WARNING! Civ4 Ships With Critical Security Vulnerabilities!

[CivIndeed]

While what you are saying is true, it would still be bad practice to release code that leverages a library with known vulnerabilities... EVEN if you did your own bounds checking prior to handing data off to functions/objects/whathave you in the vulnerable library...

Of course it is, because that library could somehow be referenced by another app that uses/requires it, especially if it is installed by the app (or user) in a common file search path/location.

That isnt the case with Civ 4, to be clear, but its still a common practice nonetheless.

Of course, relying on third party code always has its risks, security being one of them. One need to only look at the scope of applications using zlib1.dll (or zlib source within the app) to see the inherent issue and danger in terms of security.

The case of Civ 4 is of course, a nice object lesson.

 

[CivIndeed]

tell me civindeed is it such a wonder a publisher released software with slightly older versions in it?

I dont know if its a "wonder" or not, but its certainly demonstrable of irresponsible incompetence.

As software gets more complex, and larger, there is a greater incentive to use pre-existing specialized third party code. Of course, the more an application relies on third party code, the more important it becomes for the developer to thoroughly verify and audit that third party code and its functionality.

For example, going to the web site that they get it from, and comparing the latest available version to the version they have on hand, and reading the really obvious notes about security vulnerabilities fixed in the latest version, seems a pretty simple first step in that process.

Unless of course you are incompetent, and/or cant read (which is just a specific form of incompetence).

when bigger badder music publishing companies are actually installing rootkits which are just as bad or worse than old zlib libraries i am not doubting you i take heed of your words i am just making a observation about the state of todays affairs regarding entertainment consumables (music and games and movies) for the rootkit/sony info see www.sysinternals.com

I dont disagree. Thankfully, the security industry is growing, as well as is demand for more security products at all levels. However, obviously, there is a long way go towards pervasive computing security.

When an analysis of Windows's error reporting indicates that 35-45% of application crashes are caused by spyware (as of a year ago), thats probably a good sign that something needed to be done about the situation, and so MS bought up Giant and its AntiSpyware software, and released an updated version to the public as a "beta" for nearly a year now.

And guess what the # 1 download is at Microsoft Downloads (and has been i think for nearly a year now)? That's right - Microsoft AntiSpyware (to be final released as "Windows Defender").

When research indicates that only 8-15% of Windows Desktop PCs are protected by AntiVirus software, its no wonder that insecurity is an issue, and why it needs to less of one.

That explains why Microsoft bought RAV from GeCAD and then used its technology to provide the Malicious Software Removal Tool being pumped through Microsoft/Windows/Automatic Updates on a monthly basis. Not to mention Microsoft's forthcoming (currently being beta tested) "OneCare", a combined AntiVirus/AntiSpyware/Enhanced Windows Firewall/Backup product, intended for consumers.

And then there is the Sybari purchase..and the FrontBridge Purchase...and the FinJan licensing and investment deal.

When Microsoft feels compelled to enter the consumer and entireprise security software & services market space on several fronts, you know security has really become a primary issue (with a clearly underserved market) in the industry.

Security matters, increasingly more so, and if game developers (like Firaxis) think they can avoid (or better yet ignore) the trend, they better think again.

 

[ZouPrime]

The nature of the vulnerability itself is what creates the insecurity, and the degree thereof, not whether or not someone or something exists immediately or otherwise to take advantage of it.

CivIndeed, since you admited not understanding the difference between a risk and a vulnerability, I'm going to explain it to you real quick here.

The importance of a risk is in function of a vulnerability and a threat. The risk is what's important here; it defines the level of control you implement in your system to make it secure. A very high vulnerability doesn't mean jack **** if the threat is not high enough, since the risk won't be big enough too. The typical example is the risk of a plane crashing on the building you are reading this post right now; even tought most if not all buildings are very vulnerable to planes crash, it doesn't mean building designers are incompetent; it's just that they calculated (rightly so) that the threat of something like this happening is fairly remote, enough to ignore it. Note that this calculation can change depending of the building size and value (you are more ready to protect something important like the White House than any random house), or the nature of the threat (I could suspect that someone would want to crash a plane on the White House, but on a random house? There's no clear reason why).

This risk calculation is highly important in information security, and is teached in the introductory chapter of all books on the topic. Focusing on the vulnerability while ignoring the threat is clear sign of someone not knowledgeable of the subject, since it's pretty poor security. There are thousands of vulnerabilities out there who are routinely ignored by everyone because the threat doesn't justify anything else, and it doesn't mean that security researchers are incompetent, it just mean they understand what they are up to.

