CVE-2009-3026

Publication date 31 August 2009

Last updated 24 July 2024

Ubuntu priority

protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly other versions, does not follow the "require TLS/SSL" preference when connecting to older Jabber servers that do not follow the XMPP specification, which causes libpurple to connect to the server without the expected encryption and allows remote attackers to sniff sessions.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
pidgin	9.10 karmic	Not affected
	9.04 jaunty	Fixed 1:2.5.5-1ubuntu8.5
	8.10 intrepid	Fixed 1:2.5.2-0ubuntu1.6
	8.04 LTS hardy	Fixed 1:2.4.1-1ubuntu2.8
	6.06 LTS dapper	Not in release

Notes

mdeslaur

Reproducer in debian bug

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
pidgin	Upstream: http://developer.pidgin.im/viewmtn/revision/info/55897c4ce0787edc1e7721b7f4a9b5cbc8357279

References

Related Ubuntu Security Notices (USN)