Network Security, Vulnerability Management

Flaw in Portrait Displays SDK apps enable RCE

Share

A bug in applications developed using the Portrait Display SDK, v2.30 through 2.34, default to insecure configurations which enable arbitrary code execution, according to Vulnerability Note VU#219739 from CERT at Carnegie Mellon University.

Various apps developed using the Portrait Displays SDK do not use secure permissions when running, the alert explained. "These applications run the component pdiservice.exe with NT AUTHORITY/SYSTEM permissions. This component is also read/writable by all authenticated users. This allows local authenticated attackers to run arbitrary code with system privileges."

According to an advisory from US-CERT, the affected applications, pre-installed on some Fujitsu, HP, and Philips devices, are:

  • Fujitsu DisplayView Click: Version 6.0 and 6.01. The issue was fixed in v6.3.
  • Fujitsu DisplayView Click Suite: Version 5. The issue is addressed by patch in v5.9.
  • HP Display Assistant: Version 2.1. The issue was fixed in v2.11.
  • HP My Display: Version 2.0. The issue was fixed in v2.1.
  • Philips Smart Control Premium: v2.23, 2.25. The issue was fixed in v2.26.

Users are advised to update affected applications to the latest version.

Flaw in Portrait Displays SDK apps enable RCE

A bug in applications developed using Portrait Display SDK default to insecure configurations enabling arbitrary code execution.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy.