bugtraq - Word 2007 Email as PDF path disclosure flaw

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20080110160712.25841.qmail@securityfocus.com>
Date: 10 Jan 2008 16:07:12 -0000
From: ebk_lists@...mail.com
To: bugtraq@...urityfocus.com
Subject: Word 2007 Email as PDF path disclosure flaw

Intro:
Word 2007 is the latest installment of Microsoft's word processing program

Bug:
Word 2007 with the "save as pdf" add-on is vulnerable to a path disclosure when using the feature's email as pdf option, accessible through the office button. This feature enables a user to email a word doc as a pdf without saving it as a pdf first. When doing so, the full path to the file is placed on the subject line of the email being drafted. When working with documents that are not resident on the user's drive or an accessible network share (such as an email attachment or web page) the path to the temporary file that is created is placed in the subject line. Like so:

From: Joey Jackrabbit
Sent: Friday, November 30, 2007 2:15 PM
To: Jacob Smith
Cc: John Smith
Subject: C:\Documents and Settings\ebk\Local Settings\Temporary Internet Files\Content.Outlook\FIZK8FYG\My new Document

Testing revealed that only Word exhibits this behavior.

Timeline:
11/30/07 Discovered
11/30/07 Reported to MS
1/8/08 MS Reported this will be addressed in next version/service pack

Workaround:
Delete the path information from the subject line before sending the email