Intel Trace Analyzer and Collector Privilege Escalation (INTEL-SA-01266)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(261760);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/09/09");

  script_cve_id("CVE-2025-20048");
  script_xref(name:"IAVA", value:"2025-A-0588");

  script_name(english:"Intel Trace Analyzer and Collector Privilege Escalation (INTEL-SA-01266)");

  script_set_attribute(attribute:"synopsis", value:
"A software performance profiler application installed on the remote Windows host is affected by a privilege escalation vulnerability.");
  script_set_attribute(attribute:"description", value:
"Intel Trace Analyzer and Collector is installed on the remote Windows host. It is, therefore, affected by an escalation
of privilege vulnerability:

  - Uncontrolled search path for the Intel(R) Trace Analyzer and Collector software all verions may allow an 
    authenticated user to potentially enable escalation of privilege via local access. Intel is not releasing updates to
    mitigate this potential vulnerability and has issued a Product Discontinuation Notice for Intel Trace Analyzer and
    Collector software. (CVE-2025-20048)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # 
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1db7d33c");
  script_set_attribute(attribute:"solution", value:
"Uninstall Intel Trace Analyzer and Collector.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:H/Au:S/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-20048");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/08/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/09/09");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:intel:trace_analyzer_and_collector");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("intel_trace_analyzer_and_collector_installed.nbin");
  script_require_keys("SMB/Registry/Enumerated", "installed_sw/Intel Trace Analyzer and Collector");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'os': 'windows'}}
  ],
  'checks': [
    {
      'product': {'name': 'Intel Trace Analyzer and Collector', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'fixed_display': 'None - see vendor advisory'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:result);