911769 - Emails disclosure on Thunderbird

Status: RESOLVED INVALID

(Thunderbird :: Security, defect)

Description

[Fabian Cuchietti]

Attachment: thunderbird-mail-disclosure.mp4

User Agent: Mozilla/5.0 (Windows NT 6.1; rv:23.0) Gecko/20100101 Firefox/23.0 (Beta/Release)
Build ID: 20130814063812

Steps to reproduce:

Hello Mozilla Security,

I discovered an issue in "Earlybird / Thunderbird" Read mails without having an access password thunderbird, this allows full disclosure of emails a user. Attached a video as proof of concept.


Steps to reproduce:
Open Mozilla and go to the following directory:

file:///C:/Users/{PC-USER}/AppData/Roaming/Thunderbird/Profiles/j1k1jwpq.default/ImapMail/imap.googlemail.com/%5BGmail%5D.sbd/Todos

I have read the emails without having to get your password,

Regards.

Comment 1

[Wayne Mery (:wsmwk)]

(not security sensitive)

Comment 2

[Fabian Cuchietti]

"Dupeme" what mean this?

Comment 3

[Fabian Cuchietti]

This issue is considered valid?

Comment 4

[Mark Banner (:standard8)]

Thunderbird makes no promises to data security on the local machine and is not designed for multiple users from the same log in. If users are concerned about data security, they should use OS level protection, or other security applications to sandbox Thunderbird in a way that can only be accessed by password.