Bugtraq mailing list archives
Re: Millions of PDF invisibly embedded with your internal disk paths
From: Nick FitzGerald <nick () virus-l demon co uk>
Date: Sat, 05 Dec 2009 09:55:35 +1300
Thor (Hammer of God) wrote:
"Leaking" a pdf with 'e:\nethome\joe_kitten_lover' doesn't remotely "prove" anything. If I create a user called MayIMommaDogFaceToTheBannanPatch and "leaked" a pdf, it doesn't mean Steve Martin was culpable. This is a non-issue, no matter how much you might want to create some fanciful "bonsai kitten" theory to get Joe in trouble, dawg.
Oddly, or not, that doyen of security sensibility, Microsoft, disagrees with you. A few years back, MS spent quite a bit of effort adding functionality to the next-SP-for-the-then-current (and next, in development) versions of Office to address exactly these kinds of privacy and information leakage through embedded metadata issues with its Office products. They also produced standalone tools for removing such metadata for users of older versions of Office (which no longer got SP support) and to allow mass "cleaning" of large collections of such files. Is it a big security exposure issue? That depends on your situation, the risks you're prepared to accept, etc, etc. Does disclosing this issue so more people are aware of it help or hurt? Regards, Nick FitzGerald
Current thread:
- Re: Millions of PDF invisibly embedded with your internal disk paths Pavel Machek (Dec 03)
- Message not available
- RE: Millions of PDF invisibly embedded with your internal disk paths Thor (Hammer of God) (Dec 04)
- RE: Millions of PDF invisibly embedded with your internal disk paths Ian Bradshaw (Dec 04)
- Re: Millions of PDF invisibly embedded with your internal disk paths Nick FitzGerald (Dec 07)
- RE: Millions of PDF invisibly embedded with your internal disk paths Thor (Hammer of God) (Dec 10)
- RE: Millions of PDF invisibly embedded with your internal disk paths Thor (Hammer of God) (Dec 04)
- Re: Millions of PDF invisibly embedded with your internal disk paths Nick FitzGerald (Dec 07)
- Message not available
- Message not available
- Re: Millions of PDF invisibly embedded with your internal disk paths Pavel Machek (Dec 07)