Facebook.com suffers from a bypass vulnerability where an executable can be attached to a message if a spaced is added to the name.
d50f0c387bdb7f361f67403ec07249d408f5a19eed5358e240b208741277268f
---------------------------------------------------------------------------------
1. Summary:
When using the Facebook 'Messages' tab, there is a feature to attach a
file.
Using this feature normally, the site won't allow a user to attach an
executable file.
A bug was discovered to subvert this security mechanisms. Note, you do NOT
have
to be friends with the user to send them a message with an attachment.
---------------------------------------------------------------------------------
Read the rest of this advisory here:
http://www.securitypentest.com/2011/10/facebook-attach-exe-vulnerability.html
Enjoy :)
Nathan Power
www.securitypentest.com