Lucene search

MitreCVE-2019-15316

HistoryAug 21, 2019 - 8:15 p.m.

CVE-2019-15316

2019-08-2120:15:12

CWE-367

CWE-732

mitre

web.nvd.nist.gov

cve-2019-15316

valve

steam

windows

privilege escalation

folder permissions

createmountpoint.exe

setoplock.exe

toctou

nvd

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

45.7%

JSON

Valve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to privilege escalation (to NT AUTHORITY\SYSTEM) via crafted use of CreateMountPoint.exe and SetOpLock.exe to leverage a TOCTOU race condition.

Affected configurations

Nvd

Node

valvesoftwaresteam_clientRange≤2019-08-20

AND

microsoftwindowsMatch-

VendorProductVersionCPE
valvesoftwaresteam_client*cpe:2.3:a:valvesoftware:steam_client:*:*:*:*:*:*:*:*
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
valvesoftware	steam_client	*	cpe:2.3:a:valvesoftware:steam_client::::::::
microsoft	windows	-	cpe:2.3:o:microsoft:windows:-:::::::*

References

amonitoring.ru/article/onemore_steam_eop_0day/

habr.com/ru/company/pm/blog/464367/

www.youtube.com/watch?v=I93aH86BUaE

www.youtube.com/watch?v=ZCHrjP0cMew

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

45.7%

JSON

Related for CVE-2019-15316