Full Disclosure mailing list archives
Re: Facebook Attach EXE Vulnerability
From: Pablo Ximenes <pablo () ximen es>
Date: Fri, 28 Oct 2011 12:18:48 -0300
Not fixed yet. At least not yesterday when I checked. Nathan, didn't Facebook ask for some time to fix this bug after they have acknowledged it? Pablo Ximenes http://ximen.es/ http://twitter.com/pabloximenes Em 27/10/2011, às 19:29, Joshua Thomas <rappercrazzy () gmail com> escreveu: can't believe such was on FB .... wahahaha !!! lol ....rofl ... When was this discovered and fixed ? On Thu, Oct 27, 2011 at 1:02 AM, Nathan Power < <np () securitypentest com> np () securitypentest com> wrote:
--------------------------------------------------------------------------------- 1. Summary: When using the Facebook 'Messages' tab, there is a feature to attach a file. Using this feature normally, the site won't allow a user to attach an executable file. A bug was discovered to subvert this security mechanisms. Note, you do NOT have to be friends with the user to send them a message with an attachment. --------------------------------------------------------------------------------- Read the rest of this advisory here: <http://www.securitypentest.com/2011/10/facebook-attach-exe-vulnerability.html> http://www.securitypentest.com/2011/10/facebook-attach-exe-vulnerability.html Enjoy :) Nathan Power <http://www.securitypentest.com>www.securitypentest.com _______________________________________________ Full-Disclosure - We believe in it. Charter: <http://lists.grok.org.uk/full-disclosure-charter.html> http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - <http://secunia.com/>http://secunia.com/
_______________________________________________ Full-Disclosure - We believe in it. Charter: <http://lists.grok.org.uk/full-disclosure-charter.html> http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - <http://secunia.com/>http://secunia.com/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Facebook Attach EXE Vulnerability Nathan Power (Oct 27)
- Re: Facebook Attach EXE Vulnerability Joshua Thomas (Oct 27)
- Re: Facebook Attach EXE Vulnerability Pablo Ximenes (Oct 28)
- Re: Facebook Attach EXE Vulnerability Guilherme Scombatti (Oct 28)
- Re: Facebook Attach EXE Vulnerability Peter Dawson (Oct 28)
- Re: Facebook Attach EXE Vulnerability Pablo Ximenes (Oct 28)
- Re: Facebook Attach EXE Vulnerability Peter Dawson (Oct 28)
- Re: Facebook Attach EXE Vulnerability Pablo Ximenes (Oct 28)
- Re: Facebook Attach EXE Vulnerability Nathan Power (Oct 28)
- Re: Facebook Attach EXE Vulnerability Pablo Ximenes (Oct 28)
- Re: Facebook Attach EXE Vulnerability Dave (Oct 28)
- Re: Facebook Attach EXE Vulnerability Joshua Thomas (Oct 27)
- Re: Facebook Attach EXE Vulnerability Nathan Power (Oct 28)
- Re: Facebook Attach EXE Vulnerability Ulises2k (Oct 28)
- Re: Facebook Attach EXE Vulnerability Laurelai (Oct 28)