CVE-2009-3026: Medium severity pidgin vulnerability

Published Aug 31, 2009

Updated

protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly other versions, does not follow the "require TLS/SSL" preference when connecting to older Jabber servers that do not follow the XMPP specification, which causes libpurple to connect to the server without the expected encryption and allows remote attackers to sniff sessions.

Affected Software

1 affected component

Pidgin Pidgin=2.6.0

Remediation

Patch Available

http://developer.pidgin.im/viewmtn/revision/diff/312e056d702d29379ea61aea9d27765f127bc888/with/55897c4ce0787edc1e7721b7f4a9b5cbc8357279

Event History

Aug 31, 2009

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2009-3026?

CVE-2009-3026 is considered a moderate severity vulnerability due to its impact on encryption settings.

How do I fix CVE-2009-3026?

To fix CVE-2009-3026, upgrade to a version of Pidgin that enforces TLS/SSL connections properly or adjust server configurations if possible.

Which versions of Pidgin are affected by CVE-2009-3026?

CVE-2009-3026 affects Pidgin version 2.6.0 and possibly other earlier versions.

What does CVE-2009-3026 affect in Pidgin?

CVE-2009-3026 affects the ability of libpurple in Pidgin to enforce TLS/SSL encryption when connecting to older Jabber servers.

Why is CVE-2009-3026 a concern for users?

CVE-2009-3026 is a concern because it allows connections without the expected encryption, potentially exposing user data to interception.