CVE-2011-1271 : The JIT compiler in Microsoft .NET Framework 3.5 Gold and SP1, 3.5.1, and 4.0, when IsJITOptimizerDisabled is false, doe

The JIT compiler in Microsoft .NET Framework 3.5 Gold and SP1, 3.5.1, and 4.0, when IsJITOptimizerDisabled is false, does not properly handle expressions related to null strings, which allows context-dependent attackers to bypass intended access restrictions, and consequently execute arbitrary code, in opportunistic circumstances by leveraging a crafted application, as demonstrated by (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka ".NET Framework JIT Optimization Vulnerability."

Published 2011-05-10 19:55:02

Updated 2023-12-07 18:38:57

Source Microsoft Corporation

View at NVD, CVE.org

Vulnerability category: Execute code

Exploit prediction scoring system (EPSS) score for CVE-2011-1271

Probability of exploitation activity in the next 30 days: 0.75%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 78 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2011-1271

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.1	MEDIUM	AV:N/AC:H/Au:N/C:P/I:P/A:P	4.9	6.4	NIST
Access Vector: Network Access Complexity: High Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

CWE ids for CVE-2011-1271

CWE-264

Assigned by: nvd@nist.gov (Primary)

References for CVE-2011-1271

http://stackoverflow.com/questions/2135509/bug-only-occurring-when-compile-optimization-enabled/

c# - Bug only occurring when compile optimization enabled - Stack Overflow
Exploit
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12686

Repository / Oval Repository
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-044

Microsoft Security Bulletin MS11-044 - Critical | Microsoft Docs

Products affected by CVE-2011-1271

Microsoft » .net Framework » Version: 2.0 Update SP2
cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 2003 Server » Update SP2
When used together with: Microsoft » Windows Server 2003 » Update SP2
When used together with: Microsoft » Windows Server 2008 » Itanium Edition
When used together with: Microsoft » Windows Server 2008 » X32 Edition
When used together with: Microsoft » Windows Server 2008 » X64 Edition
When used together with: Microsoft » Windows Server 2008 » Update SP2 X32 Edition
When used together with: Microsoft » Windows Server 2008 » Update SP2 X64 Edition
When used together with: Microsoft » Windows Server 2008 » Version: N/A Update SP2 Itanium Edition
When used together with: Microsoft » Windows Vista » Update SP1
When used together with: Microsoft » Windows Vista » Update SP2
When used together with: Microsoft » Windows Xp » Update SP3
When used together with: Microsoft » Windows Xp » Version: N/A Update SP2 X64 Edition
Microsoft » .net Framework » Version: 2.0 Update SP1
cpe:2.3:a:microsoft:.net_framework:2.0:sp1:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows Server 2008 » Itanium Edition
When used together with: Microsoft » Windows Server 2008 » X32 Edition
When used together with: Microsoft » Windows Server 2008 » X64 Edition
When used together with: Microsoft » Windows Vista » Update SP1
Microsoft » .net Framework » Version: 3.5
cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 2003 Server » Update SP2
When used together with: Microsoft » Windows Server 2003 » Update SP2
When used together with: Microsoft » Windows Server 2008 » Itanium Edition
When used together with: Microsoft » Windows Server 2008 » X32 Edition
When used together with: Microsoft » Windows Server 2008 » X64 Edition
When used together with: Microsoft » Windows Vista » Update SP1
When used together with: Microsoft » Windows Vista » Update SP2
When used together with: Microsoft » Windows Xp » Update SP3
When used together with: Microsoft » Windows Xp » Version: N/A Update SP2 X64 Edition
Microsoft » .net Framework » Version: 3.5 Update SP1
cpe:2.3:a:microsoft:.net_framework:3.5:sp1:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 2003 Server » Update SP2
When used together with: Microsoft » Windows Server 2003 » Update SP2
When used together with: Microsoft » Windows Server 2008 » Itanium Edition
When used together with: Microsoft » Windows Server 2008 » X32 Edition
When used together with: Microsoft » Windows Server 2008 » X64 Edition
When used together with: Microsoft » Windows Server 2008 » Update SP2 X32 Edition
When used together with: Microsoft » Windows Server 2008 » Update SP2 X64 Edition
When used together with: Microsoft » Windows Server 2008 » Version: N/A Update SP2 Itanium Edition
When used together with: Microsoft » Windows Vista » Update SP1
When used together with: Microsoft » Windows Vista » Update SP2
When used together with: Microsoft » Windows Xp » Update SP3
When used together with: Microsoft » Windows Xp » Version: N/A Update SP2 X64 Edition
Microsoft » .net Framework » Version: 3.5.1
cpe:2.3:a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 7 » Version: N/A
When used together with: Microsoft » Windows 7 » Version: N/A Update SP1 X64 Edition
When used together with: Microsoft » Windows 7 » Version: N/A Update SP1 X86 Edition
When used together with: Microsoft » Windows Server 2008 » Version: R2 Itanium Edition
When used together with: Microsoft » Windows Server 2008 » Version: R2 X64 Edition
Microsoft » .net Framework » Version: 4.0
cpe:2.3:a:microsoft:.net_framework:4.0:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 2003 Server » Update SP2
When used together with: Microsoft » Windows 7 » Version: N/A
When used together with: Microsoft » Windows 7 » Version: N/A Update SP1 X86 Edition
When used together with: Microsoft » Windows Server 2003 » Update SP2
When used together with: Microsoft » Windows Server 2008 » Itanium Edition
When used together with: Microsoft » Windows Server 2008 » X32 Edition
When used together with: Microsoft » Windows Server 2008 » X64 Edition
When used together with: Microsoft » Windows Server 2008 » Update SP2 X32 Edition
When used together with: Microsoft » Windows Server 2008 » Update SP2 X64 Edition
When used together with: Microsoft » Windows Server 2008 » Version: N/A Update SP2 Itanium Edition
When used together with: Microsoft » Windows Server 2008 » Version: R2 Itanium Edition
When used together with: Microsoft » Windows Server 2008 » Version: R2 X64 Edition
When used together with: Microsoft » Windows Vista » Update SP1
When used together with: Microsoft » Windows Vista » Update SP2
When used together with: Microsoft » Windows Xp » Update SP3
When used together with: Microsoft » Windows Xp » Version: N/A Update SP2 X64 Edition

Vulnerability Details : CVE-2011-1271

Exploit prediction scoring system (EPSS) score for CVE-2011-1271

CVSS scores for CVE-2011-1271

CWE ids for CVE-2011-1271

References for CVE-2011-1271

Products affected by CVE-2011-1271