CVE-2009-3026
published 2009-08-31CVE-2009-3026: protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly other versions, does not follow the "require TLS/SSL" preference when connecting to older…
PriorityP423medium5CVSS 2.0
AVNACLAuNCPINAN
EPSS
1.30%
67.2th percentile
protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly other versions, does not follow the "require TLS/SSL" preference when connecting to older Jabber servers that do not follow the XMPP specification, which causes libpurple to connect to the server without the expected encryption and allows remote attackers to sniff sessions.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | pidgin | < pidgin 2.6.1-1 (bookworm) | pidgin 2.6.1-1 (bookworm) |
| pidgin | pidgin | — | — |
| pidgin | pidgin | >= 0 < 2.6.1-1 | 2.6.1-1 |
| pidgin | pidgin | >= 0 < 2.6.1-1 | 2.6.1-1 |
| pidgin | pidgin | >= 0 < 2.6.1-1 | 2.6.1-1 |
| pidgin | pidgin | >= 0 < 2.6.1-1 | 2.6.1-1 |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv5.0MEDIUM
vendor_debian5.0LOW
vendor_redhat5.0MEDIUM
vendor_ubuntu5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Pidgin vulnerabilities
vendor_ubuntu·2010-01-18·CVSS 5.0
CVE-2008-2955 [MEDIUM] Pidgin vulnerabilities
Title: Pidgin vulnerabilities
Summary: Pidgin vulnerabilities
It was discovered that Pidgin did not properly handle certain topic
messages in the IRC protocol handler. If a user were tricked into
connecting to a malicious IRC server, an attacker could cause Pidgin to
crash, leading to a denial of service. This issue only affected Ubuntu 8.04
LTS, Ubuntu 8.10 and Ubuntu 9.04. (CVE-2009-2703)
It was discovered that Pidgin did not properly enforce the "require
TLS/SSL" setting when connecting to certain older Jabber servers. If a
remote attacker were able to perform a machine-in-the-middle attack, this flaw
could be exploited to view sensitive information. This issue only affected
Ubuntu 8.04 LTS, Ubuntu 8.10 and Ubuntu 9.04. (CVE-2009-3026)
It was discovered that Pidgin did not properly
Red Hat
pidgin: ignores SSL/TLS requirements with old jabber servers
vendor_redhat·2009-01-15·CVSS 5.0
CVE-2009-3026 [MEDIUM] pidgin: ignores SSL/TLS requirements with old jabber servers
pidgin: ignores SSL/TLS requirements with old jabber servers
protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly other versions, does not follow the "require TLS/SSL" preference when connecting to older Jabber servers that do not follow the XMPP specification, which causes libpurple to connect to the server without the expected encryption and allows remote attackers to sniff sessions.
Debian
CVE-2009-3026: pidgin - protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly other version...
vendor_debian·2009·CVSS 5.0
CVE-2009-3026 [MEDIUM] CVE-2009-3026: pidgin - protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly other version...
protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly other versions, does not follow the "require TLS/SSL" preference when connecting to older Jabber servers that do not follow the XMPP specification, which causes libpurple to connect to the server without the expected encryption and allows remote attackers to sniff sessions.
Scope: local
bookworm: resolved (fixed in 2.6.1-1)
bullseye: resolved (fixed in 2.6.1-1)
forky: resolved (fixed in 2.6.1-1)
sid: resolved (fixed in 2.6.1-1)
trixie: resolved (fixed in 2.6.1-1)
GHSA
GHSA-39qg-c7hm-9wwf: protocols/jabber/auth
ghsa_unreviewed·2022-05-02
CVE-2009-3026 [MEDIUM] GHSA-39qg-c7hm-9wwf: protocols/jabber/auth
protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly other versions, does not follow the "require TLS/SSL" preference when connecting to older Jabber servers that do not follow the XMPP specification, which causes libpurple to connect to the server without the expected encryption and allows remote attackers to sniff sessions.
OSV
CVE-2009-3026: protocols/jabber/auth
osv·2009-08-31·CVSS 5.0
CVE-2009-3026 [MEDIUM] CVE-2009-3026: protocols/jabber/auth
protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly other versions, does not follow the "require TLS/SSL" preference when connecting to older Jabber servers that do not follow the XMPP specification, which causes libpurple to connect to the server without the expected encryption and allows remote attackers to sniff sessions.
No detection rules found.
No public exploits indexed.
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=542891http://developer.pidgin.im/ticket/8131http://developer.pidgin.im/viewmtn/revision/diff/312e056d702d29379ea61aea9d27765f127bc888/with/55897c4ce0787edc1e7721b7f4a9b5cbc8357279http://secunia.com/advisories/37071http://www.openwall.com/lists/oss-security/2009/08/24/2http://www.securityfocus.com/bid/36368https://exchange.xforce.ibmcloud.com/vulnerabilities/53000https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11070https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5757http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=542891http://developer.pidgin.im/ticket/8131http://developer.pidgin.im/viewmtn/revision/diff/312e056d702d29379ea61aea9d27765f127bc888/with/55897c4ce0787edc1e7721b7f4a9b5cbc8357279http://secunia.com/advisories/37071http://www.openwall.com/lists/oss-security/2009/08/24/2http://www.securityfocus.com/bid/36368https://exchange.xforce.ibmcloud.com/vulnerabilities/53000https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11070https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5757
2009-08-31
Published