Hello list, In the aftermath of most of my full-disclosure posts I've observed quite interesting referrer URLs when someone tries to read information provided explaining the issue. In quite some cases, those requests can be attributed to national CERTs, software distributors' security teams, universities with IT-security research units, ... accessing that information. Information leaked via the referrer URLs indicates, that a noticeable number of security experts do not exercise strict separation of their internal working processes, e.g. accessing their internal wiki/mantis/communication/... systems, from the context used for accessing POC data. In rare cases even session IDs are encoded in the URL. A malicious attacker could use the disclosure of e.g. an unrelated zero day to compromise especially machines of CERT/DoD/.. or get at least hints, who is interested in his material, e.g. by requests like [Some-IP] - - [14/May/2013:17:44:38 +0000] "GET /Security/2012/LinuxKernelBinfmtScriptStackDataDisclosure/ HTTP/1.1" 200 7707 "http://rcf.mitre.org/~coley/cve-content/coffin-train-source-complex.html"; "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:20.0) Gecko/20100101 Firefox/20.0" hd PS: just curious: would be interested, what coffin-train-source-complex.html is about, perhaps one having access to the source could forward me a copy. - -- http://www.halfdog.net/ PGP: 156A AE98 B91F 0114 FE88 2BD8 C459 9386 feed a bee