PT-2017-8701 · Valve · Steam

Gsx · Published 2017-01-23 · Updated 2017-09-07 · CVE-2016-5237

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Valve Steam version 3.42.16.13

Description The issue concerns weak permissions for files in the Steam program directory, allowing local users to modify these files and potentially gain privileges. This could be exploited, for example, by creating a Trojan horse Steam.exe file.

Recommendations For Valve Steam version 3.42.16.13, consider restricting access to the Steam program directory to prevent local users from modifying its files until a fix is available. As a temporary workaround, monitor the directory for any unauthorized changes, especially to the Steam.exe file.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2016-5237

Affected Products

Steam

References · 4

• 🔥 https://exploit-db.com/exploits/39888 · Exploit
• 🔥 https://packetstormsecurity.com/files/137343/Valve-Steam-3.42.16.13-Local-Privilege-Escalation.html · Exploit
• https://osv.dev/vulnerability/CVE-2016-5237 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-5237 · Security Note