Samsung Magician for MacOS Privilege Escalation (CVE-2024-31952)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(204783);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/11/01");

  script_cve_id("CVE-2024-31952");
  script_xref(name:"IAVB", value:"2024-B-0101");

  script_name(english:"Samsung Magician for MacOS Privilege Escalation (CVE-2024-31952)");

  script_set_attribute(attribute:"synopsis", value:
"Samsung magician running on the remote host is affected by a privilege escalation vulnerability.");
  script_set_attribute(attribute:"description", value:
"Samsung Magician versions < 8.1.0 are vulnerable to a privilege escalation vulnerability due to issues with symbolic 
linking in the files used during the installation process allowing an attacker to escalate privileges through 
arbitrary file permission writes. 

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://semiconductor.samsung.com/emea/support/quality-support/product-security-updates/cve-2024-31952/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?fec727ba");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Samsung Magician 8.1.0 or later.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:H/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-31952");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/01/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/01/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/07/26");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:samsung:magician");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"MacOS X Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("macos_samsung_magician_installed.nbin");
  script_require_keys("installed_sw/SamsungMagician");

  exit(0);
}

include('vcf.inc');

if (!get_kb_item('Host/local_checks_enabled'))
  audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item('Host/MacOSX/Version'))
  audit(AUDIT_OS_NOT, 'macOS');

var app_info = vcf::get_app_info(app:'SamsungMagician');

var constraints = [
  { "fixed_version" : '8.1.0' }
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);