OSVDB ID: 2707 Title: Microsoft IE Drag and Drop Arbitrary File Installation |
Info |
|
|
Dates |
||||
|
|
Description |
Microsoft Internet Explorer contains a flaw in its handling of certain drag-and-drop events. The issue is triggered when a malicious web site is able to predict and exploit the timing of a drag-and-drop operation. It is possible that the flaw may allow a malicious user to install arbitrary files in sensitive locations that may enable further system compromise, resulting in a loss of integrity. |
Classification |
Location:
Remote / Network Access
Attack Type: Input Manipulation, Race Condition Impact: Loss of Integrity Exploit: Exploit Rumored Disclosure: Vendor Verified |
Solution |
Currently, there are no known upgrades or patches to correct this issue. It is possible to correct the flaw by implementing the following workaround(s): 1) Set a Kill Bit on the Shell.Explorer Control 2) Prevent Automatic Navigation to Local Intranet Zone (Windows XP SP2, Windows Server 2003 SP1) 3) Disable Active Scripting |
Products |
|
References |
|
Credit |
|
kc.rr.com -