WARNING! Civ4 Ships With Critical Security Vulnerabilities!

Firaxis in their infinite incompetence has shipped Civilization 4 with an entirely outdated and insecure version of the zlib compression library (ZLIB1.DLL)!

Firaxis in their infinite incompetence has also shipped Civilization 4 with an entirely outdated and insecure version of the python programming language (PYTHON24.DLL)!

Zlib Insecurity Details:
------------------------

The zlib library file is located in the Civ4 main installation folder (generally c:\program files\firaxis games\sid meier's civilization 4).

The version that ships with Civ 4 - 1.2.1 - contains two different security vulnerabilities (not to mention is itterly out of date):

1) http://www.kb.cert.org/vuls/id/238678

"Un-handled error conditions in the zlib compression library may allow an attacker to cause a denial-of-service condition.

There is a vulnerability in the error handling mechanisms of the decompression functions in the zlib compression library. The decompression functions inflate() and inflateBack() fail to handle certain error conditions properly. If an un-handled error condition is raised, the application linked to zlib may abruptly and abnormally terminate. This vulnerability may be exploited locally or remotely depending on the application being attacked.

This issue exists in zlib versions 1.2.0.x and 1.2.x, other versions are not vulnerable."


2) http://www.kb.cert.org/vuls/id/680620

"A buffer overflow in the zlib compression library may cause any application linked to zlib to improperly and immediately terminate.

There is a buffer overflow in the zlib data-compression library caused by a lack of bounds checking in the inflate() routine. If an attacker supplies the inflate()routine with a specially crafted compressed data stream, that attacker may be able to trigger the buffer overflow causing any application linked to zlib, or incorporating zlib code to crash. According to reports, the buffer overflow is caused by a specific input stream and results in a constant value being written into an arbitrary memory location. This vulnerability may be exploited locally or remotely depending on the application being attacked.

This vulnerability only affects zlib versions 1.2.1 and 1.2.2."


As you can see, Civ4 is clearly vulnerable, as zlib1.dll is required by and called by the main executable, Civilization4.exe.

This version of zlib shipped with Civ4 (1.2.1) is 2 versions (and 3 months) out of date - the current version, as of July 18, 2005 (3 months before the game was RTM'ed) is 1.2.3. 1.2.3 was released to specifically address these two security vulnerabilities.

These two (latest) zlib library vulnerabilities were widely publicized back in July:

http://news.com.com/Wide-ranging+flaw+crashes+programs/2100-1002_3-5778652.html?tag=nl

Nor is this the first time the zlib library has been known to be insecure, and it is highly irresponsible and rather incompetent of the firaxis code managers and developers to have allowed this to slip past them especially considering the amount of media attention these flaws were given.

Python Insecurity Details:
--------------------------

The Python library file is located in the Civ4 main installation folder (generally c:\program files\firaxis games\sid meier's civilization 4).

The version that ships with Civ 4 - 2.4.1 - contains the aforementioned zlib vulnerabilities (it includes the zlib library source), not to mention several security vulnerabilities of its own:

http://www.python.org/2.4.2/NEWS.html

2.4.2 fixes numerous security related bugs, including cross site scripting vulnerabilities etc.

As you can see, Civ4 is clearly vulnerable, as python24.dll is required by and called by the main executable, Civilization4.exe.

The latest version of Python is 2.4.2 (September 28, 2005 - a month prior to the game being RTM'ed), and version 2.4.1 (that ships with the game) was released March 30 2005. 2.4.2 specifically addresses both its own security vulnerabilities from 2.4.1, and includes updated zlib 1.2.3 source code.

Firaxis should be ashamed and highly concerned that all of their third party code libraries, but most especially the insecure zlib and Python ones, were out of date at the time the game was RTM'ed.

Unless and until a patch for Civ 4 is released by Firaxis/Take2 containing updated third party code libraries (ZLIB1.DLL version 1.2.3, PYHTON24.DLL version 2.4.2, etc, the following solution is provided:

Solution:
---------

Update zlib:

1) Locate zlib1.dll in the c:\program files\firaxis games\sid meier's civilization 4 folder, and rename it zlib1.dll.old.
2) Download zlib version 1.2.3 from: http://www.zlib.net/zlib123-dll.zip
3) Save the zip file as you see fit, and uncompress it or copy the uncompressed zlib1.dll file to the c:\program files\firaxis games\sid meier's civilization 4 folder.

Update Python:

1) Locate python24.dll in the c:\program files\firaxis games\sid meier's civilization 4 folder, and rename it python24.dll.old.
2) Download python version 2.4.2 from: http://www.python.org/ftp/python/2.4.2/python-2.4.2.msi
3) Install Python 2.4.2, locate the python24.dll file in the c:\windows\system32 folder, and copy it to the c:\program files\firaxis games\sid meier's civilization 4 folder.
4) Uninstall Python 2.4.2 (this step is optional, unless you want to keep the entire Python programming package installed)

Again, it cannot be stressed enough how incompetent and irresponsible Firaxis and Take 2 have been in regards to shipping Civilization 4 with insecure outdated third party code libraries, and they should be held to task for doing so.

you should inform firaxis of this if it is the case, they may or may not be aware, but it cant hurt right?

