Bleeping Computer - "Second Steam Zero-Day Impacts Over 96 Million Windows Users"

[Hoss]

Another one reported

https://www.bleepingcomputer.com/ne...o-day-impacts-over-96-million-windows-users/1

Second Steam Zero-Day Impacts Over 96 Million Windows Users

"The privilege escalation (also known as an elevation of privilege or local privilege escalation) security flaw disclosed today by Kravets can allow attackers with limited rights to use a technique known as BaitAndSwitch to run executables using the Steam Client Service's NT AUTHORITY\SYSTEM elevated permissions.

This would allow potential attackers to launch a three-stage attack, getting remote code execution privileges by exploiting a vulnerability in a Steam game, a Windows app, or the OS itself, subsequently elevating privileges on the compromised device and running a malicious payload using SYSTEM permissions."

 

[Karmah]

and practically ,how do we avoid it ? by not clicking a link or it goes beyond that common sense ?

 

[Serutan]

and practically ,how do we avoid it ? by not clicking a link or it goes beyond that common sense ?

If you don't have the Steam client, you're good to go.

If you do, and want to be safe you need to uninstall it ASAP and not re-install until Valve fixes the issue.

Also the link in the OP got me a 'site down' message. Here's an alternative:

https://www.zdnet.com/article/resea...-getting-banned-on-valves-bug-bounty-program/