There isn't a lot of technical data on this one, but it seems that some network equipment on AT&T's wireless network gave a session cookie to another user. Thereby circumventing authentication and just giving Facebook access to a random person.
"The diversity, volume, and innovation of the research was impressive. Competition was as fierce as ever and the judges had their work cut out. Rich Mogull, Dinis Cruz, Chris Hoff, HD Moore, Billy Rios, Dan Kaminsky, Romain Gaucher, Steven Christey, Jeff Forristal, and Michal Zalewski were tasked with ranking the field based upon novelty, impact, and overall pervasiveness."
"Microsoft is aware of reports of vulnerabilities in Adobe Flash Player
6 provided in Windows XP. We are not aware of attacks that try to use
the reported vulnerabilities or of customer impact at this time but
recommend that users install the latest version of Flash Player provided
"MIT Kerberos is prone to multiple integer-underflow vulnerabilities
because it fails to properly handle malformed encrypted data.
Attackers can exploit these issues to execute arbitrary code with
SYSTEM-level privileges. Failed attacks will result in denial-of-service
Versions prior to Kerberos 5 1.6.4 and 1.7.1 are vulnerable."
"A use-after-free flaw was found in the way CUPS handled references in its
file descriptors-handling interface. A remote attacker could, in a
specially-crafted way, query for the list of current print jobs for a
specific printer, leading to a denial of service (cupsd crash).
"The FBI today reminds Internet users who receive appeals to donate money in the aftermath of Tuesday's earthquake in Haiti to apply a critical eye and do their due diligence before responding to those requests."
As always, when natural disaster strikes, there are people who try to profit off of it. For any place you donate to, make sure to check on them to make sure they are legit. I like using the following resources before I donate.
"Sun Java System Directory Server is prone to a denial-of-service
An attacker can exploit this issue to crash the effected application,
denying service to legitimate users.
Directory Server 7.0 is vulnerable; other versions may also be affected."
No patches have been released at this time.
"A remote user can download arbitrary files from a libpurple-based client."
This vulnerability is through the custom emoticon ability with MSN and
pidgin. This has been fixed in v2.6.5.
It is recommended that MSN users upgrade to v2.6.5 to avoid exposure of
As tax season approaches, users should use caution when choosing their
online tax preparer. Some security analysts are predicting a surge of
malicious tax phishing sites targeted at stealing PII (Personally
Identifiable Information) which could lead to identity theft.
It is recommended to verify the URL in the location bar, and choose a
trusted Tax Preparation site.
Ransomeware, "Data Doctor 2010", has been cracked by Sunbelt Software Security Labs. They have released a tool that can decrypt your files, which are held hostage by the program. If you have been denied access to your files by Data Doctor 2010, follow the link above.