Detections
Analytics
Pidgin < 2.6.1 Multiple Vulnerabilities
medium Nessus Network Monitor Plugin ID 5168
Synopsis
The remote host is vulnerable to multiple attack vectors.Description
The remote host is running Pidgin < 2.6.1. Such versions are potentially affected by multiple issues :- A denial-of-service vulnerability because it fails to properly handle malformed links sent via the Yahoo Instant Messenger protocol. (CVE-2009-3025)
- A man-in-the-middle vulnerability exists because the application does not require the TLS/SSL preference to be enabled when connecting to older Jabber servers. (CVE-2009-3026)
Solution
Upgrade to Pidgin 2.6.1 or later.See Also
http://pidgin.im/news/security/?id=36
Plugin Details
Severity: Medium
ID: 5168
Family: Internet Messengers
Published: 9/11/2009
Updated: 3/6/2019
Nessus ID: 40986
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 4.1
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS v3
Risk Factor: Medium
Base Score: 5.3
Temporal Score: 4.9
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:pidgin:pidgin
Patch Publication Date: 8/18/2009
Vulnerability Publication Date: 9/11/2009
Reference Information
CVE: CVE-2009-3025, CVE-2009-3026