Description
Race condition in Microsoft Internet Explorer allows user-assisted attackers to overwrite arbitrary files and possibly execute code by tricking a user into performing a drag-and-drop action from certain objects, such as file objects within a folder view, then predicting the drag action, and re-focusing to a malicious window.
References
- 20060213 Internet Explorer drag&drop 0day mailing-list
- ADV-2006-0553 vdb-entry
- 18787 third-party-advisory
- 20060214 Advisory: Internet Explorer Drag and Drop Redeux [CVE-2005-3240] (fwd) mailing-list
- http://www.securiteam.com/windowsntfocus/5MP0B0UHPA.html
- 16352 vdb-entry
- ie-dragdrop-variant(24648) vdb-entry
- 1015049 vdb-entry
- 2707 vdb-entry
- http://blogs.technet.com/msrc/archive/2006/02/13/419439.aspx