full-disclosure - PDF's unsafe?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed Sep 21 17:38:37 2005
From: michealespinola at gmail.com (Micheal Espinola Jr)
Subject: PDF's unsafe?

Go check it out.  Attachments in PDF's have been a "feature" for a
couple versions now.

I mean executable attachments, as in files that can be immediately
executed without any decompression or manual loading into an
application.  With Adobe, there is no administratively controllable
criteria against what can be attached or run after it is received by
the end-user.

Your mail server AV may bock executable attachments (.exe's, .bat,
etc), but do you allow .PDF's?   Well, executable attachments can be
IN your .PDF's.  Does you AV scan for that as well?

On 9/21/05, Geo. <geoincidents@....net> wrote:
> >> and I know it doesn't run javascript or allow
> executable attachments in PDF's, like Adobe's does.<<
>
> Executable attachments? How?
>
> Geo.
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

--
ME2  <http://www.santeriasys.net/>