Now, let's look at our current problem. We know the vulnerability (well, up to a point, since without exploit code we can't be sure it is really exploitable. But let's say it is). What what are the threats? Let's explore the typical threat scenario possible.

a) The worst case possible is the worm, i.e. an automated and self-replicating network program with or without a payload. They are the bane of modern network security, as most of the critical security incidents happening on big networks are caused by worm replicating and the DOS they are generally creating. Worms require two things; the remotely exploitable vulnerability (most of the time, a buffer overflow) and mass presence (the vulnerability must be everywhere, else the worm can't replicate efficiently). In the current case, both requirements are not met. AFAIK, the vulnerability identified are not remotely exploitable, and the program coverage is far from enough. Even if Civ4 is the biggest seller ever, it won't remotely touch the coverage of an application such as Windows for example. There's a reason why worms are typically created for program who have a constant network presence and/or are installed everywhere, and not for common games. Some exceptions exist (I'm thinking of Witty on ISS products for example) but that's the general rule.

b) Still problematic, but less critical; an locally triggered exploit. I think some people around here suggested a malformed mod for example, although nobody knows when the vulnerable code is really called and in which circumstances. In this specific case, that's by far the kind of scenario we should be looking at. From the point of view of a user having his box zombified by joe hacker through civ4, it sure sucks. But on the grand scheme of things, it's far less impressive. Imagine I'm a hacker, I work hard to trigger the bug in the software, exploit a buffer overflow and make my mod install a rootkit on the user's box. How many infectiona can I expect? A thousand? Maybe. If I put it in a popular mod, I risk getting caught. If I put in a stupid, small mod, I won't have a lot of targets. The cost/result ratio is going to be pretty poor, considering that some hackers can install hundreds of thousands of these rootkits using much faster method of propagation (see a)). Maybe I'm not here to attack the largest numbers of civ4 users, maybe I want to target a specific user; e.g. I want make *you* install my mod/rootkit because the value of the information on your computer is high. This is a scenario that make sense economically for joe hacker; but in this case, we'll have to wonder why you are running a game (or any other program not designed for security) on a high value machine.

Does the risk exist? Of course. Should Firaxis have known better and ship the fixed code? Sure, but considering they are not in the business of making secure software and are still facing bugs in their own code, it is understandable. Is the risk high enough to justify calling it "critical"? Of course not. Many people here told you so in the very begining of this discussion. You did the right thing by telling the skateholders of the problem. But you did the wrong thing in trying to analyse the impact of what you found, because you obviously have no idea of what you are talking about. That's my problem, and I guess that's the problem of many other posters regarding your original OP. By making it too big a deal, you're not helping, because people will tend to overeact and see the problem everywhere. Your persistence in answering every single lines of posts separately, making comments over the quality of my english (how childish, really) instead of actually addressing arguments, and acting like a jackass, certainly did not help. In fact, it confirms the suspicion that you aren't here to help anyone, but simply want to make a fuss and defend your "discovery". I think someone said the problem was at least partially mitigated with the new 1.09 patch. Thank god if it's so, since we'll be able to put this whole idiocy behind us and go play the damn game.

 

[Prince James I]

While I'm downloading the patch I'd also like to add this:

Both the libraries are contained within the civ4 folder, so only civ should be accessing them.

Until someone has come up with a working exploit that uses the compromised libraries *THROUGH* Civ then I'll agree that there is a security vulnerabilty.

 

[jimkirk]

regardless of whats in the civ4 libraries if you listen to sony music your computer health is far worse off anyhow the patch fixed a bunch of stuff and broke a few others go figure

 

[dosage0]

Are you geeks still arguing about this stupid crap?

Go outside.
Moderator Action: Trolling - warned.
Please read the forum rules: http://forums.civfanatics.com/showthread.php?t=422889

 

[n003lb]

Did the 1.09 Patch address this, because I have the up to date zlib file. If this has already been answered in this thread, please accept my apologies, as I don't feel like dredging through 6 pages of posts to find out.

 

[oldStatesman]

Did the 1.09 Patch address this, because I have the up to date zlib file. If this has already been answered in this thread, please accept my apologies, as I don't feel like dredging through 6 pages of posts to find out.

Read my post above.

But I will repeat, zlib.dll is updated, python24.dll is not.

 

[CivIndeed]

CivIndeed, since you admited not understanding the difference between a risk and a vulnerability, I'm going to explain it to you real quick here.

Feel free to actually quote such an "admission". Making up Yet-Another-Strawman is just silly.

The importance of a risk is in function of a vulnerability and a threat.

Nonsensical imcomprehensible gibberish. I'm sure its all part of the painful process of a "real quick explanation" attempt.

