Portrait Displays SDK CVE-2017-3210 Local Privilege Escalation Vulnerability

Bugtraq ID:	98006
Class:	Configuration Error
CVE:	CVE-2017-3210
Remote:	No
Local:	Yes
Published:	Apr 25 2017 12:00AM
Updated:	May 02 2017 03:09AM
Credit:	Werner Schober of SEC Consult
Vulnerable:	Portrait Displays SDK 2.34 Portrait Displays SDK 2.30 Philips Smart Control Premium 2.25 Philips Smart Control Premium 2.23 HP My Display 2.0 HP Display Assistant 2.1 Fujitsu DisplayView Click Suite 5 Fujitsu DisplayView Click 6.01 Fujitsu DisplayView Click 6.0
Not Vulnerable:	Philips Smart Control Premium 2.26 HP My Display 2.1 HP Display Assistant 2.11 Fujitsu DisplayView Click Suite 5.9 Fujitsu DisplayView Click 6.3

Portrait Displays SDK CVE-2017-3210 Local Privilege Escalation Vulnerability

Portrait Displays SDK is prone to a local privilege-escalation vulnerability.

A local attacker can exploit this issue to execute arbitrary code with elevated SYSTEM privileges.

Portrait Display SDK 2.30 through 2.34 are vulnerable.

Portrait Displays SDK CVE-2017-3210 Local Privilege Escalation Vulnerability

The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.

Portrait Displays SDK CVE-2017-3210 Local Privilege Escalation Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Portrait Displays SDK CVE-2017-3210 Local Privilege Escalation Vulnerability

References:

• Nessus Homepage (Tenable Network Security)
  
• Security Update! (portrait.com)
  
• title: Privilege Escalation due to insecure service configuration (sec-consult.com)
  
• [R3] Nessus 6.10.5 Fixes Two Vulnerabilities (Tenable)
  
• VU#219739: Portrait Displays SDK applications are vulnerable to arbitrary code e (KB CERT)