CVE-2017-3210: Applications developed using the Portrait Display SDK, versions 2.30 through 2.34, default to insecure configurations which allow arbitrary code execution
First published: Tue Jul 24 2018(Updated: )
Applications developed using the Portrait Display SDK, versions 2.30 through 2.34, default to insecure configurations which allow arbitrary code execution. A number of applications developed using the Portrait Displays SDK do not use secure permissions when running. These applications run the component pdiservice.exe with NT AUTHORITY/SYSTEM permissions. This component is also read/writable by all Authenticated Users. This allows local authenticated attackers to run arbitrary code with SYSTEM privileges. The following applications have been identified by Portrait Displays as affected: Fujitsu DisplayView Click: Version 6.0 and 6.01. The issue was fixed in Version 6.3. Fujitsu DisplayView Click Suite: Version 5. The issue is addressed by patch in Version 5.9. HP Display Assistant: Version 2.1. The issue was fixed in Version 2.11. HP My Display: Version 2.0. The issue was fixed in Version 2.1. Philips Smart Control Premium: Versions 2.23, 2.25. The issue was fixed in Version 2.26.
Credit: cret@cert.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Portrait Portrait Display Sdk | >=2.30<2.34 | |
| Fujitsu DisplayView Click | =6.0 | |
| Fujitsu DisplayView Click | =6.01 | |
| Fujitsu DisplayView Click Suite | =5.0 | |
| HP Display Assistant | =2.1 | |
| HP My Display | =2.0 | |
| Philips Smart Control Premium | =2.23 | |
| Philips Smart Control Premium | =2.25 |
Remedy
Thanks to Werner Schober of SEC Consult for reporting this vulnerability.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2017-3210.
What applications are affected by this vulnerability?
Applications developed using the Portrait Display SDK versions 2.30 through 2.34, Fujitsu DisplayView Click versions 6.0 and 6.01, Fujitsu DisplayView Click Suite version 5.0, HP Display Assistant version 2.1, HP My Display version 2.0, Philips Smart Control Premium versions 2.23 and 2.25 are affected by this vulnerability.
What is the severity level of this vulnerability?
The severity level of this vulnerability is high.
What is the Common Weakness Enumeration (CWE) ID for this vulnerability?
The Common Weakness Enumeration (CWE) IDs for this vulnerability are CWE-16 and CWE-276.
How can I fix this vulnerability?
To fix this vulnerability, ensure that the affected applications are updated to a secure version or contact the software provider for a patch.
- collector/nvd-index
- agent/weakness
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/author
- agent/tags
- agent/severity
- agent/title
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- vendor/portrait
- canonical/portrait portrait display sdk
- version/portrait portrait display sdk/2.30
- vendor/fujitsu
- canonical/fujitsu displayview click
- version/fujitsu displayview click/6.0
- version/fujitsu displayview click/6.01
- canonical/fujitsu displayview click suite
- version/fujitsu displayview click suite/5.0
- vendor/hp
- canonical/hp display assistant
- version/hp display assistant/2.1
- canonical/hp my display
- version/hp my display/2.0
- vendor/philips
- canonical/philips smart control premium
- version/philips smart control premium/2.23
- version/philips smart control premium/2.25