IM client library bug plagues Pidgin
Feathers fly due to Libpurple vuln
Agentless Backup is Not a Myth
Users of Pidgin and other alternative IM clients need to update their software following the discovery of potentially serious security flaws.
Pidgin, Finch, Adium, Meebo, and Gaim are all vulnerable to a flaw that stems from a bug in Libpurple, library software for multi-protocol support that's used by many IM clients. The vulnerability stems from bugs in the software function that handles instant messages from the MSN network. The flaw was discovered by CORE Security whose advisory can be found here.
The flaw is particularly serious because all it takes to take advantage of the vulnerability is a message from a regular MSN user, not necessarily on a targeted user's buddy list, the SANS Institute Internet Storm Centre warns.
Users are advised to update to an IM client that uses non-vulnerable versions of Libpurple (version 2.5.9 or above). For Pidgin, the most common of the alternative IM packages affected, that means updating to version 2.5.9 as explained here.
The issue provides further evidence that users of alternative client software may remove themselves from the main line of attacks but not from the need to patch their systems. ®
COMMENTS
RE: Auto-Update
not true,
you need to enable the Release Notification plugin to get update notices on window versions.
carrier??
what we need here is to close down any requests for updates because the users don't know what they need.
mine's the one with the resizable text area in it's pocket
Not programs job to check for updates
"because I'm so used to software automatically checking for updates, I was still using Pidgin 2.4.x"
The thing is, programs on Linux do not typically check for updates, because that's the package manager's job. I got my pidgin updates yesterday on my Ubuntu boxes, before the story even broke! This is I guess one consequence of running a Windows box, then running a bunch of ports of Linux software on it -- better check for updates for them!
IT infrastructure monitoring strategies
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
Data control in the cloud
Cloud based data management
Agentless Backup is Not a Myth
