CVE-2019-17180: Valve Steam Client File Modification Vulnerability
Summary
CVE-2019-17180: Valve Steam Client before 2019-09-12 allows placing or appending partially controlled filesystem content, as demonstrated by file modifications on Windows in the context of NT AUTHORITY\SYSTEM. Affects steam versions < 2019-09-12. Fixed in 2019-09-12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Valve Steam Client is a popular gaming platform that allows users to purchase, download, and play games on their computers. It provides a wide range of features, including social networking, game streaming, and community forums. The client is available for multiple operating systems, including Windows. However, prior to the release on September 12, 2019, the Steam Client was susceptible to a file modification vulnerability on Windows systems.
Vulnerability Detail
The vulnerability (CVE-2019-17180) in the Valve Steam Client allowed an attacker to place or append partially controlled filesystem content. This means that an attacker could modify files on a Windows system where the Steam Client was running, even in the context of the highly privileged NT AUTHORITY\SYSTEM account. The impact of this vulnerability could range from denial of service to elevation of privilege, and potentially other unspecified consequences.
How To Fix
Minimum fixed version
2019-09-12
This is the first release that contains the fix.
pip install --upgrade "steam==2019-09-12"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Users are advised to update their Steam Client to the latest version as soon as possible.
Conclusion
The Valve Steam Client prior to September 12, 2019, was vulnerable to file modifications on Windows systems. This could lead to denial of service, elevation of privilege, or other unspecified impacts. Users are strongly advised to update their Steam Client to the latest version to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for steam →
FAQ
The Valve Steam Client is a gaming platform that allows users to purchase, download, and play games on their computers. It provides various features such as social networking, game streaming, and community forums.
The vulnerability in the Valve Steam Client could lead to denial of service, elevation of privilege, or other unspecified impacts. An attacker could modify files on a Windows system where the Steam Client is running, even in the context of the highly privileged NT AUTHORITY\SYSTEM account.
To fix this vulnerability, users should update their Steam Client to a version released on or after September 12, 2019. Valve has addressed this issue in the update by implementing security patches and enhancements to prevent unauthorized file modifications.
There is no specific workaround mentioned for this vulnerability. The recommended solution is to update the Steam Client to the latest version.
For more information about this vulnerability, you can visit the official GitHub repository of the PyPA Advisory Database, which provides the source of this vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for steam.
