CVEvulnerability
CVE-2009-3026
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2009-08-31
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-310
Description
protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly other versions, does not follow the "require TLS/SSL" preference when connecting to older Jabber servers that do not follow the XMPP specification, which causes libpurple to connect to the server without the expected encryption and allows remote attackers to sniff sessions.
Affected configurations
• pidgin pidgin 2.6.0
Related
Weakness · not in database (1)
References
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=542891 bugs.debian.org
- http://developer.pidgin.im/ticket/8131 developer.pidgin.im
- http://developer.pidgin.im/viewmtn/revision/diff/312e056d702d29379ea61aea9d27765f127bc888/with/55897c4ce0787edc1e7721b7f4a9b5cbc8357279 Patch
- http://secunia.com/advisories/37071 secunia.com
- http://www.openwall.com/lists/oss-security/2009/08/24/2 www.openwall.com
- http://www.securityfocus.com/bid/36368 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53000 exchange.xforce.ibmcloud.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11070 oval.cisecurity.org
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5757 oval.cisecurity.org
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=542891 bugs.debian.org
- http://developer.pidgin.im/ticket/8131 developer.pidgin.im
- http://developer.pidgin.im/viewmtn/revision/diff/312e056d702d29379ea61aea9d27765f127bc888/with/55897c4ce0787edc1e7721b7f4a9b5cbc8357279 Patch
- http://secunia.com/advisories/37071 secunia.com
- http://www.openwall.com/lists/oss-security/2009/08/24/2 www.openwall.com
- http://www.securityfocus.com/bid/36368 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53000 exchange.xforce.ibmcloud.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11070 oval.cisecurity.org
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5757 oval.cisecurity.org