CVE-2011-1271

Exploit

EPSS 20.1%
Veröffentlicht 10.05.2011 19:55:02
Zuletzt bearbeitet 16.06.2026 23:29:03
Erkennungen
Login

The JIT compiler in Microsoft .NET Framework 3.5 Gold and SP1, 3.5.1, and 4.0, when IsJITOptimizerDisabled is false, does not properly handle expressions related to null strings, which allows context-dependent attackers to bypass intended access restrictions, and consequently execute arbitrary code, in opportunistic circumstances by leveraging a crafted application, as demonstrated by (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka ".NET Framework JIT Optimization Vulnerability."

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 6

NVD 6 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Microsoft ≫ .Net Framework Version 4.0

   Microsoft ≫ Windows 2003 Server Update sp2
   Microsoft ≫ Windows 7 Version -
   Microsoft ≫ Windows 7 Version - Update sp1 Edition x86
   Microsoft ≫ Windows Server 2003 Update sp2
   Microsoft ≫ Windows Server 2008 Edition itanium
   Microsoft ≫ Windows Server 2008 Edition x32
   Microsoft ≫ Windows Server 2008 Edition x64
   Microsoft ≫ Windows Server 2008 Update sp2 Edition x32
   Microsoft ≫ Windows Server 2008 Update sp2 Edition x64
   Microsoft ≫ Windows Server 2008 Version - Update sp2 Edition itanium
   Microsoft ≫ Windows Server 2008 Version r2 Edition itanium
   Microsoft ≫ Windows Server 2008 Version r2 Edition x64
   Microsoft ≫ Windows Vista Update sp1
   Microsoft ≫ Windows Vista Update sp2
   Microsoft ≫ Windows Xp Update sp3
   Microsoft ≫ Windows Xp Version - Update sp2 Edition x64

Microsoft ≫ .Net Framework Version 3.5.1

   Microsoft ≫ Windows 7 Version -
   Microsoft ≫ Windows 7 Version - Update sp1 Edition x64
   Microsoft ≫ Windows 7 Version - Update sp1 Edition x86
   Microsoft ≫ Windows Server 2008 Version r2 Edition itanium
   Microsoft ≫ Windows Server 2008 Version r2 Edition x64

Microsoft ≫ .Net Framework Version 2.0 Update sp2

   Microsoft ≫ Windows 2003 Server Update sp2
   Microsoft ≫ Windows Server 2003 Update sp2
   Microsoft ≫ Windows Server 2008 Edition itanium
   Microsoft ≫ Windows Server 2008 Edition x32
   Microsoft ≫ Windows Server 2008 Edition x64
   Microsoft ≫ Windows Server 2008 Update sp2 Edition x32
   Microsoft ≫ Windows Server 2008 Update sp2 Edition x64
   Microsoft ≫ Windows Server 2008 Version - Update sp2 Edition itanium
   Microsoft ≫ Windows Vista Update sp1
   Microsoft ≫ Windows Vista Update sp2
   Microsoft ≫ Windows Xp Update sp3
   Microsoft ≫ Windows Xp Version - Update sp2 Edition x64

Microsoft ≫ .Net Framework Version 3.5 Update sp1

Microsoft ≫ .Net Framework Version 2.0 Update sp1

   Microsoft ≫ Windows Server 2008 Edition itanium
   Microsoft ≫ Windows Server 2008 Edition x32
   Microsoft ≫ Windows Server 2008 Edition x64
   Microsoft ≫ Windows Vista Update sp1

Microsoft ≫ .Net Framework Version 3.5

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	20.1%	0.971

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	5.1	4.9	6.4	AV:N/AC:H/Au:N/C:P/I:P/A:P
CISA-ADP	7.7	2.2	5.5	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

CWE-476 NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

http://stackoverflow.com/questions/2135509/bug-only-occurring-when-compile-optimization-enabled/

Exploit

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-044

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12686

https://nvd.nist.gov/vuln/detail/CVE-2011-1271

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2011-1271

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2011-1271

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2011-1271