|
Microsoft Internet Explorer Implicit Drag and Drop File Installation Vulnerability
A proof-of-concept is available at the following location. It should be noted that Symantec does not guarantee the integrity of this proof-of-concept: http://www.malware.com/wottapoop.html A second proof-of-concept has been provided by "mikx" <mikx@mikx.de> that obfuscates the executable as a scrollbar and moves the target frame to intercept the victim's mouse events. Symantec cannot guarantee the integrity of this proof-of-concept: http://www.mikx.de/scrollbar/ ** UPDATE: The "mikx" proof-of-concept is reportedly being used by malicious Web sites to install Backdoor.Akak on victim computers. CORE has developed a working commercial exploit for their IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild. |
|
 Privacy Statement |
