7 ms·

There is more blatant violation: 1. Log on as non-admin on a box with steam 2. Do not start steam or any game 3. cat %system32%\calc.exe > %programfiles%\steam

There is more blatant violation: 1. Log on as non-admin on a box with steam 2. Do not start steam or any game 3. cat %system32%\calc.exe > %programfiles%\steam\bin\steamservice.exe 4. Reboot 5. Log on, start steam 6. BAM! Now you have calc.exe (attempted to) run as System with highest local priveleges

AnIdiotOnTheNet 7y ago
> 3. cat %system32%\calc.exe > %programfiles%\steam\bin\steamservice.exe This requires elevation.
- dtech 7y ago
  On my machine, the Steam folder is writable by the Users group. I didn't modify anything so I assume Steam set it that way.
  - yrro 7y ago
    Of course, how else is a user running Steam supposed to update it? Headdesk
    - batat 7y ago
      Through Steam service running as NT AUTHORITY\SYSTEM? Like "Mozilla Maintenance Service" for Firefox.
      - yrro 7y ago
        That would require Valve's developers have a clue about basic security...
        shawnz 7y ago
        It's ironic, because Gabe Newell himself started at Microsoft. Now he's created a company in which apparently none of his employees understand the security model of Microsoft products.
  - AnIdiotOnTheNet 7y ago
    If true, then I stand corrected. However, I'll point out that one hardly needs administrator access to, say, encrypt your documents and install a crypto miner. The whole idea that gaining administrator privileges through local escalation on a personal desktop is A Big Deal(TM) is silly.
    - r1ch 7y ago
      Microsoft considers this kind of escalation a security issue and will issue patches if this is found in Windows components. If Steam is installed on a corporate network PC (game development, QA services, esports teams, etc?), regular users being able to elevate to machine admin is a big deal.
      - AnIdiotOnTheNet 7y ago
        > Microsoft considers this kind of escalation a security issue and will issue patches if this is found in Windows components. Makes sense, because Windows is also used for servers. The Steam client is not. > If Steam is installed on a corporate network PC (game development, QA services, esports teams, etc?), regular users being able to elevate to machine admin is a big deal. No it isn't. This is effectively the same as being installed on some home PC. Being local admin on the workstation doesn't really give you any more ability to do damage than just a regular user account. A non-administrative process still has access to all the user's stuff, and all the network resources that user account has access to. Local admin doesn't really give you anything new.
        deleted 7y ago
        [deleted]
        deleted 7y ago
        [deleted]
        lurker458 7y ago
        local admin on windows is similar to having sudo rights on linux. It can be used to access personal files and running sessions of other users on the same machine, to install malware that will affect other users, to change drivers, to block AV or GPO policies from being applied to protect them, etc.
- omgtehlion 7y ago
  no it does not! the issue is this file has W permission for all users
yrro 7y ago
Have you reported this to the vendor or whatever channels are required to get a CVE?
- shawnz 7y ago
  From 2015: https://nvd.nist.gov/vuln/detail/CVE-2015-7985 https://nvd.nist.gov/vuln/detail/CVE-2015-7985
  - yrro 7y ago
    So this is less of a 0day and more of a 1300day :)
LoSboccacc 7y ago
"It rather involves being on this side of the airtight archway" you can't write there without elevating. at which point you can just register stuff to run as you wish.

AnIdiotOnTheNet 7y ago

> 3. cat %system32%\calc.exe > %programfiles%\steam\bin\steamservice.exe This requires elevation.

dtech 7y ago
On my machine, the Steam folder is writable by the Users group. I didn't modify anything so I assume Steam set it that way.
- yrro 7y ago
  Of course, how else is a user running Steam supposed to update it? Headdesk
  - batat 7y ago
    Through Steam service running as NT AUTHORITY\SYSTEM? Like "Mozilla Maintenance Service" for Firefox.
    - yrro 7y ago
      That would require Valve's developers have a clue about basic security...
      - shawnz 7y ago
        It's ironic, because Gabe Newell himself started at Microsoft. Now he's created a company in which apparently none of his employees understand the security model of Microsoft products.
- AnIdiotOnTheNet 7y ago
  If true, then I stand corrected. However, I'll point out that one hardly needs administrator access to, say, encrypt your documents and install a crypto miner. The whole idea that gaining administrator privileges through local escalation on a personal desktop is A Big Deal(TM) is silly.
  - r1ch 7y ago
    Microsoft considers this kind of escalation a security issue and will issue patches if this is found in Windows components. If Steam is installed on a corporate network PC (game development, QA services, esports teams, etc?), regular users being able to elevate to machine admin is a big deal.
    - AnIdiotOnTheNet 7y ago
      > Microsoft considers this kind of escalation a security issue and will issue patches if this is found in Windows components. Makes sense, because Windows is also used for servers. The Steam client is not. > If Steam is installed on a corporate network PC (game development, QA services, esports teams, etc?), regular users being able to elevate to machine admin is a big deal. No it isn't. This is effectively the same as being installed on some home PC. Being local admin on the workstation doesn't really give you any more ability to do damage than just a regular user account. A non-administrative process still has access to all the user's stuff, and all the network resources that user account has access to. Local admin doesn't really give you anything new.
      - deleted 7y ago
        [deleted]
        deleted 7y ago
        [deleted]
      - lurker458 7y ago
        local admin on windows is similar to having sudo rights on linux. It can be used to access personal files and running sessions of other users on the same machine, to install malware that will affect other users, to change drivers, to block AV or GPO policies from being applied to protect them, etc.
omgtehlion 7y ago
no it does not! the issue is this file has W permission for all users

yrro 7y ago

Have you reported this to the vendor or whatever channels are required to get a CVE?

shawnz 7y ago
From 2015: https://nvd.nist.gov/vuln/detail/CVE-2015-7985 https://nvd.nist.gov/vuln/detail/CVE-2015-7985
- yrro 7y ago
  So this is less of a 0day and more of a 1300day :)

LoSboccacc 7y ago

"It rather involves being on this side of the airtight archway" you can't write there without elevating. at which point you can just register stuff to run as you wish.