RHBA-2009:0407 - Bug Fix Advisory

Topic

Updated Pidgin packages that fix significant bugs are now available for Red
Hat Enterprise Linux 4 and 5.

Description

Pidgin is a multi-protocol Internet Messaging (IM) client.

This update addresses the following bugs:

• the ICQ Internet message protocol servers recently changed and now

require clients to use a newer version of the ICQ protocol. When logging in
to ICQ Pidgin 2.5.2 (the version previously shipped with Red Hat Enterprise
Linux 4 and 5) fails with an error message as a result. Pidgin 2.5.5,
included with this update, uses the newer ICQ protocol, which resolves this
issue. (BZ#490104, BZ#490094)

Note: Pidgin 2.5.5 also addresses several other minor bugs. See the Pidgin
2.5.5 ChangeLog, linked to in the References section below, for details
regarding these other changes.

• users with "One-Time Password" authenticated logins reported

authentication failures because Pidgin attempts to re-connect using the
previous password after disconnecting from an IM service. This behavior
presented even if the "Remember password" check-box was unchecked in the
Account Editor dialog box for a given account (Choose Accounts > Manage
Accounts to open a list of active accounts. Double-click an account on this
list to show the Account Editor dialog box for that account.)

A new plug-in, "One Time Password Support", is included with this update.
With this plug-in enabled, a "One-Time Password" checkbox appears in the
Advanced tab of the Account Editor dialog box. For each account that
requires One-Time Password authentication, check this checkbox in the
Advanced tab. You must also uncheck the "Remember password" checkbox in the
Basic tab for this plug-in to work. (BZ#490536, BZ#490539)

Note: because of the unpredictable disconnection rate for IM sessions, the
attempts to automatically re-connect noted above are by design and are not
considered a bug. The One Time Password plug-in allows the enforcement, on
a per-account basis, of One-Time Password authentication. With the plug-in
active, Pidgin will still attempt to re-connect to services after being
disconnected. It will not, however, use the previous password.

All Pidgin users should upgrade to these updated packages, which contains
Pidgin version 2.5.5 and resolves these issues. Note: after these errata
packages are installed, Pidgin must be restarted for the update to take
effect.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 5.3 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 5.3 i386
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 4.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 4.7 ia64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 4.7 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.7 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 490536 - [RHEL-4.7] One-Time Password Support for Pidgin
• BZ - 490539 - [RHEL-5.3] One-Time Password Support for Pidgin
• BZ - 490104 - [RHEL-4.7] ICQ login is broken
• BZ - 490094 - [RHEL-5.3] ICQ login is broken

CVEs

(none)

References

• http://www.redhat.com/security/updates/classification/#none
• http://developer.pidgin.im/wiki/ChangeLog#Version2.5.503012009