{"id":2727,"date":"2017-04-26T07:58:56","date_gmt":"2017-04-26T05:58:56","guid":{"rendered":"http:\/\/borncity.com\/win\/?p=2727"},"modified":"2024-10-05T18:57:38","modified_gmt":"2024-10-05T16:57:38","slug":"security-risk-oem-bloatware-portrait-display-pdiservice-exe","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2017\/04\/26\/security-risk-oem-bloatware-portrait-display-pdiservice-exe\/","title":{"rendered":"Security risk OEM bloatware Portrait Display (PdiService.exe)"},"content":{"rendered":"

[German<\/a>]A from OEM's (HP, PHILIPS, FUJITSU) on Windows notebooks preinstalled application bears a huge security risk. A vulnerability allows a local authenticated (non-privileged) attacker to run arbitrary code with SYSTEM privileges. Millions of devices are affected by this bloatware. <\/p>\n

<\/p>\n

\"\"The topic isn't new, I've addressed several security issues caused by preinstalled OEM software within my German blog. Overall, preinstalled OEM software is a potential security risk. Currently, a Display SDK service, developed from Portrait Displays Inc., causes such a security risk. The service is used to change some screen settings on notebook and the SDK program PdiService.exe <\/em>is shipped from many OEM's on Windows notebooks. The program comes with different brand names, Fujitsu is calling it DisplayView Click. <\/p>\n

While the program seems to make sense (change some screen settings), it's bloatware, that's causing a major security risk. Austrian security specialists from sec.consult.com has documented it here<\/a>. But also US CERT has issued a warning VU#219739<\/a> about the vulnerability. <\/p>\n

\n

Vulnerability Note VU#219739<\/h3>\n

Portrait Displays SDK applications are vulnerable to arbitrary code execution and privilege escalation<\/h4>\n

A number of applications developed using the Portrait Displays SDK do not use secure permissions when running. These applications run the component PdiService.exe <\/em>with NT AUTHORITY\/SYSTEM permissions. This component is also read\/writable by all Authenticated Users. This allows local authenticated attackers to run arbitrary code with SYSTEM privileges.<\/p>\n<\/blockquote>\n

The command: <\/p>\n

sc.exe config pdiService.exe binpath \"mc.exe \u2013nv \u2013l 127.0.0.1 \u2013p4242 \u2013p c:\\Windows\\System32\\cmd.exe |out-null<\/em><\/em><\/p>\n

issued in an administrative command prompt window allows a local authenticated (non-privileged) attacker can run arbitrary code with SYSTEM privileges. The command uses the UAC bypassing trick, I've mentioned within my blog post Windows: UAC opens hidden in background<\/a>.<\/p>\n

Affected applications and fixes<\/h3>\n

The following applications have been identified by Portrait Displays as affected:<\/p>\n