bugtraq - Re: Millions of PDF invisibly embedded with your internal disk paths

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-id: <4B19842D.29492.A3903ECF@nick.virus-l.demon.co.uk>
Date: Sat, 05 Dec 2009 10:50:37 +1300
From: Nick FitzGerald <nick@...us-l.demon.co.uk>
To: bugtraq@...urityfocus.com
Subject: Re: Millions of PDF invisibly embedded with your internal disk paths

Ian Bradshaw wrote:

> This isn't a security issue its a privacy issue.

If the leaked, embedded paths can be things like UNCs or IP-based 
internal server addresses, it is arguably a bit more than a privacy 
issue, allowing silent, external, partial mapping of the corporate 
intranet.

Not good if your organization is in the habit of making lots of PDFs 
more or less publicly available from many departments, etc...

Definitely something the security team should be aware of and 
(probably) making sure there are policies, and as necessary, 
amelioration tools and processes, to handle such.

Regards,

Nick FitzGerald