Microsoft Internet Explorer Implicit Drag and Drop File Installation Vulnerability

A proof-of-concept is available at the following location. It should be noted that Symantec does not guarantee the integrity of this proof-of-concept:

http://www.malware.com/wottapoop.html

A second proof-of-concept has been provided by "mikx" <mikx@mikx.de> that obfuscates the executable as a scrollbar and moves the target frame to intercept the victim's mouse events. Symantec cannot guarantee the integrity of this proof-of-concept:

http://www.mikx.de/scrollbar/

** UPDATE: The "mikx" proof-of-concept is reportedly being used by malicious Web sites to install Backdoor.Akak on victim computers.

CORE has developed a working commercial exploit for their IMPACT
product. This exploit is not otherwise publicly available or known
to be circulating in the wild.


 

Privacy Statement
Copyright 2010, SecurityFocus