495661 - mail download blocked, alert msg:Thunderbird received a message with incorrect Message Authentication Code. From spop.west.cox.net server, an ssl.

Status: RESOLVED WORKSFORME

(Thunderbird :: Security, defect)

Description

[hbassham]

User-Agent:       Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; OfficeLiveConnector.1.3; OfficeLivePatch.0.0)
Build Identifier: Thunderbird Version 2.0.0.21(20090302)

This is second occurance in a week. Unable to download mail from the spop.west.cox.net ssl server due to an Alert message box that appears and says "Thunderbird received a message with incorrect Message Authentication Code. If this error occurs frequently, contact the website administrator. They say it is not their problem. Using port 995 and ssl.
This does not happen using my other mail servers at road runner, gmail and others.

Reproducible: Always

Steps to Reproduce:
1.attempt to download new mail from spop.west.cox.net.
2.click on download new mail
3.Alert error box appears with above message. Only options are "X" upper right in box or "OK" at bottom of box.
Actual Results:  
Logging onto my email account at cox.net and attempting to download mail causes the Alert box to appear as above and clicking ok or X clears the box but no email download is possible as the box just reappears when attempting to get the email. This does not occur when signing into the cox.net webmail page since Thunderbird is not used when going direct to the webmail page. The first time it happened, Thunderbird worked ok after rebooting the computer. That is not working now. Thunderbird seems to be blocked from logging into the mail server by the display of the Alert message box.

Expected Results:  
After reboot the first time it happened the cox webmail worked ok. 
I use three other webmail servers for other email and they all work normally with Thunderbird.

I cannot identify what an incorrect Message Authentication Code would be.

Comment 1

[WADA:World Anti-bad-Duping Agency]

> incorrect Message Authentication Code
> Using port 995 and ssl.

Sounds error code of -12273 or -12272 case.
> http://www.mozilla.org/projects/security/pki/nss/ref/ssl/sslerr.html
Some Web pages found Google search for "incorrect Message Authentication Code" refer to "firewall".
> http://forums.mozillazine.org/viewtopic.php?t=617416
> http://cyberstarweb.com/post/Fix-for-Firefox-received-a-message-with-incorrect-Message-Authentication-Code.aspx
What firewall software do you use?
Does your problem occur when firewall software/anti-virus software is disabled?

Comment 2

[Ludovic Hirlimann [:Usul]]

