Dell System Update < 2.3.0.0 Multiple Vulnerabilities (DSA-2026-324)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(364718);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/12");

  script_cve_id(
    "CVE-2026-86360",
    "CVE-2026-86361",
    "CVE-2026-86362",
    "CVE-2026-63697",
    "CVE-2026-71168"
  );
  script_xref(name:"IAVA", value:"2026-A-1092");

  script_name(english:"Dell System Update < 2.3.0.0 Multiple Vulnerabilities (DSA-2026-324)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has an installation of Dell System Update that is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, the Dell System Update (DSU) installation on the remote host is prior to
2.3.0.0. It is, therefore, affected by multiple vulnerabilities as referenced in the DSA-2026-324 advisory.

  - Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted
    Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially
    exploit this vulnerability, leading to Filesystem access for attacker. This vulnerability is considered critical
    because it can be leveraged by an unauthenticated attacker to execute arbitrary code with root privileges.
    (CVE-2026-86360)

  - Dell System Update, versions prior to 2.3.0.0, contains an Incorrect Permission Assignment for Critical
    Resource vulnerability. A low privileged attacker with local access could potentially exploit this
    vulnerability, leading to Elevation of privileges. (CVE-2026-86361)

  - Dell System Update, versions prior to 2.3.0.0, contains an Improper Access Control vulnerability. A low
    privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of
    privileges. (CVE-2026-86362)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported
version number.");
  # https://www.dell.com/support/kbdoc/en-us/000515843/dsa-2026-324-security-update-for-dell-system-update-dsu-vulnerabilities
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2db4fce6");
  script_set_attribute(attribute:"solution", value:
"Update Dell System Update to version 2.3.0.0 or later.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-86360");
  script_cwe_id(22, 284, 295, 732);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/12");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:dell:system_update");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("dell_system_update_nix_installed.nbin");
  script_require_keys("installed_sw/Dell System Update");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Dell System Update', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'fixed_version': '2.3.0.0'}
      ]
    }
  ]
};

# DSU is Dell's own RPM from linux.dell.com, not a distro package, so no OS advisory backports these fixes and the
# package-managed install must still be assessed.
var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE, check_backporting:false);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);