Intel oneAPI Base Toolkit < 2025.1.0 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(250289);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/12/03");

  script_cve_id(
    "CVE-2025-20017",
    "CVE-2025-20087",
    "CVE-2025-20056",
    "CVE-2025-20627",
    "CVE-2025-31931"
  );
  script_xref(name:"IAVA", value:"2025-A-0588");
  script_xref(name:"IAVA", value:"2025-A-0862");
  

  script_name(english:"Intel oneAPI Base Toolkit < 2025.1.0 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote Windows host contains a library that is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"Multiple vulnerabilities exist in Intel oneAPI Base Toolkit versions prior to 2025.1.0. See vendor advisory for more 
details. 

  - Uncontrolled search path for the Instrumentation and Tracing Technology API (ITT API) software before version 3.25.4 
    within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an 
    authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially 
    occur via local access when attack requirements are present without special internal knowledge and requires active 
    user interaction. (CVE-2025-31931)

  - Incorrect default permissions for some Intel® oneAPI DPC++/C++ Compiler software installers may allow an
  authenticated user to potentially enable escalation of privilege via local access. (CVE-2025-20087)

  - Uncontrolled search path for some Intel® oneAPI Toolkit and component software installers may allow an
  authenticated user to potentially enable escalation of privilege via local access. (CVE-2025-20017)

  - Uncontrolled search path for some Intel® oneAPI DPC++/C++ Compiler software before version 2025.0.1 may
  allow an authenticated user to potentially enable escalation of privilege via local access. (CVE-2025-20627)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01285.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ddd56443");
  # https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01355.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c187672a");
  # https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01337.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c1858d4a");

  script_set_attribute(attribute:"solution", value:
"Upgrade to Intel oneAPI Base Toolkit 2025.1.0 or later.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:H/Au:S/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-31931");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2025-31931");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/08/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/08/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/08/15");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:intel:oneapi_base_toolkit");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("intel_oneapi_base_toolkit_win_installed.nbin");
  script_require_keys("installed_sw/oneAPI Base Toolkit");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'oneAPI Base Toolkit', 'type': 'app'},
      'requires': [{'scope': 'target', 'match': {'os': 'windows'}}],
      'check_algorithm': 'default',
      'constraints': [{'fixed_version': '2025.1.0'}]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:result);