The risk is what's important here; it defines the level of control you implement in your system to make it secure. A very high vulnerability doesn't mean jack **** if the threat is not high enough, since the risk won't be big enough too. <insert long meandering irrelevant paragraph here>

Perhaps it would have been useful to actually make your "real quick explanation", "real quick" (for your attempted strawman dissertation explanation), instead of injecting it with meaningless irrelevant babble.

This risk calculation is highly important in information security, and is teached in the introductory chapter of all books on the topic.

Perhaps it was taught (yes, taught) in same chapter that teaches "How To Make Yet Another Absurd Assertion Using Absolutes" or "Silly Straw-Man: How To Disable Your Argument Through Absurd Asinine Assertions".

Focusing on the vulnerability while ignoring the threat is clear sign of someone not knowledgeable of the subject, since it's pretty poor security.

One more straw-man for the road.....

I cant imagine why there would be focus on it. It must be something like "duhuh, if the specific vulnerability doesnt exist to begin with, you dont have to worry about a specific threat tailored for it and aimed at it", or something to that effect.

No specific vulnerability, no specific vulnerability threat.

Its a logic thing, you clearly dont get it. When you are "teached" proper logic, you'll be made aware of such things, such as the straw-man fallacy (and others, like "making an absolute statement without absolute knowledge in the face of evidence to the contrary")

Speaking of "someone not knowledgeable": Thats a pretty bold statement (pun intended) - ironically coming from someone who thinks being "wormed" and/or "zombied" are somehow "the worst" consequences when it comes to security compromise.

There are thousands of vulnerabilities out there who are routinely ignored by everyone because the threat doesn't justify anything else, and it doesn't mean that security researchers are incompetent, it just mean they understand what they are up to.

How would you know they are "routinely ignored by everyone"?

Oh right, you dont know about them being exploited, and, since you have perfect knowledge of all extant vulnerabilities and all extant exploits (and exploit attempts), you can confidently make such an asinine silly absurd assertion. Got it.

Perhaps this would have been better stated as "I'm really ignorant of most vulnerabilities, and of the existence of exploits for them, but, one time, at security camp..."

I didnt realize that "everyone" actually meant "security researchers". Its good you pointed that out (as part of the "real quick explanation").

I sure hope your usage of the word "incompetence" in regards to "security researchers" not knowing about vulnerabilities isnt some attempt at apologism on behalf of Firaxis. Because they clearly arent "security researchers" - they arent even competent third party code licensing usage and distribution folks, let alone "security researchers".

I just know this wasnt an attempt to minimize and rationalize Firaxis incompetence in this matter. That would just be... silly.

Now, let's look at our current problem.

Again? Hey, i know - you should explain to me - the "guy that pointed out the insecurity situation with Civ 4 as shipped" - what the "current problem" is.

We know the vulnerability (well, up to a point, since without exploit code we can't be sure it is really exploitable. But let's say it is).

Up to a point? Are you back to attempting to claim that the vulnerability doesnt exist? Attempting to minimize the extant nature of the flaws in the zlib code again eh? We dont have to "pretend" its vulnerable - it is vulnerable.

What what are the threats? Let's explore the typical threat scenario possible.

I'm sure this is all a part of the "real quick explanation". I say we explore logic, and logical fallacies like "why the straw man came to town"...

a) The worst case possible is the worm, i.e. an automated and self-replicating network program with or without a payload.

I find it disturbing that you believe this is the "worse case possible".

Perhaps if you are an ISP, or large PC network manager, this might be the "worst case" in terms of network traffic load and PC/device "cleaning time".

As for the individual working on one PC, its moot.

I'll take a generic worm using my PC to propagate itself to other PCs any day over a complete system takeover with 100% loss of data, or confidential/private data loss/theft.

Take for example the (original) Code Red worm: It propagates itself to deface web servers.

Oh yeah, big threat to deskop PCs and individual users/data. No doubt.

They are the bane of modern network security, as most of the critical security incidents happening on big networks are caused by worm replicating and the DOS they are generally creating.

They are a bane, yes, but not "the" bane. They are perhaps more significant as a bane to those sysadmins who cant find the time to properly patch their different PC devices and systems with 1/3/6/12/24/36 month old patches.

However, I'm sure you can poll different corporate network sysadmins and find a plethora of "banes", with different focus issues for each of them. For example, many will find the usage of unathorized software with internet/network connectivity to be their "biggest security bane", especially instant messaging/chat software/connections, and many will will also find "inappropriate browsing and content download" to be their "biggest security bane".

But none of that changes the fact that Civ 4 shipped with vulnerable outdated insecure third party code, which allowed for potential local and remote exploitation leading to a DoS situation, and/or arbitrary code execution.