[removed my sarcasm : CivIndeed seems to have a cool head]

Working for Atari or something??

1c0n said:

you should inform firaxis of this if it is the case, they may or may not be aware, but it cant hurt right?

Click to expand...

They were informed, as much as they could be, considering the dearth of contact emails, and appropriately directed emails, provided at the firaxis.com web site.

If they are aware, well, that would be Really Bad (TM). Knowingly RTM'ing the game with known-to-be-insecure code doesnt exactly display them in a responsible positive light - quite the opposite. Not that I think this is was the case.

I simply think they were incompetent and didnt take the time or make the effort to verify they were using/shipping the latest third party libraries that Civ4 requires. Plain old irresponsible incompetence - not specific knowing negative intent.

Of course, if they didnt know the modules were insecure, they should have, especially considering the tech-media attention the zlib library flaws received.
Even without the attention, they should have RTM'ed the game with the latest versions of all the third party modules, and thus "defaulted" to providing the most recent "secure" third party code.

But, they didnt do that, and here we are.

Sorceresss said:

The thread's initial post sounds like Twilight Zone, X-Files paranoia.

Click to expand...

The Truth Is Out There - Do Not Adjust Your Monitor.

Its true enough, security doesnt matter, its why there isnt an entire market and industry dedicated to providing and increasing it, and why the tech and mainstream media never reports upon it from time to time.

Its all a Big Conspiracy (TM)

parachute4u said:

Working for Atari or something??

Click to expand...

Obviously. Who else but Atari or an Atari employee would possibly care about whether Civ 4 shipped insecure or not? Obviously not the Civ 4 user base, actual or potential.

The important thing to remember is, the employment of the person informing you about the insecurity of Civ 4 as shipped, is what matters - not the fact that Firaxis used old outdated insecure third party code, making their application insecure, as well as users' systems.

You saw through my clever ploy!

I agree that firaxsis should have checked this before release, however if anyone wants to hack your computer they'll just use one of the multitude of security holes in windows.

sequence said:

I agree that firaxsis should have checked this before release, however if anyone wants to hack your computer they'll just use one of the multitude of security holes in windows.

Click to expand...

Any rational person would agree it should have been checked before RTM - irrational people argue "it doesnt matter" or "they wont exploit this vulnerability" or "this doesnt matter because you work for company XXXX" or "this isnt a security issue".

zlib is one of the most popular and widely used third party source libraries out there, thus making its exploitation appeal that much greater.

The fact is, an attacker/exploiter will use ANY available means to engage in a DoS attack or system takeover. If Civ 4 and the zlib exploit are the available means, they'll use that.

Consider the scenario of multiplayer play, and a less-than-scrupulous opponent. From their point of view, they may see it as simply another form of cheating to knock you offline by crashing your Civ 4 session, or taking over your system to remotely monitor your movements and actions.

Online Multiplayer cheating is a massive industry - do you want firaxis' incompetence to add fuel to that fire when playing Civ 4?

And remember, thats just one of many many possible attack(er) scenarios.

Assuming that critical security vulnerability X (that allows in its worst case scenario complete remote system control) "wont be used because other security vulnerabilities exist" is, well, foolish, to say the least.

Are you aware of the cars on the streets?

the zlib slipup is disappointing. the python slipup seems a little close, as the "gold" date was only 2 or 3 weeks after the python update. hopefully, these issues are addressed with the patch. if they are not, then i'll definitely update as per CivIndeed's recommendations.

Python24.dll does not install in the Python24 directory, rather in the Windows/System32 directory.

Just curiously, has anyone done a PoC on the Win32 versions listed to see if infact there is the vulnerablity?

Your calling these Critical Security Vulnerabilities. How can these files be exploited by a hacker? I can see if these files were on a webserver how a user can use it to crash the server, but the only thing I believe might happen is Civ 4 would crash. Give me an example of how these can be exploited then I might believe that this is critical.

JudgeDeath said:

Python24.dll does not install in the Python24 directory, rather in the Windows/System32 directory.

Click to expand...

Yup. I was just about to say that, and I can't find the updated DLL anywhere in the C:\Python24 directory after I installed it.

grahamiam said:

the zlib slipup is disappointing. the python slipup seems a little close, as the "gold" date was only 2 or 3 weeks after the python update. hopefully, these issues are addressed with the patch. if they are not, then i'll definitely update as per CivIndeed's recommendations.

Click to expand...

"Disappointing" doesnt begin to cover it in terms of zlib.

I'm willing to maybe give them python (though they should have already have had a patch waiting on release to update python with all the other third party code libraries).

However, remember, the version of the python library they shipped with Civ 4, contains insecure zlib source code - that was one of the specific changes from 2.4.1 to 2.4.2 (not to mention all the other many bug fixes, including security related ones)

http://www.python.org/2.4.2/NEWS.html

"Upgrade Windows build to zlib 1.2.3 which eliminates a potential security vulnerability in zlib 1.2.1 and 1.2.2."

