1424804 - sender spoofing

Status: RESOLVED DUPLICATE of bug 1423430

(Thunderbird :: Untriaged, defect)

Description

[u608096]

User Agent: Mozilla/5.0 (Windows NT 6.3; rv:52.0) Gecko/20100101 Firefox/52.0
Build ID: 20171107091003

Steps to reproduce:

52.5.0 ESR
There is possible sender e-mail spoofing and injection of false sender addresses that will be presented the preson which receives the mail. VERY DANGEROUS!

Here is living demo: https://www.mailsploit.com/index#demo





Actual results:

Regarding the demo the shown sender is "BEGIN / (|)|<|>|@|,|;|:||"|/|[|]|?|.|= /". Here can be other real characters! The correct sender shall be [e-mail]

Where the bug will be corrected?

I'm going to use Claws mail instead Thunderbird if the bug won't be corrected. I don't need buggy technology (thunderbird 52.5.0). 

I don't hide the problem due to living demo. The problem is publicly known. 


Expected results:

Regarding the demo the shown sender is "BEGIN / (|)|<|>|@|,|;|:||"|/|[|]|?|.|= /". Here can be other real characters! The correct sender shall be [e-mail]

Where the bug will be corrected?

I'm going to use Claws mail instead Thunderbird if the bug won't be corrected. I don't need buggy technology (thunderbird 52.5.0). 

I don't hide the problem due to living demo. The problem is publicly known.

Comment 1

[u608096]

* Where the bug will be corrected?

Comment 2

[u608096]

* When the bug will be corrected?

Comment 3

[Tom Prince [:tomprince]]

Thanks for the report. We are aware of the problem and are tracking fixes in Bug 1423430 and linked bugs.

Comment 4

[Jorg K (CEST = GMT+2)]

Expect a fix in TB 52.5.1 scheduled for release in the next two weeks approximately. The problem is already fixed in TB 58 beta 2 available at https://www.mozilla.org/en-US/thunderbird/channel/.