1475856 - bug de seguridad mozilla thunderbird

Status: RESOLVED INVALID

(Thunderbird :: Security, defect)

Description

[PedroDiaz]

Attachment: Video 15-07-2018 17-06-27.mp4

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36

Steps to reproduce:

error that allows impersonation of any email address
the error allows me to evade any email address without being detected as spam



Actual results:

Possible sending of files illegally if it is misused



Expected results:

should ask for an authentication when changing that address

Comment 1

[PedroDiaz]

Attachment: Video 15-07-2018 17-49-41.mp4

Comment 3

[Andre Klapper]

In your first video, at second 26, you can see that your outgoing SMTP server is smtp.strato.com. 
If Strato's mail servers obviously allow spoofing email addresses (like using "[e-mail]") I do not know why you expect some application like Thunderbird to suddenly not allow spoofing email addresses (like using "[e-mail]") anymore?

Proposing to close this task as invalid, if I don't misunderstand something.
Such logic needs to be implement by the SMTP mail server, not by a mail client like Thunderbird.

Comment 4

[Wayne Mery (:wsmwk)]

You might also ask for help at https://support.mozilla.org/questions/new/thunderbird