CVE-2017-3210
Description
Applications developed using the Portrait Display SDK, versions 2.30 through 2.34, default to insecure configurations which allow arbitrary code execution. A number of applications developed using the Portrait Displays SDK do not use secure permissions when running. These applications run the component pdiservice.exe with NT AUTHORITY/SYSTEM permissions. This component is also read/writable by all Authenticated Users. This allows local authenticated attackers to run arbitrary code with SYSTEM privileges. The following applications have been identified by Portrait Displays as affected: Fujitsu DisplayView Click: Version 6.0 and 6.01. The issue was fixed in Version 6.3. Fujitsu DisplayView Click Suite: Version 5. The issue is addressed by patch in Version 5.9. HP Display Assistant: Version 2.1. The issue was fixed in Version 2.11. HP My Display: Version 2.0. The issue was fixed in Version 2.1. Philips Smart Control Premium: Versions 2.23, 2.25. The issue was fixed in Version 2.26.
How to fix
- portrait portrait_display_sdk2.34 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| portrait portrait_display_sdk | 2.30 ≤ v < 2.34 | 2.34 |
| fujitsu displayview_click | 6.0, 6.01 | — |
| fujitsu displayview_click_suite | 5.0 | — |
| hp display_assistant | 2.1 | — |
| hp my_display | 2.0 | — |
| philips smart_control_premium | 2.23, 2.25 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.