CVE-2008-3969: Multiple unspecified vulnerabilities in BitlBee before 1.2.3 allow remote attackers to "overwrite" and "hijack" existing accounts via unknown vectors ...

Description

Multiple unspecified vulnerabilities in BitlBee before 1.2.3 allow remote attackers to "overwrite" and "hijack" existing accounts via unknown vectors related to "inconsistent handling of the USTATUS_IDENTIFIED state." NOTE: this issue exists because of an incomplete fix for CVE-2008-3920.

Metrics

EPSS Probability

2.41%

82.0th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Vendor	Product	Versions
Bitlbee	Bitlbee	< 1.2.3
Fedoraproject	Fedora	8

References

http://secunia.com/advisories/31690Third Party Advisory
http://secunia.com/advisories/31991Third Party Advisory
http://security.gentoo.org/glsa/glsa-200809-14.xmlThird Party Advisory
http://www.bitlbee.org/main.php/changelog.htmlRelease Notes, Vendor Advisory
http://www.bitlbee.org/main.php/news.r.htmlRelease Notes, Vendor Advisory
http://www.openwall.com/lists/oss-security/2008/09/08/1Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2008/09/09/11Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/31342Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=461424Issue Tracking, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/45132Third Party Advisory, VDB Entry
https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00587.htmlThird Party Advisory
http://secunia.com/advisories/31690Third Party Advisory
http://secunia.com/advisories/31991Third Party Advisory
http://security.gentoo.org/glsa/glsa-200809-14.xmlThird Party Advisory
http://www.bitlbee.org/main.php/changelog.htmlRelease Notes, Vendor Advisory
http://www.bitlbee.org/main.php/news.r.htmlRelease Notes, Vendor Advisory
http://www.openwall.com/lists/oss-security/2008/09/08/1Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2008/09/09/11Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/31342Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=461424Issue Tracking, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/45132Third Party Advisory, VDB Entry
https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00587.htmlThird Party Advisory

Timeline

Published: Sep 11, 2008
Last Modified: Jun 16, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2008-3969?

Multiple unspecified vulnerabilities in BitlBee before 1.2.3 allow remote attackers to "overwrite" and "hijack" existing accounts via unknown vectors related to "inconsistent handling of the USTATUS_IDENTIFIED state." NOTE: this issue exists because of an incomplete fix for CVE-2008-3920.

How severe is CVE-2008-3969?

Severity scoring for CVE-2008-3969 is pending analysis. The EPSS model estimates a 2.41% probability of exploitation in the next 30 days.

How do I fix CVE-2008-3969?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2008

View all 2008CVEs →