CVE-2009-3026

2009-08-3100:00:00

ubuntu.com

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.004 Low

EPSS

Percentile

75.0%

JSON

protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly other
versions, does not follow the “require TLS/SSL” preference when connecting
to older Jabber servers that do not follow the XMPP specification, which
causes libpurple to connect to the server without the expected encryption
and allows remote attackers to sniff sessions.

Bugs

Notes

Author	Note
mdeslaur	Reproducer in debian bug

OSVersionArchitecturePackageVersionFilename
ubuntu8.04noarchpidgin< 1:2.4.1-1ubuntu2.8UNKNOWN
ubuntu8.10noarchpidgin< 1:2.5.2-0ubuntu1.6UNKNOWN
ubuntu9.04noarchpidgin< 1:2.5.5-1ubuntu8.5UNKNOWN