619665 - thunderbird dont ask for new password, after delete password, need restart app

Status: RESOLVED DUPLICATE of bug 516464

(Thunderbird :: Security, defect)

Description

[Piotr Pastuszka]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.1; pl; rv:1.9.2.12) Gecko/20101026 Ant.com Toolbar 2.0.1 Firefox/3.6.12
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.1; pl; rv:1.9.2.13) Gecko/20101207 Lightning/1.0b2 Thunderbird/3.1.7 ThunderBrowse/3.3.4

Sorry for poor english.
After delete password thunderbird dont ask for new password.
Need restart app.
It make angry when stored password is bad (not always ask again).
And it is bad when change password by WWW. Thunderbird dont ask for new password and still use old. 


Reproducible: Always

Steps to Reproduce:
1.Delete password
2.Get new mails ("Pobierz" in my Poland version)

Actual Results:  
Nothing. 

Expected Results:  
Should ask for new password

Comment 1

[Ludovic Hirlimann [:Usul]]

Anything in Tools -> Error console when this happens ?

Comment 2

[Piotr Pastuszka]

ONLY:
poczta.o2.pl : server does not support RFC 5746, see CVE-2009-3555

BTW: error console should have date/time stamp. J have to delete my stored password to test again, because Error console had to many entries.

Comment 3

[Ludovic Hirlimann [:Usul]]

It seems that we keep the cached password while the session is active.

Comment 4

[WADA:World Anti-bad-Duping Agency]

Read all bugs in Dependency tree for bug 533006(with "show resolved").
https://bugzilla.mozilla.org/showdependencytree.cgi?id=533006&hide_resolved=0
And read bug 346944 comment #10, please.

Due to bug 533006, password is not prompted again until restart of Tb after login failure by wrong password in some cases(depends on server).
Your case sounds same external symptom as bug 346944 and bug 505481, and same phenomenon as Bug 428611.
Get NSPR log for POP3, IMAP etc.(depends on your server type), and check protocol level flow.
Same problem as one of bugs in the depenency tree?

(In reply to comment #2)
> poczta.o2.pl : server does not support RFC 5746, see CVE-2009-3555

Is the server relevant to your comment #0?
CVE-2009-3555 is for security issue in SSL. Is your server maintaind at latest/safe level?
If the message is shown, connection loss happens. If this happens during retry of login after login failur by wrong password, similar connection loss to Bug 533006 can happen.
Is the message(and connection loss) relevant to your comment #0?
Or comment #0 is simply caused by "kill of connection by server after reject of login by wrong password"? 

If CVE-2009-3555 is irrelvant to your problem of this bug, workroud is perhaps;
1. Remove currently saved password(wrong password) by Paasword Manager.
2. Restart Tb.
3. Type correct password upon first password prompt.

> BTW: error console should have date/time stamp. J have to delete my stored
> password to test again, because Error console had to many entries.

"one problem per a bug" is rule at B.M.O. Please open separate bug fr it after search B.M.O well, and please keep "one problem per a bug".

Comment 5

[Wayne Mery (:wsmwk)]

should be fixed by bug 516464. Please comment in the bug if you still see this problem in version 60