Worms require two things; the remotely exploitable vulnerability (most of the time, a buffer overflow) and mass presence (the vulnerability must be everywhere, else the worm can't replicate efficiently).

Neither one of those two things are required for worms. The fact that you think they are, again, is very telling as to your lack of expertise (or common sense) in the matter.

Worms can and do propagate without specific code vulnerabilities, whether they are locally or remotely exploitable, and may, or may not engage in malicious conduct.

I suggest you go read up on "worm" in a computing dictionary. I'll facilitate the process:

http://www.m-w.com/dictionary/worm
http://www.smartcomputing.com/edito...searchtype=0&DicID=19654&RefType=Encyclopedia

In the current case, both requirements are not met.

Not met...where? (even though of course, your made-up supposed "requirements" are in no way definitive as i previously explained)

Are you referring to Civ 4 now? Because if you are, its already been established that Civ is insecure, through vulnerable zlib libraries (ZLIB1.DLL and PYTHON24.DLL), which are remotely and/or locally exploitable (depending on the app), and that Firaxis acknowledged Civ 4 was insecure by issuing the latest security fixed version of ZLIB1.DLL (1.2.3) with the 1.09 patch (though they neglected to mention it in their release notes, and they also neglected to update PYTHON24.DLL as well)

Additionally, Civ 4 was shipped, insecure, and was installed on many PCs (it was the #1 selling game there at some point, may still be).

AFAIK, the vulnerability identified are not remotely exploitable, and the program coverage is far from enough.

Yes, because reading is a very hard concept to master, only slightly more difficult than intellectual honesty, or perhaps logic.

Yes, none of the several different security bulletins and advisories linked to or pasted from, indicated any remote exploitation capacity. Still not reading...

Even if Civ4 is the biggest seller ever, it won't remotely touch the coverage of an application such as Windows for example.

What exactly does how many copies of MS Windows are sold relative to Civ 4 have to do with the fact that Civ 4 shipped insecure, and is still insecure, even after the first patch?

Oh, i know - nothing. (This would be covered under (but not limited to) the "fallacy of changing the topic")

If in fact the Civilization series has sold over 6 million units, and if one were to average those 6 over the 3 prior releases of the game (as a whole), that would about 2 million installs per game.

If one were to forecast, say 2 million installs for Civ 4, would that qualify as "mass presence", in your universe? Would 1/4th of that - 500,000 - be considered "mass presence"? Could you give me a number, that would meet your silly supposed "mass presence" or "enough covergage" criteria? Let me guess, its higher than say, 500,000? Or 2 million? I can probably already guess the answer.

Of course, since i informed them of the issue and they updated the zlib library file, it likely wont get to the 2 million mark first in terms of vulnerable ZLIB1.DLL installs. However, of course, Civ 4 is still vulnerable via the outdated insecure version of PYTHON24.DLL.

There's a reason why worms are typically created for program who have a constant network presence and/or are installed everywhere, and not for common games.

At least you are starting to sound slightly reasonable, what with the usage of the word "typically" there.

But then you went and ruined it with "and/or installed everywhere" (instead of something reasonable like "installed on most (or a majority of) desktop PCs" etc etc)

But yeah, all those silly email (or floppy based) worms, how dare they defy your claim!

I'm sure you'll claim that most emails programs "have a constant network presence" or better yet, fit into "and/or are installed everywhere".

Still problematic, but less critical; an locally triggered exploit. some people around here suggested a malformed mod for example, although nobody knows when the vulnerable code is really called and in which circumstances.

I'm sorry, did you just say "less critical". So you now ackowledge that its critical?

In this specific case, that's by far the kind of scenario we should be looking at.

You should be looking at all vulnerabilities, and all exploit vectors, and all possible consequences. Thats what "security" is all about. You still dont get it.

And this from someone claiming to be a "security professional". Scary.

From the point of view of a user having his box zombified by joe hacker through civ4, it sure sucks.

Generally, "zombies" are used for DoS and DDoS attacks.

Again, strange assessement of what an implied worst possible outcome is.

Wouldnt 100% data loss be "worse"? Perhaps theft of private/personal/confidential data?

Id much rather have an intact easily recoverable Windows install that was simply being used as part of some DoS/DDoS than to have the hard disk wiped, or data stolen, etc.

Ask people whether they preferred their PC caused more internet/network traffic, or whether their hard disk was wiped or personal/private data stolen. Common sense leads us to the latter.

But on the grand scheme of things, it's far less impressive.

Doesnt change the fact that its a vulnerability and/or vulnerability vector.

Imagine I'm a hacker, I work hard to trigger the bug in the software, exploit a buffer overflow and make my mod install a rootkit on the user's box.

I'd prefer to imagine you in a Logic class..perhaps an English reading and comprehension class...

