Microsoft Internet Explorer Implicit Drag and Drop File Installation Vulnerability

A proof-of-concept is available at the following location. It should be noted that Symantec does not guarantee the integrity of this proof-of-concept:

A second proof-of-concept has been provided by "mikx" <> that obfuscates the executable as a scrollbar and moves the target frame to intercept the victim's mouse events. Symantec cannot guarantee the integrity of this proof-of-concept:

** UPDATE: The "mikx" proof-of-concept is reportedly being used by malicious Web sites to install Backdoor.Akak on victim computers.

CORE has developed a working commercial exploit for their IMPACT
product. This exploit is not otherwise publicly available or known
to be circulating in the wild.


Privacy Statement
Copyright 2010, SecurityFocus