CVE-2011-1271

Description

The JIT compiler in Microsoft .NET Framework 3.5 Gold and SP1, 3.5.1, and 4.0, when IsJITOptimizerDisabled is false, does not properly handle expressions related to null strings, which allows context-dependent attackers to bypass intended access restrictions, and consequently execute arbitrary code, in opportunistic circumstances by leveraging a crafted application, as demonstrated by (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka ".NET Framework JIT Optimization Vulnerability."

Related CPE's

amicrosoft.net_framework4.0*******

omicrosoftwindows_vista*sp2x64*****

omicrosoftwindows_server_2008*sp2x32*****

omicrosoftwindows_server_2008r2*itanium*****

omicrosoftwindows_server_2008r2*x64*****

omicrosoftwindows_server_2008-sp2itanium*****

omicrosoftwindows_xp-sp2x64*****

omicrosoftwindows_7-sp1x86*****

omicrosoftwindows_vista*sp1x64*****

omicrosoftwindows_7-*******

References

http://stackoverflow.com/questions/2135509/bug-only-occurring-when-compile-optimization-enabled/

Exploit

oval:org.mitre.oval:def:12686

MS11-044

CvssV3 impact

Could not find any metrics

CvssV2 impact

Version

2.0

VectorString

AV:N/AC:H/Au:N/C:P/I:P/A:P

AccessVector

NETWORK

AccessComplexity

HIGH

Authentication

NONE

ConfidentialityImpact

PARTIAL

IntegrityImpact

PARTIAL

AvailabilityImpact

PARTIAL

BaseScore

5.099999904632568

Created by Yello
About Severity.io