How many infectiona can I expect? A thousand?

Well, lets see..count the number of units old...estimate the number of unpatched systems...carry the 1...divide by two....take into account the coefficient of friction for an ethernet frame....look at the ceiling....think about whats coming on TV tonight..and we have..

Only a thousand units old? If thats the case, Take Two (or Firaxis) sure didnt get their investments worth.. You might want to tell them they are really losing money on that whole Civ 4 game selling stuff.

Maybe. If I put it in a popular mod, I risk getting caught.

Its true - any/all human actions have the "risk" of being known/discovered. Good point, that added nothing.

If I put in a stupid, small mod, I won't have a lot of targets. The cost/result ratio is going to be pretty poor, considering that some hackers can install hundreds of thousands of these rootkits using much faster method of propagation (see a)).

Yeah, because it costs so much to program software these days, what with all the freely available programming tools, and all that reuseable third party code out there (hmm) and even that cruddy more-insecure-than-closed-source open source stuff.

Especially some small little exploit utility. We are talking a major corporate development effort, requirings 10s of thousands - if not millions - of development dollars.

Maybe I'm not here to attack the largest numbers of civ4 users, maybe I want to target a specific user; e.g. I want make *you* install my mod/rootkit because the value of the information on your computer is high.

Or maybe the "exploiter" doesnt care about knowing the value of the target system beforehand, aside from the fact that its running Civ 4. Maybe he/she will assess that after system compromise, if at all.

This is a scenario that make sense economically for joe hacker; but in this case, we'll have to wonder why you are running a game (or any other program not designed for security) on a high value machine.

Yeah! Who ever heard of high end gaming PCs!? No one ever buys high end high value PCs to run games! ABSURD! Wait, maybe by "high value" you mean "low end", and yeah, those people wont be running Civ 4 (at least not well).

Shouldnt all programs be "securely" designed? Especially ones that provide network connectivity of some kind, and/or require administrator privileges to run? Shouldnt security matter for everyone, everywhere?

If increased network traffic and network security are so important to you (remember those "worms" and "zombies" that concern you so much), shouldnt you be the among those most streneously arguing for Firaxis to make their network multiplayer code/functionality as secure as possible?

Does the risk exist? Of course. Should Firaxis have known better and ship the fixed code? Sure, but considering they are not in the business of making secure software and are still facing bugs in their own code, it is understandable.

They arent in the business of shipping secure software? You mean they arent in the business of shipping security software, right? That was a typo, right?

Oh, wait, no, you actually did say that. It is true that Civ 4 shipped insecure <chorus>

However, if Firaxis isnt in the business of "securing their software", you might want to tell them that - they include security measures in the multiplayer setup (logins, passwords, etc), and even added more security measures in Patch 1.09 - They updated ZLIB1.DLL as i told them to, they added password encryption, restricted different saved game version loading for saves protected by admin passwords, etc.

Did they do it just to make you look silly and foolish?

Is the risk high enough to justify calling it "critical"? Of course not.

Yes. Locally and/or remotely exploitable, resulting in DoS and/or arbitrary code execution.

Many people here told you so in the very begining of this discussion.

A total of maybe one (yes, 1) person in the third 3 pages of this thread had any interpretable issue with "critical" - adamal. Many? Not even close.

But you did the wrong thing in trying to analyse the impact of what you found, because you obviously have no idea of what you are talking about.

This is a fascinating redirected self-examination. Perhaps you should claim to be a "security professional" again.

That's my problem, and I guess that's the problem of many other posters regarding your original OP.

Yes, indeed it is your problem, what with the obvious banal projection and transference prior to this.

By making it too big a deal, you're not helping, because people will tend to overeact and see the problem everywhere.

No one required you to respond, ever. If the conversation/dialogue itself bothers you and you believe its not contributing to your supposed altruistic concern for everyone, then why did you engage in it?

Obvious inconsistency and intellectual dishonesty here...

Your persistence in answering every single lines of posts separately, making comments over the quality of my english (how childish, really) instead of actually addressing arguments, and acting like a jackass, certainly did not help.

Well, at least you arent exaggerating or distorting - that would clearly be beneath you and your standards. The quality of your English matters, as, in fact, several times, your idea conveyance was clearly obstructed by your inability to express yourself in a comprehensible manner.

In fact, it confirms the suspicion that you aren't here to help anyone, but simply want to make a fuss and defend your "discovery".

Yes, it was "very unhelpful" the way i communicated to the developer/publisher/user community, the existence of security flawed code, and even went so far as to explain to the user community the means to temporarily (or permanently, depending) rectify the situation by updating the security flawed code.

