1325179 - Thunderbird cannot send or view trash folder from hushmail account without unblocking Akamai(23.32.0.0-23.63.255.255) 23.61.187.27:80

Status: RESOLVED INVALID

(Thunderbird :: Security, defect)

Description

[Dan Sielicki]

User Agent: Mozilla/5.0 (Windows NT 6.1; rv:50.0) Gecko/20100101 Firefox/50.0
Build ID: 20161129173726

Steps to reproduce:

Thunderbird cannot send or view trash folder from hushmail account without unblocking Akamai(23.32.0.0-23.63.255.255) 23.61.187.27:80


Actual results:

my firewall is blocking this address because it has nothing to do with SMTP and is not secure.

your software should not need to go there.


Expected results:

mail should have been sent to server

Comment 1

[Wayne Mery (:wsmwk)]

(not a vulnerability)

Comment 2

[Jorg K (CEST = GMT+2)]

I'm not aware of TB contacting unwanted addresses on the internet.

Can you please provide more details. I'm looking at my network connections using TCPView and I can see that TB maintains a connections to the IMAP server of an IMAP account. When I send an e-mail, more connections are opened.

You're using Hushmail's servers 65.39.152.135?

Comment 3

[Dan Sielicki]

2016-12-22 20:39:02 reject  Akamai(23.32.0.0-23.63.255.255) outbound connect  C:\Program Files\Mozilla Thunderbird\thunderbird.exe  192.168.1.65  23.61.187.27  45635 80  PID: 2788;
2016-12-22 20:39:02 reject  Akamai(23.32.0.0-23.63.255.255) outbound connect  C:\Program Files\Mozilla Thunderbird\thunderbird.exe  192.168.1.65  23.61.187.27  45636 80  PID: 2788;
2016-12-22 20:39:02 reject  Akamai(23.32.0.0-23.63.255.255) outbound connect  C:\Program Files\Mozilla Thunderbird\thunderbird.exe  192.168.1.65  23.61.187.27  45637 80  PID: 2788;
2016-12-22 20:39:02 reject  Akamai(23.32.0.0-23.63.255.255) outbound connect  C:\Program Files\Mozilla Thunderbird\thunderbird.exe  192.168.1.65  23.61.187.27  45638 80  PID: 2788;
2016-12-22 20:39:03 reject  Akamai(23.32.0.0-23.63.255.255) outbound connect  C:\Program Files\Mozilla Thunderbird\thunderbird.exe  192.168.1.65  23.61.187.27  45639 80  PID: 2788;
2016-12-22 20:39:03 reject  Akamai(23.32.0.0-23.63.255.255) outbound connect  C:\Program Files\Mozilla Thunderbird\thunderbird.exe  192.168.1.65  23.61.187.27  45640 80  PID: 2788;
2016-12-22 20:39:03 reject  Akamai(23.32.0.0-23.63.255.255) outbound connect  C:\Program Files\Mozilla Thunderbird\thunderbird.exe  192.168.1.65  23.61.187.27  45641 80  PID: 2788;
2016-12-22 20:39:03 reject  Akamai(23.32.0.0-23.63.255.255) outbound connect  C:\Program Files\Mozilla Thunderbird\thunderbird.exe  192.168.1.65  23.61.187.27  45642 80  PID: 2788;

Comment 4

[Dan Sielicki]

The previous entry was copied from my firewall log.
TB is clearly attempting to make outbound connection to 23.61.187.27 via port 80.
TB has 3 gmail accounts and 1 one for hushmail.
TB has all message composition set to text only - non html.
TB has junk mail classification support set to Spam Assassin (THIS WAS MY FIRST GUESS - SA DOING CHECK)

Comment 5

[Jorg K (CEST = GMT+2)]

As you know, Akamai is a content delivery network (https://en.wikipedia.org/wiki/Akamai_Technologies)
Pasting 23.61.187.27 into a web browser downloads a 5-byte file of type application/ocsp-response (https://en.wikipedia.org/wiki/Online_Certificate_Status_Protocol).

Most likely, TB is asking for the revocation status of an X.509 digital certificate and the server to provide this information is hosted via Akamai.

Read for example here:
https://www.entrust.com/news/entrust-ssl-certificates-faster-ocsp-leverages-akamai-accelerate-website-performance-reliability-global-users/

Get in contact with Hushmail or the provider of their certificates and ask them how they handle revocation queries.

I don't think we will take any action on this bug.