possible MITM attack against servers that used to support weak DH?
TLSv1.1 doesn't have a different treatment of the key-exchange parameters than TLSv1.2 has. It's just a little less obvious.

Let's dig into TLSv1.1 specification.
On page 44 you'll find that ServerKeyExchange consists of ServerXXXParams params and Signature signed_params. Now on page 44 you'll actually find a definition of Signature. This definition signs sha_hash with or without md5_hash. Now look at the definition of sha_hash and md5_hash. It states that MD5(ClientHello.random + ServerHello.random + ServerParams) is the definition for md5_hash and that SHA(ClientHello.random + ServerHello.random + ServerParams) is the definition of sha_hash.

Now you've found the  random values you're looking for and hence this is the same methodology as in TLSv1.2, but there the signature is directly applied and arbitrary hash-functions can be used.