Ubuntu 17.04 USN-3300-1 Critical: Juju-Core Administrative Access

ubuntu

May 26, 2017

The system could be made to run programs as an administrator.

Summary

The system could be made to run programs as an administrator.

Software Description:

- juju-core: next generation service orchestration system

Details:

Ryan Beisner discovered juju did not set permissions on a Unix domain

socket. A local attacker could use this flaw to gain administrative

privileges.

Topics Covered

security advisory access control ubuntu administrative access juju-core

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 17.04:
  juju                            2.0.2-0ubuntu2.1
  juju-2.0                        2.0.2-0ubuntu2.1

Ubuntu 16.10:
  juju                            2.0.2-0ubuntu0.16.10.2
  juju-2.0                        2.0.2-0ubuntu0.16.10.2

Ubuntu 16.04 LTS:
  juju                            2.0.2-0ubuntu0.16.04.2
  juju-2.0                        2.0.2-0ubuntu0.16.04.2

Ubuntu 14.04 LTS:
  juju                            1.25.6-0ubuntu1.14.04.2
  juju-core                       1.25.6-0ubuntu1.14.04.2
  juju-local                      1.25.6-0ubuntu1.14.04.2
  juju-local-kvm                  1.25.6-0ubuntu1.14.04.2

After a standard system update you need to restart juju-core to make
all the necessary changes.