In effect, they are doubly vulnerable to the zlib flaws - once via ZLIB1.DLL, and again via PYTHON24.DLL. That means (at least) two totally different attack vectors for the same vulnerabilities. Ludicrous.

What's most disturbing is that they clearly dont need much testing time - check out the Miles Sound System version: 7.0c (7.0.2.0). That was released on September 7, 2005. Civ 4 was RTM'ed on October 19, 2005.

Now, if they could include an MSS version that was released so close to the RTM date (5 1/2 weeks), I'm thinking, they dont need much testing time.

(For the record, that isnt latest MSS version - 7.0d is..released September 23, 2005. Also, for the record, when i replace the older version with the newest version, the game never loads past the initial load screen, it simply exits to the desktop, so there obviously are some linkage differences as per the Civ executable)

I sure hope these outdated insecure third part code libraries are addressed in the patch as well. If not, it'll really underscore their already obvious utter incompetence as supposed professional developers.

It took me all of about 5-10 minutes to check the versions of the third party libraries in the Civ 4 folder, and compare them against the known latest versions of each, and another 5-10 minutes to determine that the versions of zlib and python they were using were utterly insecure (and outdated of course).

Why did i even bother? Because i noticed in the past with Civ 3 and its expansions, they often werent using the latest available versions at RTM time, and, when i perused the different Civ 4 forums, i noticed lots of chatter about the (once again) outdated third party code libraries.

Now, if i can do all that, in a few minutes, and on a whim really, then what is it that the supposedly professional firaxis developers do over the course of the development cycle? What is the build manager (whoever that is) being paid to do? Who is tracking the versions/builds? Are they actually doing professional version/build tracking? Etc etc.

Pure and utter incompetence. Remember, Civ 4 isnt the first time they released outdated third party code libraries with their product - they did it with every version of Civ 3 as well. This isnt an "abberation" or a "one time thing". I'm tempted to snag a copy of Pirates just to see if this pattern follows for it as well. I'll wager a cyber hug that it contains outdated insecure third party code libraries as well.

"Disturbing" is what first comes to mind for me..then it only goes downhill from there.

JudgeDeath said:

Python24.dll does not install in the Python24 directory, rather in the Windows/System32 directory.

Click to expand...

Thats correct, my mistake, thanks for catching that. I got into "automatic copy paste" mode from my zlib directions in order to save typing, and didnt catch myself on that.

The two vulnerabilities in zlib translate, in this context, to mean that if you're playing online it is possible to boot you from a game (oh noes!), and it is possible (under very particular circumstances) to force the game to crash.

It's not as if there are armies of malicious hackers stroking their evil cats, waiting to boot you from a multiplayer Civ session.

Neither of the exploits allow arbitrary code execution.

The python problems, given the way it is implemented in Civ4, are pretty much totally trivial. Civ4 is not a webserver environment.

I'm sure the whole community appreciates your timely and exhaustively detailed account of these minor problems with the game. The world hasn't ended yet, and it's not going to, no matter how many times you reply to inflate the significance of this. Other people are having much more serious problems and are not gabbing about it like it's the worst thing Firaxis could have done.

phybre said:

Neither of the exploits allow arbitrary code execution.

Click to expand...

Wrong:

http://secunia.com/advisories/15949/

Secunia Advisory: SA15949
Release Date: 2005-07-07
Last Update: 2005-08-22


Critical:
Moderately critical
Impact: DoS System access
Where: From remote
Solution Status: Vendor Patch

Software: zlib 1.x
CVE reference: CAN-2005-2096

Description:
A vulnerability has been reported in zlib, which can be exploited by malicious people to conduct a DoS (Denial of Service) against a vulnerable application or potentially execute arbitrary code.

The vulnerability is caused due to a boundary error in inftrees.c when handling corrupted compressed data streams. This can be exploited to crash any application that uses the zlib library, or potentially to execute arbitrary code with privileges of the vulnerable application.

The vulnerability has been reported in version 1.2.2. Prior versions may also be affected.

Click to expand...

With priviledges is most disturbing, as in XP most users probably run in an administrative context. This means that once in, a hacker can pretty much have full acces to your system; for home users maybe not so big a deal, but for those running civ on a work machine this could potentially be a big issue.

Thanks CivIndeed for bring this matter up. I appreciate it; but then again I deal with Computer security in my day to day professional life.

For those who say this is not really a big deal, well, good luck if some bored cracker looking for a bit of noteriety writes a virus code that polls for these files on online unpatched systems...I for one remember Code Red ..and that is a scenario I'd rather not face again. (150,000+ rigs were affected simply because the folks running them did not bother to install the fix, which existed months before...they were warned, but never got around to it or something...only cost the business sector a few humdred million dollars in lost productivity...no big deal.)

Excellent work CivIndeed. I run Apache/MySQL/PHP/Python on my local PC for testing of various scripts I write, and occasionally i allow remote access to the webserver for previewing purposes. Which makes me wonder if my version of python has been overwritten by the version installed with Civ4? Hmmm.. not a nice thought.

As far as I can remember, Civ4 also forced me to install their version of DirectX 9c, although I already had v9.0c installed prior to that.

Thanks again CivIndeed.