Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

8
  • Oh this is interesting! I haven't thought about using PDF/A for this purpose before. I suppose I should fuzz some parsers in PDF/A mode and see how that works out... Commented Oct 31, 2018 at 3:09
  • Thank you very much .@PushfPopf so the web server should "run" a PDF/A converter? Is there a tool or piece of code you would suggest? Commented Oct 31, 2018 at 15:55
  • 1
    I'd be very surprised if the conversion process was exploitable (aside from making it fail) however if you're concerned, there's no reason you couldn't run it in a vm. Commented Nov 1, 2018 at 12:46
  • 1
    @fargo01 I really have no idea. I use GhostScript in a high volume 24x7 production environment and have never had any issues with it. I don't know anything about pdfium. Commented Nov 1, 2018 at 12:50
  • 1
    @fargo01 The exploits are typically in the viewer app or GDI on the user's desktop. I'm running it on a headless server which has neither. Commented Nov 1, 2018 at 12:52