Work:src ludo$ openssl s_client  -connect spop.west.cox.net:995 -showcerts
CONNECTED(00000003)
depth=0 /C=US/ST=Georgia/L=Alpharetta/O=Cox Communications/OU=DPS/CN=*.west.cox.net
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 /C=US/ST=Georgia/L=Alpharetta/O=Cox Communications/OU=DPS/CN=*.west.cox.net
verify error:num=27:certificate not trusted
verify return:1
depth=0 /C=US/ST=Georgia/L=Alpharetta/O=Cox Communications/OU=DPS/CN=*.west.cox.net
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
 0 s:/C=US/ST=Georgia/L=Alpharetta/O=Cox Communications/OU=DPS/CN=*.west.cox.net
   i:/C=ZA/ST=Western Cape/L=Cape Town/O=Thawte Consulting cc/OU=Certification Services Division/CN=Thawte Premium Server CA/emailAddress=[e-mail]
-----BEGIN CERTIFICATE-----
MIIDczCCAtygAwIBAgIQDR2QYrjlOm2cYEvO9ZKXaDANBgkqhkiG9w0BAQUFADCB
zjELMAkGA1UEBhMCWkExFTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJ
Q2FwZSBUb3duMR0wGwYDVQQKExRUaGF3dGUgQ29uc3VsdGluZyBjYzEoMCYGA1UE
CxMfQ2VydGlmaWNhdGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjEhMB8GA1UEAxMYVGhh
d3RlIFByZW1pdW0gU2VydmVyIENBMSgwJgYJKoZIhvcNAQkBFhlwcmVtaXVtLXNl
cnZlckB0aGF3dGUuY29tMB4XDTA5MDExOTExMjQ1OFoXDTExMDExOTExMjQ1OFow
eDELMAkGA1UEBhMCVVMxEDAOBgNVBAgTB0dlb3JnaWExEzARBgNVBAcTCkFscGhh
cmV0dGExGzAZBgNVBAoTEkNveCBDb21tdW5pY2F0aW9uczEMMAoGA1UECxMDRFBT
MRcwFQYDVQQDDA4qLndlc3QuY294Lm5ldDCBnzANBgkqhkiG9w0BAQEFAAOBjQAw
gYkCgYEAviNk9bk8Ob4WZFE/LC2EdQowOuXRhQwWEV8dijVLDO+HgEVpxTbAnNpb
LgMx5kTRTkxKTXN4exifRxH2cHJdWV89a6aXDCNueayuVAjvmRO4tOHon0RrxVaD
30vQHRVYA7nve1HTjcyK59XQbiS1b6Z+VKZYnD8twHUryBfOrOkCAwEAAaOBpjCB
ozAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwQAYDVR0fBDkwNzA1oDOg
MYYvaHR0cDovL2NybC50aGF3dGUuY29tL1RoYXd0ZVByZW1pdW1TZXJ2ZXJDQS5j
cmwwMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzABhhZodHRwOi8vb2NzcC50aGF3
dGUuY29tMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQEFBQADgYEAYncqpN2Vtu5H
zz2/RMjdUWxd4VXsT8JqHFArIdrqcgwWG1ASa0pX+gIfZH0KKM3E+Pde9aMm/sov
fWONc0spb1qOzTKZGsKsecMo/vZigVCIbTTKD2pWf3xk0KTHV14hV5TE7gS4f3Dw
boEw8HM1EJgSedqGQEOB38aadu5SSz0=
-----END CERTIFICATE-----
---
Server certificate
subject=/C=US/ST=Georgia/L=Alpharetta/O=Cox Communications/OU=DPS/CN=*.west.cox.net
issuer=/C=ZA/ST=Western Cape/L=Cape Town/O=Thawte Consulting cc/OU=Certification Services Division/CN=Thawte Premium Server CA/emailAddress=[e-mail]
---
No client certificate CA names sent
---
SSL handshake has read 1023 bytes and written 306 bytes
---
New, TLSv1/SSLv3, Cipher is RC4-MD5
Server public key is 1024 bit
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : RC4-MD5
    Session-ID: BDD906BAB14EBD36C8BE61269C7E4A93785F96E7FC7E927D64F7A674017CB872
    Session-ID-ctx: 
    Master-Key: 0F66EA6A51A16C8C2E4CB01E330DBF13F2954017272A3CFCB6210B20FBBC2EA7E7D8ECB4A7BFCD4C7079B061923DF143
    Key-Arg   : None
    Start Time: 1243931212
    Timeout   : 300 (sec)
    Verify return code: 21 (unable to verify the first certificate)
---
+OK fed1rmpop108 InterMail POP3 server ready.


could we be chocking on : 
Work:src ludo$ openssl s_client  -connect spop.west.cox.net:995 -showcerts
CONNECTED(00000003)
depth=0 /C=US/ST=Georgia/L=Alpharetta/O=Cox Communications/OU=DPS/CN=*.west.cox.net
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 /C=US/ST=Georgia/L=Alpharetta/O=Cox Communications/OU=DPS/CN=*.west.cox.net
verify error:num=27:certificate not trusted
verify return:1
depth=0 /C=US/ST=Georgia/L=Alpharetta/O=Cox Communications/OU=DPS/CN=*.west.cox.net
verify error:num=21:unable to verify the first certificate
verify return:1

Comment 3

[hbassham]

The solution seems to be a COX.NET problem tha they solved and my problem went away 24 hours after filing my request with COX. The denied the problem was theirs but it disappeared the following day.

Comment 4

[Ludovic Hirlimann [:Usul]]

(In reply to comment #3)
> The solution seems to be a COX.NET problem tha they solved and my problem went

Thanks - from the above it looked like one of their cert was broken (but ain't sure).