Steam 'vgui2_s.dll' Heap Buffer Overflow Vulnerability

Bugtraq ID:	56111
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 18 2012 12:00AM
Updated:	Mar 19 2015 08:23AM
Credit:	Luigi Auriemma and Donato Ferrante
Vulnerable:
Not Vulnerable:

Steam 'vgui2_s.dll' Heap Buffer Overflow Vulnerability

Steam is prone to a remote heap-based buffer-overflow vulnerability.

An attacker can exploit this issue to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely result in denial-of-service conditions.

Steam 1.0.1446.623 is vulnerable; other versions may also be affected.

Steam 'vgui2_s.dll' Heap Buffer Overflow Vulnerability

The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.

Steam 'vgui2_s.dll' Heap Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Steam 'vgui2_s.dll' Heap Buffer Overflow Vulnerability

References:

• STEAM BROWSER PROTOCOL INSECURITY (Luigi Auriemma and Donato Ferrante)
  
• Steam Homepage (Valve Corporation)