On the other hand, you as a "self proclaimed security professional", doing your best to attempt to minimize the nature and existence of the flawed code, and then defending your inconsistent occasionally incomprehensible silly absurd assertions time and again, well, im sure that had nothing to do with apologism and inferiorityism and selfishness, and everything to with altriusm and "helping the community".

Right.

I think someone said the problem was at least partially mitigated with the new 1.09 patch. Thank god if it's so, since we'll be able to put this whole idiocy behind us and go play the damn game.

Yes, because, as a "security professional" "concerned about helping the Civ 4 community", you know that a partial fix is clearly the desired end result.

I'm sure i wont be seeing any more posts from you at all on the subject, certainly not any "real quick explanations" like this.

 

[CivIndeed]

While I'm downloading the patch I'd also like to add this:

Both the libraries are contained within the civ4 folder, so only civ should be accessing them.

Only Civ 4 should be, but other programs could be using them. Improbable perhaps, but not impossible, in the least.

Not to mention that the outdated insecure versions of third party libraries can be moved/copied around the system. Again, improbable perhaps, but certainly not impossible (especially with newer users that dont grasp all the details of files and folders and programs etc and like to start interesting forms of "file management")

Until someone has come up with a working exploit that uses the compromised libraries *THROUGH* Civ then I'll agree that there is a security vulnerabilty.

Do you mean "disagree" or "isnt" there?

Civ 4 is vulnerable regardless of whether you know about a specific exploit or not.

The security vulnerability is there regardless of whether the exploit exists.

This would be akin to saying "i cant agree my car is insecure because i left it unlocked, because i havent heard about anyone breaking into cars around here".

Its insecure. How you assess your risk of exploitation in the final analysis, is up to you. But it was (and is still, even after the 1.09 patch) insecure.

No amount of blathering about not knowing about a specific exploit, or about risk or threats or why worms and zombies love spaghetti changes the fact that Civ 4 shipped with vulnerable code, and continues to have vulnerable code even after the 1.09 patch.

Next.

 

[CivIndeed]

Read my post above.

But I will repeat, zlib.dll is updated, python24.dll is not.

Yes, unfortunately, they only issued a partial fix.

They also neglected to indicate in their release notes that they updated ZLIB1.DLL to address security vulnerability issues.

Its a good thing they are learning from their obvious past mistakes.

Its almost become a Comedy of Incompetence Errors.

 

[phalzyr]

LOL CivIndeed your rude/sarcastic posts are cracking me up, almost as much as ZouPrime's misinformed education. Worm the worst thing that can happen and all the other things....

Luckily worms are one of the least of my worries on the network I manage (I also never had any get in thankfully, I keep my security updated though as much as I can)... I'd rather have a worm that is easy to get rid of than alot of the stuff I see going on on the oother side of my firewall... I have delt with them on another network that I only manage when something goes wrong (they pay for my time through my work to fix technical issues). they are pretty easy to deal with and if you manage your network right little damage other than time is the result. Granted I don't manage huge netwroks so the loss/risk would be different elsewhere...

Anyway thanks for the info, though keep in mind you catch more flies with honey, than... well you know the saying. Just becasue you can be rude/abrupt doesn't mean you have to be, most of this argument would of ended long ago if you had phrased your replies in a more freindly manner, and certain others also.

As far as the door being locked comparison that isn't a very good one, and the yelling about a vulnerability isn't an issue either as far as I can tell anyway. Any hacker can look at the files and see they are old. They don't need to be told, it is already out there for everyone to see.

Oh well I better stop before civIndeed puts me down .

 

[phybre]

for those running civ on a work machine this could potentially be a big issue.

For those running civ on a work machine, maybe you should email Firaxis and ask for a boss key so nobody finds out you're performing theft of service on company property.

And you need to learn how to read a bug report. "Potential" doesn't mean "can occur in every implementation". The relevant point you neglect is that this is a video game, and not a socket-based service. So there's no point of entry in order to create arbitrary code execution. But as I already said at apolyton, you can feel free to code up a proof of concept and prove me wrong. Thought I'm sure you can't, since anyone who knew how to do a proper security audit wouldn't have repeated one paranoid rambling about vulnerabilities that are irrelevant given the context.

Cheers.

 

[phybre]

I'm the RL equivalent of an "Elite software engineer" who's almost achieved "Great Leader" status. I've been on the internet since before it became "inter". I was on SciNet, UUNet, and DARPANet (not their official names but you get the point) before they merged. I've been a systems security officer for the US government (can't tell you where or I'd have to kill you). And you don't yell about vulnerabilities in a public place.

