// For flags

CVE-2011-1271

Microsoft .NET Framework JIT Compiler - Optimization NULL String Remote Code Execution

Severity Score

7.7
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

2
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

The JIT compiler in Microsoft .NET Framework 3.5 Gold and SP1, 3.5.1, and 4.0, when IsJITOptimizerDisabled is false, does not properly handle expressions related to null strings, which allows context-dependent attackers to bypass intended access restrictions, and consequently execute arbitrary code, in opportunistic circumstances by leveraging a crafted application, as demonstrated by (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka ".NET Framework JIT Optimization Vulnerability."

El Compilador JIT en Microsoft .NET Framework versiones 3.5 Gold y SP1, 3.5.1 y 4.0, cuando IsJITOptimizerDisabled es falso, no controla apropiadamente las expresiones relacionadas con cadenas NULL, lo que permite a los atacantes dependiendo del contexto omitir las restricciones de acceso previstas, y, en consecuencia, ejecutar código arbitrario, en circunstancias oportunistas mediante la explotación a una aplicación creada, como es demostrado por (1) una aplicación de navegador XAML creada (también conocida como XBAP), (2) una aplicación ASP.NET creada, o (3) una aplicación de .NET Framework creada, también se conoce como "NET Framework JIT Optimization Vulnerability".

