NVD

Id
50243  
Name
CVE-2009-3026  
Description
protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly other versions, does not follow the "require TLS/SSL" preference when connecting to older Jabber servers that do not follow the XMPP specification, which causes libpurple to connect to the server without the expected encryption and allows remote attackers to sniff sessions.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-07  
Published
2009-08-31  
Modified Date
2012-10-22  
Seq
2009-3026  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
254314 50243 CVE-2009-3026 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=542891  View
254315 50243 CVE-2009-3026 http://developer.pidgin.im/ticket/8131  View
254316 50243 CVE-2009-3026 http://developer.pidgin.im/viewmtn/revision/diff/312e056d702d29379ea61aea9d27765f127bc888/with/55897c4ce0787edc1e7721b7f4a9b5cbc8357279  View
254317 50243 CVE-2009-3026 oval:org.mitre.oval:def:11070  View
254318 50243 CVE-2009-3026 oval:org.mitre.oval:def:5757  View
254319 50243 CVE-2009-3026 [oss-security] 20090824 CVE id request: pidgin  View
254320 50243 CVE-2009-3026 36368  View
254321 50243 CVE-2009-3026 pidgin-libpurple-weak-security(53000)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
41163 JVNDB-2009-002170 Pidgin の libpurple におけるセッションを盗聴される脆弱性 Pidgin の libpurple には、旧バージョンの Jabber サーバと接続した場合に "Require SSL/TLS" 設定が適切に行われないため、暗号化せずにサーバと接続し、セッションを盗聴される脆弱性が存在します。 CVE-2009-3026 40457 CVE-2009-3026 50243 5 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002170.html 2009-09-03 2009-11-02 View