CVE-2011-1271

Exploit

EPSS 16.42%
Published 10.05.2011 19:55:02
Last modified 11.04.2025 00:51:21
Source secure@microsoft.com
Teams watchlist Login
Open Login

The JIT compiler in Microsoft .NET Framework 3.5 Gold and SP1, 3.5.1, and 4.0, when IsJITOptimizerDisabled is false, does not properly handle expressions related to null strings, which allows context-dependent attackers to bypass intended access restrictions, and consequently execute arbitrary code, in opportunistic circumstances by leveraging a crafted application, as demonstrated by (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka ".NET Framework JIT Optimization Vulnerability."

Affected products Warnungen 0 Metrics 3 CWE 1 References 6

Data is provided by the National Vulnerability Database (NVD)

Microsoft ≫ .Net Framework Version4.0

   Microsoft ≫ Windows 2003 Server Updatesp2
   Microsoft ≫ Windows 7 Version-
   Microsoft ≫ Windows 7 Version- Updatesp1 Editionx86
   Microsoft ≫ Windows Server 2003 Updatesp2
   Microsoft ≫ Windows Server 2008 Editionitanium
   Microsoft ≫ Windows Server 2008 Editionx32
   Microsoft ≫ Windows Server 2008 Editionx64
   Microsoft ≫ Windows Server 2008 Updatesp2 Editionx32
   Microsoft ≫ Windows Server 2008 Updatesp2 Editionx64
   Microsoft ≫ Windows Server 2008 Version- Updatesp2 Editionitanium
   Microsoft ≫ Windows Server 2008 Versionr2 Editionitanium
   Microsoft ≫ Windows Server 2008 Versionr2 Editionx64
   Microsoft ≫ Windows Vista Updatesp1
   Microsoft ≫ Windows Vista Updatesp2
   Microsoft ≫ Windows Xp Updatesp3
   Microsoft ≫ Windows Xp Version- Updatesp2 Editionx64

Microsoft ≫ .Net Framework Version3.5.1

   Microsoft ≫ Windows 7 Version-
   Microsoft ≫ Windows 7 Version- Updatesp1 Editionx64
   Microsoft ≫ Windows 7 Version- Updatesp1 Editionx86
   Microsoft ≫ Windows Server 2008 Versionr2 Editionitanium
   Microsoft ≫ Windows Server 2008 Versionr2 Editionx64

Microsoft ≫ .Net Framework Version2.0 Updatesp2

   Microsoft ≫ Windows 2003 Server Updatesp2
   Microsoft ≫ Windows Server 2003 Updatesp2
   Microsoft ≫ Windows Server 2008 Editionitanium
   Microsoft ≫ Windows Server 2008 Editionx32
   Microsoft ≫ Windows Server 2008 Editionx64
   Microsoft ≫ Windows Server 2008 Updatesp2 Editionx32
   Microsoft ≫ Windows Server 2008 Updatesp2 Editionx64
   Microsoft ≫ Windows Server 2008 Version- Updatesp2 Editionitanium
   Microsoft ≫ Windows Vista Updatesp1
   Microsoft ≫ Windows Vista Updatesp2
   Microsoft ≫ Windows Xp Updatesp3
   Microsoft ≫ Windows Xp Version- Updatesp2 Editionx64

Microsoft ≫ .Net Framework Version3.5 Updatesp1

Microsoft ≫ .Net Framework Version2.0 Updatesp1

   Microsoft ≫ Windows Server 2008 Editionitanium
   Microsoft ≫ Windows Server 2008 Editionx32
   Microsoft ≫ Windows Server 2008 Editionx64
   Microsoft ≫ Windows Vista Updatesp1

Microsoft ≫ .Net Framework Version3.5

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	16.42%	0.947

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	5.1	4.9	6.4	AV:N/AC:H/Au:N/C:P/I:P/A:P
134c704f-9b21-4f2e-91b3-4a467353bcc0	7.7	2.2	5.5	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

CWE-476 NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

http://stackoverflow.com/questions/2135509/bug-only-occurring-when-compile-optimization-enabled/

Exploit

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-044

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12686

https://nvd.nist.gov/vuln/detail/CVE-2011-1271

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2011-1271

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2011-1271

EUVD