PT-2015-7693 · Valve · Steam

Published 2015-11-24 · Updated 2022-02-07 · CVE-2015-7985

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Valve Steam version 2.10.91.91

Description The issue concerns weak permissions set for the Install folder, allowing local users to gain privileges through a Trojan horse steam.exe file. This is due to the folder having read and write permissions for all users.

Recommendations For Valve Steam version 2.10.91.91, consider restricting write access to the Install folder to prevent local users from modifying its contents, thereby mitigating the risk of privilege escalation via a Trojan horse steam.exe file.

Exploit

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2015-7985

Affected Products

Steam

References · 5

• 🔥 https://exploit-db.com/exploits/9386 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-7985 · Security Note
• http://securityfocus.com/archive/1/536961/100/0/threaded · Note
• http://packetstormsecurity.com/files/134513/Steam-2.10.91.91-Weak-File-Permissions-Privilege-Escalation.html · Note
• https://t.me/cvenotify/26389 · Telegram Post