CVE-2019-15316

Valve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to privilege escalation to NT AUTHORITY\SYSTEM via crafted use of CreateMountPoint.exe and SetOpLock.exe to leverage a TOCTOU race condition...

CVE-2019-15315

Valve Steam Client for Windows through 2019-08-16 allows privilege escalation to NT AUTHORITY\SYSTEM because local users can replace the current versions of SteamService.exe and SteamService.dll with older versions that lack the CVE-2019-14743 patch...

Privilege escalation

Valve Steam Client for Windows through 2019-08-16 allows privilege escalation to NT AUTHORITY\SYSTEM because local users can replace the current versions of SteamService.exe and SteamService.dll with older versions that lack the CVE-2019-14743 patch...

Race condition

Valve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to privilege escalation to NT AUTHORITY\SYSTEM via crafted use of CreateMountPoint.exe and SetOpLock.exe to leverage a TOCTOU race condition...

CVE-2019-15316

Affected product: Valve Steam Client for Windows (through 2019-08-20). The vulnerability is caused by weak folder permissions that enable a TOCTOU race condition, exploited via crafted use of CreateMountPoint.exe and SetOpLock.exe to escalate privileges to NT AUTHORITY\SYSTEM. Connected documents...

CVE-2019-15316

Valve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to privilege escalation to NT AUTHORITY\SYSTEM via crafted use of CreateMountPoint.exe and SetOpLock.exe to leverage a TOCTOU race condition...

CVE-2019-15315

Valve Steam Client for Windows through 2019-08-16 allows privilege escalation to NT AUTHORITY\SYSTEM because local users can replace the current versions of SteamService.exe and SteamService.dll with older versions that lack the CVE-2019-14743 patch...

CVE-2019-15315

The CVE-2019-15315 entry concerns Valve Steam Client for Windows (up to 2019-08-16). Local attackers can achieve NT AUTHORITY\SYSTEM privilege escalation by replacing the SteamService.exe and SteamService.dll binaries with older, unpatched versions that bypassed CVE-2019-14743. Root cause is abus...

CVE-2019-15316: Time-of-check Time-of-use (TOCTOU) Race Condition

Valve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to privilege escalation to NT AUTHORITY\SYSTEM via crafted use of CreateMountPoint.exe and SetOpLock.exe to leverage a TOCTOU race condition...

PT-2019-14045

Name of the Vulnerable Software and Affected Versions Valve Steam Client for Windows versions through 2019-08-20 Description The issue is related to weak folder permissions, which can lead to privilege escalation to NT AUTHORITYSYSTEM. This can be achieved through crafted use of...

CVE-2019-15315: Incorrect Permission Assignment for Critical Resource

Valve Steam Client for Windows through 2019-08-16 allows privilege escalation to NT AUTHORITY\SYSTEM because local users can replace the current versions of SteamService.exe and SteamService.dll with older versions that lack the CVE-2019-14743 patch...

PT-2019-14044

Name of the Vulnerable Software and Affected Versions Valve Steam Client for Windows versions prior to 2019-08-16 Description The issue allows local users to escalate privileges to NT AUTHORITYSYSTEM. This is possible because local users can replace the current versions of SteamService.exe and...

Steam Windows Client Local Privilege Escalation

$SteamRegKey = "HKLM:\SOFTWARE\WOW6432Node\Valve\Steam\NSIS" $MSIRegKey = "HKLM:\SYSTEM\CurrentControlSet\Services\msiserver" $RegDir = "C:\Windows\Temp\RegLN.exe" $PayDir = "C:\Windows\Temp\payload.exe" $Payload = "c:\windows\system32\cmd.exe /c c:\windows\temp\payload.exe 127.0.0.1 4444 -e...

Gamers Beware: Zero-Day in Steam Client Affects All Windows Users

UPDATE A researcher has dropped a zero-day vulnerability that affects the Steam game client for Windows, after Valve said it wouldn’t fix it. Valve then published a patch, that the same researcher said can be bypassed. The bug is a privilege-escalation vulnerability that can allow an attacker to...

Steam Windows Client - Local Privilege Escalation

Steam Windows Client - Local Privilege Escalation $SteamRegKey = "HKLM:\SOFTWARE\WOW6432Node\Valve\Steam\NSIS" $MSIRegKey = "HKLM:\SYSTEM\CurrentControlSet\Services\msiserver" $RegDir = "C:\Windows\Temp\RegLN.exe" $PayDir = "C:\Windows\Temp\payload.exe" $Payload = "c:\windows\system32\cmd.exe /c...

Steam 0 day vulnerability affects 1 billion users-vulnerability warning-the black bar safety net

! The Steam platform is currently the most popular game platform steam has over 1 million registered users, with millions of users simultaneously participate in the game. Researchers in the Steam games Windows the client found a 0-day privilege escalation vulnerability, exploit the vulnerability...

CVE-2019-14743

In Valve Steam Client for Windows through 2019-08-07, HKLM\SOFTWARE\Wow6432Node\Valve\Steam has explicit "Full control" for the Users group, which allows local users to gain NT AUTHORITY\SYSTEM access...

CVE-2019-14743

In Valve Steam Client for Windows through 2019-08-07, HKLM\SOFTWARE\Wow6432Node\Valve\Steam has explicit "Full control" for the Users group, which allows local users to gain NT AUTHORITY\SYSTEM access...

CVE-2019-14743

CVE-2019-14743 affects Valve Steam Client for Windows (through 2019-08-07). The root cause is insecure permissions in HKLM\SOFTWARE\Wow6432Node\Valve\Steam and Steam folders, where the Users group has explicit Full control, enabling local users to gain NT AUTHORITY\SYSTEM. Red Hat CVE entries cor...

CVE-2019-14743

In Valve Steam Client for Windows through 2019-08-07, HKLM\SOFTWARE\Wow6432Node\Valve\Steam has explicit "Full control" for the Users group, which allows local users to gain NT AUTHORITY\SYSTEM access...