That might have been how they did it back when everyone thought security through obscurity was a fantastic idea. But hey, welcome to 2005. Bugs and exploits don't get addressed unless they are made public. Why? Because if they aren't made public the company can deny they exist, and besides these evil little hackers you all fear can extort money from such companies based on the threat of releasing the vulnerability along with the knowledge that it was known about in advance. In the real world, the one that isn't full of disingenuous nostalgia, the most prudent course is to fully publicize every security problem after giving the developers in question a grace period to begin fixing it. Maybe in your ruminations about the "good old days" of college campus networks you have never come across bugtraq or CERT. Easily understandable, since they're relatively unknown, unless you've ever been on the internet for more than 5 minutes. I suppose Carnegie-Mellon was never on your itinerary, or something.

But hey, good luck with all that eliteness, since you need to try to impress a bunch of ignorant gamers to justify yourself, even if the person you are replying to does deserve a good smacking. And of course you must be special because nobody else here could possibly have ever filled out an SF-86 or been interviewed by DSS. Ft. Meade? What's that? No Such Agency.

 

[Spekingur]

Heh, CivIndeed obviously doesn't like someone trying to start up low-flame arguments with him (or her, nowadays you never know). What I see is shout-back, kill-quick and lastly cannibalism.
The last one is obviously not an option in Civ4. Until some crazy modder makes it an option, of course.

 

[joepiece]

I'm surprised that the obvious solution hasn't been suggested yet! All you have to do is reformat after each time running Civ 4. Then you can at least be ensured that your local machine is safe (from this vulnerability).

And yes, I'm baiting CivIndeed here. PLEASE find something in this post to fly off the handle about! I want to go down in history as one of them "dudes" that wouldn't let it die. Oooh I did write "PLEASE" in all caps, which is incorrect grammar! Or is it? We'll never know till I get flamed.... Is Oooh a word? I can't wait to find out. I started a sentence with "And"? I'm such a loser! (I've given you plenty of choices in my "sarcastic mockery").

 

[CivIndeed]

For those running civ on a work machine, maybe you should email Firaxis and ask for a boss key so nobody finds out you're performing theft of service on company property.

Thats true. Certainly no one ever owns their own work PC, what with the impossibility of being the business/company owner, and/or "being your own boss".

Good insight.

And you need to learn how to read a bug report. "Potential" doesn't mean "can occur in every implementation".

It also doesnt mean "eats spaghetti on Luna". And it also doesnt mean "does not occur in every implementation", etc etc.

Of course, thats all moot.

Potentially, Firaxis could have not updated ZLIB1.DLL to the latest fixed version, but actually, they did, thus actually fixing the actual gaping security vulnerability in their actual program and potentially avoiding criticism/comment about the issue with ZLIB1.DLL version that shipped with Civ 4 and the actual vulnerabilities in it.

The relevant point you neglect is that this is a video game, and not a socket-based service.

And here I thought it was a computer game.

A computer game that has a network multiplayer component (not to mention a network update service, etc etc) that makes use of IP addresses, and port based connections. But yeah, there are no "sockets" here, look over there..something shiny!

The relevant point is that you are clearly ignorant of what a socket is, and of the game itself, and that you are not even close to being a genius.

So there's no point of entry in order to create arbitrary code execution.

I wonder what part of "local" you dont quite understand.

Right, because there is no network connectivity for the Civ 4 application (it doesnt use IP addresses and ports (aka "sockets")), and because it doesnt load stored compressed data in files of any kind, ergo, ad sillium infinatum foreverum, there is no point of entry.

Genius i say.

But as I already said at apolyton, you can feel free to code up a proof of concept and prove me wrong.

I think im just going to rub the "its not a socket based service" silliness in your face here.

You do realize, that the "Proof of Concept" already exists, hence the security advisories and bulletins in the first place, right? Its a logic thing. You wouldnt understand.

Thought I'm sure you can't, since anyone who knew how to do a proper security audit wouldn't have repeated one paranoid rambling about vulnerabilities that are irrelevant given the context.

Again its true enough - neither the ZLIB1.DLL file or the PYTHON24.DLL file that shipped with Civ 4 were (and still are for PYTHON24.DLL even after the 1.09 patch) outdated and insecure, which is why of course, ZLIB1.DLL wasnt updated in the 1.09 patch.

That 1.2.3 latest security fixed version of ZLIB1.DLL that the 1.09 patch installs is just there for cosmetic purposes, and to make all the "it isnt a security issue" folks (like yourself) feel foolish.

I guess those silly Firaxis developer dudes are so paranoid they updated their irrelevant insecure outdated zlib library so that it wasnt anymore. Those silly paranoid developers!

I cant believe you think so little of the Firaxis folks that you call them paranoid.

Ah yes, the straw man does cometh...

