PT-2017-18797 · Canonical · Juju+1

David Ames + 2 · Publicado 2017-05-26 · Atualizado 2025-04-26 · CVE-2017-9232

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Juju versions prior to 1.25.12 Juju versions 2.0.x prior to 2.0.4 Juju versions 2.1.x prior to 2.1.3

Description The issue allows for privilege escalation by users on the system to root due to the use of a UNIX domain socket without appropriate permissions.

Recommendations For versions prior to 1.25.12, update to version 1.25.12 or later. For versions 2.0.x prior to 2.0.4, update to version 2.0.4 or later. For versions 2.1.x prior to 2.1.3, update to version 2.1.3 or later.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2017-9232

GHSA-J3HP-PV6V-RGRX

GO-2025-3639

OPENSUSE-SU-2025:15033-1

USN-3300-1

Produtos afetados

Juju

Ubuntu

Referências · 23

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/juju_run_agent_priv_esc.rb · Exploit
• 🔥 https://exploit-db.com/exploits/44023 · Exploit
• 🔥 https://bugs.launchpad.net/juju/+bug/1682411 · Exploit
• https://github.com/juju/juju · Nota
• https://github.com/juju/juju/commit/0417178a3c2869537860e8b3b5e787ce1732231f · Nota
• http://securityfocus.com/bid/98737 · Nota
• https://osv.dev/vulnerability/CVE-2017-9232 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-9232 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2025-35965 · Nota
• https://suse.com/security/cve/CVE-2025-41395 · Nota
• https://ubuntu.com/security/CVE-2017-9232 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-j3hp-pv6v-rgrx · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2025:15033-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-3300-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-9232 · Nota de Segurança