Microsoft Internet Explorer Implicit Drag and Drop File Installation Vulnerability
A proof-of-concept is available at the following location. It should be noted that Symantec does not guarantee the integrity of this proof-of-concept:
A second proof-of-concept has been provided by "mikx" <email@example.com> that obfuscates the executable as a scrollbar and moves the target frame to intercept the victim's mouse events. Symantec cannot guarantee the integrity of this proof-of-concept:
** UPDATE: The "mikx" proof-of-concept is reportedly being used by malicious Web sites to install Backdoor.Akak on victim computers.
CORE has developed a working commercial exploit for their IMPACT
product. This exploit is not otherwise publicly available or known
to be circulating in the wild.