246638 - Incoming junk mail is already read and not marked as junk

Status: RESOLVED DUPLICATE of bug 196749

(MailNews Core :: Database, defect)

Description

[Peter Kirk]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040113
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040113

I have received a couple of junk mails with subject line "! Citibank". These
appear in my inbox as already read. And they don't seem to be recognised as junk
mail although the seem to meet the criteria, which suggests that they are not
being tested to see if they are junk mail. This may be because these mails
already include X-Mozilla-Status lines when I receive them - which may be
because they are sent by Mozilla 1.4.

Reproducible: Always
Steps to Reproduce:
1. This type of mail arrives in my inbox

Actual Results:  
It stays in my inbox, marked as read and as not junk

Expected Results:  
The message should be marked as unread and as junk, and moved to my junk folder

Here is the header of the message, after I have read it and manually transferred
it to the junk folder:

From - Mon Jun 14 01:52:15 2004
X-UIDL: 541a55b22f08393d001551dbdd309bbd
X-Mozilla-Status: 0200
X-Mozilla-Status2: 00000000
Return-path: <[e-mail]>
Envelope-to: [e-mail]
Delivery-date: Mon, 14 Jun 2004 09:50:16 +0100
Received: from [211.204.91.134] (helo=67.15.6.3)
	by pan.hu-pan.com with smtp (Exim 4.34)
	id 1BZnAT-0001iK-8U
	for [e-mail]; Mon, 14 Jun 2004 09:50:13 +0100
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
FCC: mailbox://[e-mail]/Sent
X-Identity-Key: id1
Date: Mon, 14 Jun 2004 13:45:33 +0400
From: Citi <[e-mail]>
X-Mozilla-Draft-Info: internal/draft; vcard=0; receipt=0; uuencode=0
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4)
Gecko/20030624 Netscape/7.1 (ax)
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: [e-mail]
Subject: ! Citibank
Content-Type: multipart/related;
 boundary="------------070309030906020500050004"
X-MailScanner-Information: Please contact the ISP for more information
X-MailScanner: Found to be clean

Comment 1

[David :Bienvenu]

we add the x-mozilla-status header when we download the message - and we don't
add the header when it's sent.  So I suspect the sender added it manually, which
we shouldn't allow.

Comment 2

[Peter Kirk]

It is of course possible that the sender, who is obviously malicious,
deliberately added it to confuse Mozilla. Mozilla should ignore or delete such
lines in incoming mail, for robustness against malicious behaviour like this.

Comment 3

[David :Bienvenu]

yes, we should strip out those headers if they're actually in the incoming mail.

Comment 4

[Peter Kirk]

Attachment: Example Citibank spam with X-Mozilla-Status lines

I received a few more of these Citibank spams. The attached is one of them
saved as .eml straight from my Inbox (the previous example had already been
marked as Junk). Note the double set of X-Mozilla-Status and X-Mozilla-Status2
lines. The second pair was presumably in the message as I received it. Note
that "[e-mail]" is an invalid address.

Comment 5

[Howard Chu]

I've received a few emails like this in the last couple of days too. I think
this bug is a dup of Bug #196749.

Comment 6

[Peter Kirk]

(In reply to comment #5)
> I've received a few emails like this in the last couple of days too. I think
> this bug is a dup of Bug #196749.

Yes, you're right. Glad to see plenty of activity on fixing it there. David B,
please mark this as a dup.

Comment 7

[David :Bienvenu]

dup

*** This bug has been marked as a duplicate of 196749 ***