Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I just updated to Thunderbird 3.1 and now when I attempt to add in a new email account for one of my domains I get mail.server.example potentially vulnerable to CVE-2009-3555.

Now reading up on it here I have done the given settings that are in the config editor for TBird because of this error: I added my mail server to security.ssl.renego_unrestricted_hosts and set security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref to true and false. But then the account creator basically breaks.

So how can I either A: make TBird ignore this or B: Add an account another way. I have a few other email accounts hosted from this server and they are working fine.

I understand in the end the server needs to be updated but that is currently an unrealistic option.

share|improve this question

1 Answer 1

https://wiki.mozilla.org/Security:Renegotiation describes this behavior in detail. The behavior is common Firefox and Seamonkey (and possibly other products built on the same codebase).

http://support.mozilla.com/en-US/questions/710015 discusses the issue with regard to Firefox but the solutions mentioned should be applicable to Thunderbird as well.

See also http://groups.google.com/group/mozilla.support.thunderbird/browse_thread/thread/69ba08af60eac3b8?pli=1 https://twitter.com/#!/kaiengert/status/47606502332178432 https://kuix.de/blog/index.php?entry=SSL/TLS-renegotiation-vulnerability-still-widely-unpatched

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.