News Steam Windows Client Facing Zero Day: Valve Appearing Complacent - Printable Version +- Red Security (https://redsecurity.info/cc) +-- Forum: General (https://redsecurity.info/cc/forumdisplay.php?fid=1) +--- Forum: News (https://redsecurity.info/cc/forumdisplay.php?fid=4) +--- Thread: News Steam Windows Client Facing Zero Day: Valve Appearing Complacent (/showthread.php?tid=1212)

Steam Windows Client Facing Zero Day: Valve Appearing Complacent - Mad-Architect - 08-09-2019                                                 Steam is facing some scrutiny after a Zero Day that has affected some 125 million users, is seemingly ignored by Valve, and was even labeled as N/A. Afterwards the threat was closed. This drew criticism from the security as well as the their own community. Miainly, the Zero-Day was ignored. that because the Zero-Day didn't fit into the scope of their bounty program.           The Zero-Day itself, is as follows, the vulnerability resides in the Steam Client Service. When the SDDL was reviewed, it was discovered that any user in the "Users" group can start and stop any program. Apparently, Users have permissions for all keys and subkeys.           While the report was filed, it doesn't seem like Valve will be addressing the Zero-Day, if it has been addressed, they have not given an official report.           Original article can be found here                      That was the news folks, have a good day, and stay safe out there.                       --Mad-Architect