TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them

TeamViewer has patched a security vulnerability that allowed a controlled machine (host) to attack the controlling machine (viewer) during a remote session. In a typical TeamViewer session, the viewer connects to and controls the host. This flaw reversed the attack vector, enabling a malicious or compromised host to crash the viewer's TeamViewer client. Depending on the platform, the vulnerability may also allow arbitrary code execution on the viewer's machine. The flaw represents a significant risk as it subverts the expected trust model of remote desktop sessions. Users who connect to untrusted or compromised machines could be at risk. TeamViewer has issued a fix and users are advised to update immediately.