537640 - Thunderbird Master Password bug

Status: RESOLVED DUPLICATE of bug 318697

(Thunderbird :: Security, defect)

Description

[wutzup]

User-Agent:       Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; Tablet PC 2.0)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.5) Gecko/20091204 Thunderbird/3.0

Just installed Thunderbird.
Activated the Master Password feature.
Everything seems to work great until I tested the Master Password Window.

Iam currently experiencing the following issue with my Master Password:

When I enter the wrong master password in Thunderbird, I am prevented from going, it continues to ask me to insert the password, that is good. But when I depress the "cancel" button a few times, the password window disappears and I have totall access to my Thunderbird. This is defintely a problem, any user who do not have the master password to access Thunderbird could enter by clicking the cancel button a few times. I tried this many many times on my computer. 

I have checked to see if anybody reported this problem and I did not see it listed. Please advise what I can do to fix this problem/bug. Thank you. 

Reproducible: Always

Steps to Reproduce:
1.Executed the Thunderbird program
2.The Master Password Window asking for the password would appear
3.Instead of entering the password, I clicked the cancel button a few times and full access to Thunderbird were granted
4. I tried this many times with the same results.
5. This is defintely a security issue.

Comment 1

[Mark Banner (:standard8)]

As stated in the preferences dialog: "A Master Password protects all your passwords..." it is not intended to protect your profile (e.g. you files can be looked at on disk without even starting TB).