see how long it would take before their civs were split into two after their capitals were taken, eventually decimated by the mongols in 240 BC with battleships off their coast, and then buried in the sands only to be discovered later! Oh yeah, everyone knew about that dude! totally!

Im with you dude...im with you!

Ah yes, nothing like cyber male posturing in league with absurd assertion making...

I wonder, did you ever even play against the best players? I did. WhoTF are you? This kind of freaking nonsense is what makes something enjoyable less appealing.

The best? Well, i tried to play against myself, but i just ended up playing with myself.

I had just spent WAYYY too much time trying to figure out what the heck that whole WinG thing was when DirectX was already around before i realized it was lots of fun to walk around the globe via that "land bridge" that always seemed to be there at the top and bottom of the world....

For a second there, I thought you were going to cry. Dont let me hold you back.

Let it all out. Its horrible that someone would ever do such a thing, as post a message about security vulnerabilities in a game, and then have the nerve to mock someone for being a dumbass.

B.S. Mechanical Engineering, M.S. Mechanical Engineering
Purdue University
Project Manager/System Designer

I love this part.

You know, the part where someone appends their real or pretend or supposed "credentials" as their signature. Its what makes cyber male posturing the absurdity that it is.

Its almost as good as the part where they almost cry because someone mocked someone else.

Next.

[Cambo67]

Well, I suppose, if you think you are such an expert on all this, perhaps you could supply an example programme which shows how these dangerously insecure libraries can be exploited....



Cambo

PS. Moderators, could we change this guys nym to UnCivIndeed? ;-)

[CivIndeed]

Originally posted by seebs
Mr. Indeed does not seem to understand how the zlib buffer vulnerability works.

Oh, no doubt. Im sure you are going to correct and refute all the many security advisories and bulletins about the nature of the zlib flaws, and set me straight.

Here goes:

It would allow any of the compressed files the game uses to be specially altered to, uhm, change the behavior of the game.

Would the game crashing to the desktop or abruptly terminating be a "changed behavior"? Ah, probably not, considering the abysmal code quality of the game as released, and the many many reports of constant CTDs...

Perhaps you could expound some more on what that "changed behavior" would be, aside from say, abrupt termination, and/or complete system takeover after execution of arbitrary code?

Well, its a good thing you set me straight.

A thoughtful well-sourced and substantive "straightening".

Admittedly, this could be an issue for some mods, so they should fix it.

I'm sure the only time the game ever uses the compression functionality of zlib is when working with mods. At no other time, say, for game saving/loading, RAM data compression, network data compression, etc, is the zlib code ever used.

Nope, just "mods".

Very contributory.

Next.

[CivIndeed]

Originally posted by Darg
Dear god.. people like indeed shouldn't be allowed access to the outside world.

Yeah! What with the way i......post.....messages..on a...message...board!

Not to mention that crazy security stuff! who cares about security???? We dont need no stinkin' security!

Keep your security advisor links to yourself dude..LOOSER!

In fact that's a great idea. If you're so scared of DoS attacks then go disconnect your computer from the net and don't ever plug it in again. Please!

I'll trade you a straw man for a feminized absurd assertion? Deal?

I sure as hell know that running Morpheus or Limewire opens my computer up to a hell of a lot more security vulnerabilities then Civ4 ever could and I have no problem using it.

Well, heck, if you Morpheus is insecure, and LimeWire is insecure, that means Civ 4 is secure!

Yeah yeah..i read that in my internet logic class:

If A is Z and If B is Z, then C is not Z!

Or, something otherwise totally nonsensical and irrelevant.

I felt compelled to respond to this thread because i dont really have much to say, i just want everyone to know i know how to use a P2P application and stuff.

..............

If worst comes to worst I get a trojan that Norton can't fix and I have to format my C Drive.

Or your hard drive can be formatted for you - remotely.

Im just wondering, if security doesnt really matter to you and is "no big deal" (after all, you dont care about reformatting after being exploited), why do you have an AntiVirus program?

Is it because all the cool kids have Norton, and you want to be cool like them?

So what? I have all my programming projects and graphics work backed up.

And i bet you have lots of spare time and energy available to reinstall windows, all the windows updates, all your programs, all the program updates, reset all the settings because those freaking M$ winDOZE settings never transfer properly, and copy all the document and data files back their appropriate storage locations.

Obviously you do.

Jesus.. I hate people like you. And I'm a nice kinda guy.

Dang me for taking the time and making the effort to inform Firaxis, 2K, and the Civ 4 using (or potentially using) public, about a significant security vulnerability in their product as shipped.

DANG ME!

If i knew what was decent and proper i would have said nothing at all..to anyone. Ever. I should have suffered with the knowledge of what i had discovered...alone...forever

Make sure you take the full pill this time - you know your mom gets upset when you only take half...

[CivIndeed]

Originally posted by Cambo67
Well, I suppose, if you think you are such an expert on all this, perhaps you could supply an example programme which shows how these dangerously insecure libraries can be exploited....

Sorry, no can do.

I dont supply anything in franglais.

[Cambo67]

"programme" is proper Anglo-Saxon English ;-)



Cambo

[Once]

WARNING! CivIndeed ships with critical insecurity vulnerabilities!

[uglyduck]

Originally posted by Once
WARNING! CivIndeed ships with critical insecurity vulnerabilities!

..... and also intrusive copy protection!!

[CivNonFreak]

Originally posted by CivIndeed


Oh, clearly.



Perhaps you need a refresher course on "Hurried Reading" - or perhaps you should simply take the time to do the minimal reading necessary to respond appropriately.

