lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 05 Dec 2009 09:55:35 +1300
From: Nick FitzGerald <nick@...us-l.demon.co.uk>
To: "bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>
Subject: Re: Millions of PDF invisibly embedded with your internal disk paths

Thor (Hammer of God) wrote:

> "Leaking" a pdf with 'e:\nethome\joe_kitten_lover' doesn't remotely
> "prove" anything.  If I create a user called
> MayIMommaDogFaceToTheBannanPatch and "leaked" a pdf, it doesn't mean
> Steve Martin was culpable.  This is a non-issue, no matter how much you
> might want to create some fanciful "bonsai kitten" theory to get Joe in
> trouble, dawg.

Oddly, or not, that doyen of security sensibility, Microsoft, disagrees 
with you.

A few years back, MS spent quite a bit of effort adding functionality 
to the next-SP-for-the-then-current (and next, in development) versions 
of Office to address exactly these kinds of privacy and information 
leakage through embedded metadata issues with its Office products.  
They also produced standalone tools for removing such metadata for 
users of older versions of Office (which no longer got SP support) and 
to allow mass "cleaning" of large collections of such files.

Is it a big security exposure issue?

That depends on your situation, the risks you're prepared to accept, 
etc, etc.

Does disclosing this issue so more people are aware of it help or hurt?



Regards,

Nick FitzGerald


Powered by blists - more mailing lists