Matthew Murphy has reported a vulnerability in Internet Explorer, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to error in the timing of drag-and-drop events when certain objects not derived from HTML documents (e.g. files within a folder view) are dragged. This race condition can be exploited to place arbitrary files on a user's system by tricking the user into interacting with a malicious web site.

The vulnerability is related to:
SA12321

Successful exploitation requires a certain amount of timing and user interaction.

Solution
Disable Active Scripting support for all but trusted sites.
Further details available in Customer Area

Provided and/or discovered by
Matthew Murphy

Original Advisory
Matthew Murphy posting on Full-Disclosure:
http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0271.html

Microsoft response:
http://blogs.technet.com/msrc/archive/2006/02/13/419439.aspx

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area