---
title: "CVE-2009-3026\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2009-3026?format=md
keywords: index, follow
---

# CVE-2009-3026

Publication date 31 August 2009

Last updated 24 July 2024

---

Ubuntu priority

**Medium**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

Toggle side navigation

## Description

protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly other
versions, does not follow the "require TLS/SSL" preference when connecting
to older Jabber servers that do not follow the XMPP specification, which
causes libpurple to connect to the server without the expected encryption
and allows remote attackers to sniff sessions.

[Read the notes from the security team](https://ubuntu.com/security/CVE-2009-3026?format=md#notes)

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| pidgin | 9.10 karmic | Not affected |
| 9.04 jaunty | Fixed 1:2.5.5-1ubuntu8.5 |
| 8.10 intrepid | Fixed 1:2.5.2-0ubuntu1.6 |
| 8.04 LTS hardy | Fixed 1:2.4.1-1ubuntu2.8 |
| 6.06 LTS dapper | Not in release |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)
* [Patch details](https://ubuntu.com/security/CVE-2009-3026?format=md#patch-details)

## Notes

---

### [mdeslaur](https://launchpad.net/~mdeslaur)

Reproducer in debian bug

### Patch details

For informational purposes only. We recommend not to cherry-pick updates. [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)

| Package | Patch details |
| --- | --- |
| pidgin | * Upstream:   <http://developer.pidgin.im/viewmtn/revision/info/55897c4ce0787edc1e7721b7f4a9b5cbc8357279> |

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3026)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2009-3026)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2009-3026)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2009-3026)

### Related Ubuntu Security Notices (USN)

+ [USN-886-1](https://usn.ubuntu.com/USN-886-1)
+ Pidgin vulnerabilities
+ 18 January 2010

### Other references

* <http://www.openwall.com/lists/oss-security/2009/08/24/2>
* <http://pidgin.im/news/security/?id=36>
* <https://www.cve.org/CVERecord?id=CVE-2009-3026>