CVE-2011-1271 Information

Description

The JIT compiler in Microsoft .NET Framework 3.5 Gold and SP1 3.5.1 and 4.0 when IsJITOptimizerDisabled is false does not properly handle expressions related to null strings which allows context-dependent attackers to bypass intended access restrictions and consequently execute arbitrary code in opportunistic circumstances by leveraging a crafted application as demonstrated by (1) a crafted XAML browser application (aka XBAP) (2) a crafted ASP.NET application or (3) a crafted .NET Framework application aka .NET Framework JIT Optimization Vulnerability.\

Reference

http://stackoverflow.com/questions/2135509/bug-only-occurring-when-compile-optimization-enabled/ https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-044 https://oval.cisecurity.org/repository/search/definition/oval3Aorg.mitre.oval3Adef3A12686