Executive brief
Valve's Steam client software contains a security flaw where its installation folder uses weak access controls. This allows any standard user on a shared computer to replace legitimate Steam files with malicious ones. If another user or an administrator then launches Steam, the malicious code will run with their permissions, potentially leading to a full system takeover.
Technical details
The Steam installation directory (typically C:\Program Files (x86)\Steam) implements insecure Access Control Lists (ACLs) that grant 'Full Control' (F) to the BUILTIN\Users group. This vulnerability allows a low-privileged local attacker to modify or replace critical executables and DLLs, such as Steam.exe. Because Steam often runs with elevated privileges or is configured as a startup application for multiple users, an attacker can achieve lateral or vertical privilege escalation by planting a Trojan horse binary. The issue was verified on Windows 7 x64 but affects the Steam client version 3.42.16.13 across Windows platforms.
Affected products
- Valve Steam 3.42.16.13
Timeline
- 2016-06-06: disclosed: Exploit published on Exploit-DB
- 2017-01-23: advisory: NVD published the CVE record