CVE-2009-3026
First published: Mon Aug 31 2009(Updated: )
protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly other versions, does not follow the "require TLS/SSL" preference when connecting to older Jabber servers that do not follow the XMPP specification, which causes libpurple to connect to the server without the expected encryption and allows remote attackers to sniff sessions.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Pidgin | =2.6.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2009/08/24/2
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=542891
- http://developer.pidgin.im/ticket/8131
- http://developer.pidgin.im/viewmtn/revision/diff/312e056d702d29379ea61aea9d27765f127bc888/with/55897c4ce0787edc1e7721b7f4a9b5cbc8357279
- http://secunia.com/advisories/37071
- http://www.securityfocus.com/bid/36368
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53000
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5757
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11070
Frequently Asked Questions
What is the severity of CVE-2009-3026?
CVE-2009-3026 is considered a moderate severity vulnerability due to its impact on encryption settings.
How do I fix CVE-2009-3026?
To fix CVE-2009-3026, upgrade to a version of Pidgin that enforces TLS/SSL connections properly or adjust server configurations if possible.
Which versions of Pidgin are affected by CVE-2009-3026?
CVE-2009-3026 affects Pidgin version 2.6.0 and possibly other earlier versions.
What does CVE-2009-3026 affect in Pidgin?
CVE-2009-3026 affects the ability of libpurple in Pidgin to enforce TLS/SSL encryption when connecting to older Jabber servers.
Why is CVE-2009-3026 a concern for users?
CVE-2009-3026 is a concern because it allows connections without the expected encryption, potentially exposing user data to interception.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/remedy
- agent/author
- agent/references
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/pidgin
- canonical/pidgin
- version/pidgin/2.6.0