CVE-2009-3026
Published Aug 31, 2009
Last updated 7 years ago
Overview
- Description
- protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly other versions, does not follow the "require TLS/SSL" preference when connecting to older Jabber servers that do not follow the XMPP specification, which causes libpurple to connect to the server without the expected encryption and allows remote attackers to sniff sessions.
- Source
- cve@mitre.org
- NVD status
- Modified
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 2.0
- Type
- Primary
- Base score
- 5
- Impact score
- 2.9
- Exploitability score
- 10
- Vector string
- AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
- nvd@nist.gov
- CWE-310
Vendor comments
- Red HatRed Hat has released updates to correct this issue: https://rhn.redhat.com/errata/RHSA-2009-1453.html
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:pidgin:pidgin:2.6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A8321D92-B935-4C2A-81B1-5984BFF4FD57"
}
],
"operator": "OR"
}
]
}
]