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
Low
Attack Vector
Network
Attack Complexity
High
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2011-03-04 CVE Reserved
  • 2011-03-04 First Exploit
  • 2011-05-10 CVE Published
  • 2023-03-07 EPSS Updated
  • 2024-10-17 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-264: Permissions, Privileges, and Access Controls
  • CWE-476: NULL Pointer Dereference
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
4.0
Search vendor "Microsoft" for product ".net Framework" and version "4.0"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows 2003 Server
Search vendor "Microsoft" for product "Windows 2003 Server"
*sp2
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
4.0
Search vendor "Microsoft" for product ".net Framework" and version "4.0"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows 7
Search vendor "Microsoft" for product "Windows 7"
--
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
4.0
Search vendor "Microsoft" for product ".net Framework" and version "4.0"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows 7
Search vendor "Microsoft" for product "Windows 7"
-sp1, x86
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
4.0
Search vendor "Microsoft" for product ".net Framework" and version "4.0"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows Server 2003
Search vendor "Microsoft" for product "Windows Server 2003"
*sp2
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
4.0
Search vendor "Microsoft" for product ".net Framework" and version "4.0"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows Server 2008
Search vendor "Microsoft" for product "Windows Server 2008"
*itanium
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
4.0
Search vendor "Microsoft" for product ".net Framework" and version "4.0"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows Server 2008
Search vendor "Microsoft" for product "Windows Server 2008"
*x32
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
4.0
Search vendor "Microsoft" for product ".net Framework" and version "4.0"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows Server 2008
Search vendor "Microsoft" for product "Windows Server 2008"
*x64
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
4.0
Search vendor "Microsoft" for product ".net Framework" and version "4.0"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows Server 2008
Search vendor "Microsoft" for product "Windows Server 2008"
*sp2, x32
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
4.0
Search vendor "Microsoft" for product ".net Framework" and version "4.0"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows Server 2008
Search vendor "Microsoft" for product "Windows Server 2008"
*sp2, x64
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
4.0
Search vendor "Microsoft" for product ".net Framework" and version "4.0"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows Server 2008
Search vendor "Microsoft" for product "Windows Server 2008"
-sp2, itanium
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
4.0
Search vendor "Microsoft" for product ".net Framework" and version "4.0"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows Server 2008
Search vendor "Microsoft" for product "Windows Server 2008"
r2
Search vendor "Microsoft" for product "Windows Server 2008" and version "r2"
itanium
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
4.0
Search vendor "Microsoft" for product ".net Framework" and version "4.0"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows Server 2008
Search vendor "Microsoft" for product "Windows Server 2008"
r2
Search vendor "Microsoft" for product "Windows Server 2008" and version "r2"
x64
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
4.0
Search vendor "Microsoft" for product ".net Framework" and version "4.0"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows Vista
Search vendor "Microsoft" for product "Windows Vista"
*sp1
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
4.0
Search vendor "Microsoft" for product ".net Framework" and version "4.0"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows Vista
Search vendor "Microsoft" for product "Windows Vista"
*sp2
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
4.0
Search vendor "Microsoft" for product ".net Framework" and version "4.0"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows Xp
Search vendor "Microsoft" for product "Windows Xp"
*sp3
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
4.0
Search vendor "Microsoft" for product ".net Framework" and version "4.0"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows Xp
Search vendor "Microsoft" for product "Windows Xp"
-sp2, x64
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
3.5.1
Search vendor "Microsoft" for product ".net Framework" and version "3.5.1"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows 7
Search vendor "Microsoft" for product "Windows 7"
--
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
3.5.1
Search vendor "Microsoft" for product ".net Framework" and version "3.5.1"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows 7
Search vendor "Microsoft" for product "Windows 7"
-sp1, x64
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
3.5.1
Search vendor "Microsoft" for product ".net Framework" and version "3.5.1"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows 7
Search vendor "Microsoft" for product "Windows 7"
-sp1, x86
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
3.5.1
Search vendor "Microsoft" for product ".net Framework" and version "3.5.1"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows Server 2008
Search vendor "Microsoft" for product "Windows Server 2008"
r2
Search vendor "Microsoft" for product "Windows Server 2008" and version "r2"
itanium
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
3.5.1
Search vendor "Microsoft" for product ".net Framework" and version "3.5.1"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows Server 2008
Search vendor "Microsoft" for product "Windows Server 2008"
r2
Search vendor "Microsoft" for product "Windows Server 2008" and version "r2"
x64
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
2.0
Search vendor "Microsoft" for product ".net Framework" and version "2.0"
sp2
Affected
in Microsoft
Search vendor "Microsoft"
Windows 2003 Server
Search vendor "Microsoft" for product "Windows 2003 Server"
*sp2
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
2.0
Search vendor "Microsoft" for product ".net Framework" and version "2.0"
sp2
Affected
in Microsoft
Search vendor "Microsoft"
Windows Server 2003
Search vendor "Microsoft" for product "Windows Server 2003"
*sp2
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
2.0
Search vendor "Microsoft" for product ".net Framework" and version "2.0"
sp2
Affected
in Microsoft
Search vendor "Microsoft"
Windows Server 2008
Search vendor "Microsoft" for product "Windows Server 2008"
*itanium
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
2.0
Search vendor "Microsoft" for product ".net Framework" and version "2.0"
sp2
Affected
in Microsoft
Search vendor "Microsoft"
Windows Server 2008
Search vendor "Microsoft" for product "Windows Server 2008"
*x32
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
2.0
Search vendor "Microsoft" for product ".net Framework" and version "2.0"
sp2
Affected
in Microsoft
Search vendor "Microsoft"
Windows Server 2008
Search vendor "Microsoft" for product "Windows Server 2008"
*x64
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
2.0
Search vendor "Microsoft" for product ".net Framework" and version "2.0"
sp2
Affected
in Microsoft
Search vendor "Microsoft"
Windows Server 2008
Search vendor "Microsoft" for product "Windows Server 2008"
*sp2, x32
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
2.0
Search vendor "Microsoft" for product ".net Framework" and version "2.0"
sp2
Affected
in Microsoft
Search vendor "Microsoft"
Windows Server 2008
