Pidgin < 2.6.1 Multiple Vulnerabilities
medium Nessus Network Monitor Plugin ID 5168
New! Plugin Severity Now Using CVSS v3
The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Synopsis
The remote host is vulnerable to multiple attack vectors.Description
The remote host is running Pidgin < 2.6.1. Such versions are potentially affected by multiple issues :- A denial-of-service vulnerability because it fails to properly handle malformed links sent via the Yahoo Instant Messenger protocol. (CVE-2009-3025)
- A man-in-the-middle vulnerability exists because the application does not require the TLS/SSL preference to be enabled when connecting to older Jabber servers. (CVE-2009-3026)
Solution
Upgrade to Pidgin 2.6.1 or later.See Also
http://pidgin.im/news/security/?id=36
Plugin Details
Severity: Medium
ID: 5168
Family: Internet Messengers
Published: 9/11/2009
Updated: 3/6/2019
Nessus ID: 40986
Risk Information
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 4.1
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P
Temporal Vector: CVSS2#E:F/RL:OF/RC:C
CVSS v3
Risk Factor: Medium
Base Score: 5.3
Temporal Score: 4.9
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
Vulnerability Information
CPE: cpe:2.3:a:pidgin:pidgin:*:*:*:*:*:*:*:*
Patch Publication Date: 8/18/2009
Vulnerability Publication Date: 9/11/2009
Reference Information
CVE: CVE-2009-3025, CVE-2009-3026