"There is a buffer overflow in the zlib data-compression library caused by a lack of bounds checking in the inflate() routine. If an attacker supplies the inflate()routine with a specially crafted compressed data stream, that attacker may be able to trigger the buffer overflow causing any application linked to zlib, or incorporating zlib code to crash. According to reports, the buffer overflow is caused by a specific input stream and results in a constant value being written into an arbitrary memory location. This vulnerability may be exploited locally or remotely depending on the application being attacked."

"A remote attacker be able to exploit this vulnerability by supplying the inflate() routine with specially crafted compressed data. As a result, applications linked to the zlib library may abruptly and abnormally terminate resulting in a denial-of-service condition. According to public reports, this vulnerability can be exploited to execute arbitrary code, but we have not confirmed this."

Remotely exploitable (depending on the application), and allows a DoS scenario, and/or an arbitrary code execution.

That would be "zombie making".

It all depends on how the zlib functionality is used. Network data compression? File Save/Load? Mod/scenario processing? general data compression within RAM?



And it is insecure.



Well, obviously, to frustrate deep thinkers such as yourself.

And to practice my straw-man identification and mockery skills.



I'd like to know what standard you are applying in order to make this claim.

But, there are many people, who would insist that Conquests, their most recent Civ code release prior to Civ 4, is still extremely buggy, and remains unpatched, to this day.

There is a pretty long extensive list of all the still-unpatched bugs and errors in Conquests somewhere "these parts".



Probably. The released version of this game is clearly and most definitely unfinished (regardless of the understandable reason why in terms of 2K's schedule shift).

I doubt the outdated insecure third party code library issue will be addressed in this first patch, which will only make the situation worse for them.



Good luck with that. Firaxis is a small company, and Take Two/2K is handling their support, and they arent much bigger. Reports ive read elsewhere indicate an utter lack of interest beyond listening to the issue, and providing ignorant/insufficient response back - standard tech support stuff there. Not to mention a 7-10 day "lag" from 2K to Firaxis communicating the issues.

Remember, they dont even have forums of their own - the Civ 4 site links to this one, and CivFanatics.

There is a good chance they are reading messages and threads here because of that, though, dont expect them to respond here at all. Perhaps they posted here in the past, i dont know, i cant say as ive really spent much time here - i created this account merely to inform tyhe public of the significant security issue the release of the game has presented.



Love is a temple.

Actually I gave it all the time a post from someone whose tone and irritating manner has gotten the mods to tell him to turn it down. Yep, use a mirror, CivIndeed, that would be you.

Lets cover the high points (or is that 'hi-points' Civ-puff-puff-pass-Indeed? Just curious)....

Hurried reading: yep did it. Specifically:

"that attacker may be able to trigger".

MAY be able to.

And

"According to public reports, this vulnerability can be exploited to execute arbitrary code, but we have not confirmed this."

So there is a flaw but no exploit confirmed released or seen in the wild. So its possible to, maybe, if the random factors align or whatever, to take control of the machine. And that is IF you are running w/o a firewall and someone knows you are running Civ.

Big Freaking Deal.

Keep working on your straw man and mockery skills. The tone is defintely there, but the wording is weak and repetitive.

What standard do I use? Well I go by the fact I have no real problem with any of the previous Firaxis programs after applying the latest patch. If there are Conquests bugs still outstanding, they have had no impact on my gameplay. Did they effect you, CivIndeed? Sucks to be you. But I have been fairly happy and expect them to keep making me 'fairly happy'.

You, otoh, are completely amusing. Please keep this kind of crap going. I get a laugh everyday when I read it.

[Honky_Cat]

The same guy created the same thread on civfanatics, and got schooled there too. Some people simply never learn.

http://forums.civfanatics.com/showthread.php?t=141417

[Raion]

If your brain was not where you sit, you would know that it is Microsoft's fault.

There have been court cases because -- Microsoft does not release enough info to program the computer properly, so therefore, before these court cases blaming Microsoft -- you can expect other third party programs never to work as they should or could because of Microsoft.

So quit blaming anyone else for the fact that Microsoft does not really release enough info to properly program a computer --- all bought up with the court cases.

Therefore and only therefore, it is Microsoft's fault!

So get your hearing and head checked, because you are not making any sense with any of this thread!

Why do you think Microsoft was sued by -- Europe -- and others recently?

Because simply no one can make a program as good as Microsoft because they are hiding vital infomation needed to make the programs work as well!

It is Microsoft's fault!

Write that out --- 5000 times until it sinks into your head, and quit talking from where you sit in the chair on your computer!

[CivNonFreak]

Originally posted by Raion
If your brain was not where you sit, you would know that it is Microsoft's fault.

There have been court cases because -- Microsoft does not release enough info to program the computer properly, so therefore, before these court cases blaming Microsoft -- you can expect other third party programs never to work as they should or could because of Microsoft.

So quit blaming anyone else for the fact that Microsoft does not really release enough info to properly program a computer --- all bought up with the court cases.

Therefore and only therefore, it is Microsoft's fault!

So get your hearing and head checked, because you are not making any sense with any of this thread!

Why do you think Microsoft was sued by -- Europe -- and others recently?

Because simply no one can make a program as good as Microsoft because they are hiding vital infomation needed to make the programs work as well!

It is Microsoft's fault!

Write that out --- 5000 times until it sinks into your head, and quit talking from where you sit in the chair on your computer!

Thanks for the informative and certainly conclusive commentary on whats wrong with the world of computers.

/sarcasm off

Just because they were sued does not make them wrong. Or even successfully sued. I personally think that MS has some culpability on these matters, but MS is not the root of all evil (nor is money, but I digress).

And insulting people will certainly cause them to rally around your pov.

[SpencerH]

Does anyone know if this would explain why the game crashed after installing the latest security upfate and malware removal program? I rolled back my OS to make it work again but now I have an update bug and the threat of a security problem.