PT-2017-18797 · Canonical · Juju+1

David Ames + 2 · Published 2017-05-26 · Updated 2025-04-26 · CVE-2017-9232

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Juju versions prior to 1.25.12 Juju versions 2.0.x prior to 2.0.4 Juju versions 2.1.x prior to 2.1.3

Description The issue allows for privilege escalation by users on the system to root due to the use of a UNIX domain socket without appropriate permissions.

Recommendations For versions prior to 1.25.12, update to version 1.25.12 or later. For versions 2.0.x prior to 2.0.4, update to version 2.0.4 or later. For versions 2.1.x prior to 2.1.3, update to version 2.1.3 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2017-9232

GHSA-J3HP-PV6V-RGRX

GO-2025-3639

OPENSUSE-SU-2025:15033-1

USN-3300-1

Affected Products

Juju

Ubuntu

References · 23

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/juju_run_agent_priv_esc.rb · Exploit
• 🔥 https://exploit-db.com/exploits/44023 · Exploit
• 🔥 https://bugs.launchpad.net/juju/+bug/1682411 · Exploit
• https://osv.dev/vulnerability/CVE-2017-9232 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-9232 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-9232 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j3hp-pv6v-rgrx · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15033-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3300-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9232 · Security Note
• https://osv.dev/vulnerability/GO-2025-3639 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-9232 · Security Note
• https://ubuntu.com/security/notices/USN-3300-1 · Vendor Advisory
• https://github.com/juju/juju · Note
• https://github.com/juju/juju/commit/0417178a3c2869537860e8b3b5e787ce1732231f · Note