 

[CivIndeed]

LOL CivIndeed your rude/sarcastic posts are cracking me up, almost as much as ZouPrime's misinformed education. Worm the worst thing that can happen and all the other things....

Edutainment is a wonderful thing.

Anyway thanks for the info, though keep in mind you catch more flies with honey, than... well you know the saying.

Im not worried about catching flies.

Just becasue you can be rude/abrupt doesn't mean you have to be, most of this argument would of ended long ago if you had phrased your replies in a more freindly manner, and certain others also.

Just because i can be nice, inept, incompetent, ignorant, not to mention naive, doesnt mean i have to be.

Thankfully, i can just "be as i am". Be...all that i can be...in the ...po---stery!

As far as the door being locked comparison that isn't a very good one, and the yelling about a vulnerability isn't an issue either as far as I can tell anyway.

You should say why it isnt a good comparison...

Any hacker can look at the files and see they are old. They don't need to be told, it is already out there for everyone to see.

Well, if the "hacker" is able to view Civ 4 install file details already, there is no need to exoloit any vulnerability vectors in Civ 4, as clearly, the system would already be compromised (in your scenario).

But if they havent already compromised the system, and wish to compromise the system via Civ 4, then they could use the unpatched zlib vectors to do so (knowing that unpatched versions of Civ 4 most likely have both a vulnerable zlib library, and a vulnerable python library).

Next.

 

[neriana]

I read the first post thinking, OK, now I'll read the rest and learn something from the thread. But I couldn't do it. I don't like violent movies either.

I would greatly appreciate it if someone else could explain the vulnerabilities in these files to those of us (or maybe it's just me) who don't really know what's going on here and don't want to wade through the vitriol.

 

[CivIndeed]

That might have been how they did it back when everyone thought security through obscurity was a fantastic idea.

And that would be, when? I had no idea that "everyone" thought as much, but, i guess that includes you.

But hey, welcome to 2005.

Yes, only the best and brightest have just figured out, now, in the last month of 2005 (as opposed to a decade or two ago), that "security through obscurity", doesnt really work.

Yes, welcome to 1985 and 1995 indeed.

Bugs and exploits don't get addressed unless they are made public.

Yes, you miss out on all the apologism, ignorance, and minimization that goes on. You know, such things as "there is no point of entry because its not a socket based service" (even though of course, it uses sockets in its network multiplayer capacity, and its update capacity, etc, and that the zlib flaws could be exploited locally using malformed files, etc)

Yes, the best part is the ensuing silliness that invariably occurs.

Why? Because if they aren't made public the company can deny they exist, and besides these evil little hackers you all fear can extort money from such companies based on the threat of releasing the vulnerability along with the knowledge that it was known about in advance.

Or even better, some amusingly ignorant silly person can claim that the vulnerabilities cant be exploited, because they dont know what a socket is, and/or that the game in fact, uses sockets for its, ahem, network multiplayer and updating capabilities, or that the vulnerabilities are locally exploitable through specially crafted files as well, etc etc.

Those evil little silly ignorant people!

In the real world, the one that isn't full of disingenuous nostalgia, the most prudent course is to fully publicize every security problem after giving the developers in question a grace period to begin fixing it.

Sure, thats a reasonable position. Assuming that the vulnerabilites arent already well known and fixes dont already exist that the user can apply without waiting for a developer provided fix. Remember, Civ 4 is vulnerable through the outdated insecure third party code, for which updated code already exists, and is easily available and installable.

Certainly, if security matters at all, there is no point in waiting through some "grace period" for the developer to issue a fix when the user can obtain and apply a fix themselves, as was (and is) the case here.

Maybe in your ruminations about the "good old days" of college campus networks you have never come across bugtraq or CERT. Easily understandable, since they're relatively unknown, unless you've ever been on the internet for more than 5 minutes. I suppose Carnegie-Mellon was never on your itinerary, or something.

Yeah, but, you have never been on SolarNET, or ClusterNET, or GroupNET, or SpiralArmNET, or GalactiNET, or UniversiNET, so there!

But hey, good luck with all that eliteness, since you need to try to impress a bunch of ignorant gamers to justify yourself, even if the person you are replying to does deserve a good smacking.

I'll have you know im the Emperor of the Unified Alien Cabal, not to mention Primary of the Martian Hegemonic Council! I dont have to take that!

And of course you must be special because nobody else here could possibly have ever filled out an SF-86 or been interviewed by DSS. Ft. Meade? What's that? No Such Agency.

Your puny infinetesimal terran bureaucracy and government have nothing on the rest of the universe! Trying filling out a google-part form $$;;%#$%-%^&%dgffgfg=$#$#G$%#$%#55454 in Slurpikinion!

Next.