Steam vulnerability can lead to remote insertion of malicious code

[stinger608]

Millions of Steam users are potentially vulnerable to a newly disclosed attack method that exploits a hole in the way Steam commands interact with certain games, Web browsers, e-mail clients, and other software.

Security researchers at ReVuln, based in Malta, published details of the attack [PDF] earlier this week. The vulnerability resides in the Steam Browser protocol, which is commonly used by websites such as the Steam Web Store to install, uninstall or launch Steam games and perform other common tasks, using URLs starting with "Steam://". By getting a user to click a link to a specially formed Steam URL, an attacker can remotely exploit buffer overflow bugs and other vulnerabilities in various Steam games and in Steam itself to create and run malicious code on a target's machine, as shown in a posted proof of concept video.

Here is the entire article over at ARSTechnica:

http://arstechnica.com/security/201...n-lead-to-remote-insertion-of-malicious-code/

Needless to say, people should take precautions to prevent such an attack.