Search vendor "Microsoft" for product "Windows Server 2008"
*sp2, x64
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
2.0
Search vendor "Microsoft" for product ".net Framework" and version "2.0"
sp2
Affected
in Microsoft
Search vendor "Microsoft"
Windows Server 2008
Search vendor "Microsoft" for product "Windows Server 2008"
-sp2, itanium
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
2.0
Search vendor "Microsoft" for product ".net Framework" and version "2.0"
sp2
Affected
in Microsoft
Search vendor "Microsoft"
Windows Vista
Search vendor "Microsoft" for product "Windows Vista"
*sp1
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
2.0
Search vendor "Microsoft" for product ".net Framework" and version "2.0"
sp2
Affected
in Microsoft
Search vendor "Microsoft"
Windows Vista
Search vendor "Microsoft" for product "Windows Vista"
*sp2
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
2.0
Search vendor "Microsoft" for product ".net Framework" and version "2.0"
sp2
Affected
in Microsoft
Search vendor "Microsoft"
Windows Xp
Search vendor "Microsoft" for product "Windows Xp"
*sp3
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
2.0
Search vendor "Microsoft" for product ".net Framework" and version "2.0"
sp2
Affected
in Microsoft
Search vendor "Microsoft"
Windows Xp
Search vendor "Microsoft" for product "Windows Xp"
-sp2, x64
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
3.5
Search vendor "Microsoft" for product ".net Framework" and version "3.5"
sp1
Affected
in Microsoft
Search vendor "Microsoft"
Windows 2003 Server
Search vendor "Microsoft" for product "Windows 2003 Server"
*sp2
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
3.5
Search vendor "Microsoft" for product ".net Framework" and version "3.5"
sp1
Affected
in Microsoft
Search vendor "Microsoft"
Windows Server 2003
Search vendor "Microsoft" for product "Windows Server 2003"
*sp2
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
3.5
Search vendor "Microsoft" for product ".net Framework" and version "3.5"
sp1
Affected
in Microsoft
Search vendor "Microsoft"
Windows Server 2008
Search vendor "Microsoft" for product "Windows Server 2008"
*itanium
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
3.5
Search vendor "Microsoft" for product ".net Framework" and version "3.5"
sp1
Affected
in Microsoft
Search vendor "Microsoft"
Windows Server 2008
Search vendor "Microsoft" for product "Windows Server 2008"
*x32
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
3.5
Search vendor "Microsoft" for product ".net Framework" and version "3.5"
sp1
Affected
in Microsoft
Search vendor "Microsoft"
Windows Server 2008
Search vendor "Microsoft" for product "Windows Server 2008"
*x64
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
3.5
Search vendor "Microsoft" for product ".net Framework" and version "3.5"
sp1
Affected
in Microsoft
Search vendor "Microsoft"
Windows Server 2008
Search vendor "Microsoft" for product "Windows Server 2008"
*sp2, x32
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
3.5
Search vendor "Microsoft" for product ".net Framework" and version "3.5"
sp1
Affected
in Microsoft
Search vendor "Microsoft"
Windows Server 2008
Search vendor "Microsoft" for product "Windows Server 2008"
*sp2, x64
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
3.5
Search vendor "Microsoft" for product ".net Framework" and version "3.5"
sp1
Affected
in Microsoft
Search vendor "Microsoft"
Windows Server 2008
Search vendor "Microsoft" for product "Windows Server 2008"
-sp2, itanium
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
3.5
Search vendor "Microsoft" for product ".net Framework" and version "3.5"
sp1
Affected
in Microsoft
Search vendor "Microsoft"
Windows Vista
Search vendor "Microsoft" for product "Windows Vista"
*sp1
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
3.5
Search vendor "Microsoft" for product ".net Framework" and version "3.5"
sp1
Affected
in Microsoft
Search vendor "Microsoft"
Windows Vista
Search vendor "Microsoft" for product "Windows Vista"
*sp2
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
3.5
Search vendor "Microsoft" for product ".net Framework" and version "3.5"
sp1
Affected
in Microsoft
Search vendor "Microsoft"
Windows Xp
Search vendor "Microsoft" for product "Windows Xp"
*sp3
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
3.5
Search vendor "Microsoft" for product ".net Framework" and version "3.5"
sp1
Affected
in Microsoft
Search vendor "Microsoft"
Windows Xp
Search vendor "Microsoft" for product "Windows Xp"
-sp2, x64
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
2.0
Search vendor "Microsoft" for product ".net Framework" and version "2.0"
sp1
Affected
in Microsoft
Search vendor "Microsoft"
Windows Server 2008
Search vendor "Microsoft" for product "Windows Server 2008"
*itanium
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
2.0
Search vendor "Microsoft" for product ".net Framework" and version "2.0"
sp1
Affected
in Microsoft
Search vendor "Microsoft"
Windows Server 2008
Search vendor "Microsoft" for product "Windows Server 2008"
*x32
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
2.0
Search vendor "Microsoft" for product ".net Framework" and version "2.0"
sp1
Affected
in Microsoft
Search vendor "Microsoft"
Windows Server 2008
Search vendor "Microsoft" for product "Windows Server 2008"
*x64
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
2.0
Search vendor "Microsoft" for product ".net Framework" and version "2.0"
sp1
Affected
in Microsoft
Search vendor "Microsoft"
Windows Vista
Search vendor "Microsoft" for product "Windows Vista"
*sp1
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
3.5
Search vendor "Microsoft" for product ".net Framework" and version "3.5"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows 2003 Server
Search vendor "Microsoft" for product "Windows 2003 Server"
*sp2
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
3.5
Search vendor "Microsoft" for product ".net Framework" and version "3.5"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows Server 2003
Search vendor "Microsoft" for product "Windows Server 2003"
*sp2
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
3.5
Search vendor "Microsoft" for product ".net Framework" and version "3.5"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows Server 2008
Search vendor "Microsoft" for product "Windows Server 2008"
*itanium
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
3.5
Search vendor "Microsoft" for product ".net Framework" and version "3.5"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows Server 2008
Search vendor "Microsoft" for product "Windows Server 2008"
*x32
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
3.5
Search vendor "Microsoft" for product ".net Framework" and version "3.5"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows Server 2008
Search vendor "Microsoft" for product "Windows Server 2008"
*x64
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
3.5
Search vendor "Microsoft" for product ".net Framework" and version "3.5"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows Vista
Search vendor "Microsoft" for product "Windows Vista"
*sp1
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
3.5
Search vendor "Microsoft" for product ".net Framework" and version "3.5"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows Vista
Search vendor "Microsoft" for product "Windows Vista"
*sp2
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
3.5
Search vendor "Microsoft" for product ".net Framework" and version "3.5"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows Xp
Search vendor "Microsoft" for product "Windows Xp"
*sp3
Safe
Microsoft
Search vendor "Microsoft"
.net Framework
Search vendor "Microsoft" for product ".net Framework"
3.5
Search vendor "Microsoft" for product ".net Framework" and version "3.5"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows Xp
Search vendor "Microsoft" for product "Windows Xp"
-sp2, x64
Safe