http://www.network-security.com/activex/
This is a very interesting hole since this is the first time that
someone actually published the source code for examination. The
code was stolen by maglite from a recent 2600 meeting from the
author, a dude named Toby . But the attack is very interesting in
the sense that allows you to turn off the security restrictins of
Internut Explainer 3.2 using activeX just by connecting to a WWW
page.
Check it out. It is bundled with the getadmin stuph published by
the Russian named Sokolov (?)
-Pete