CVE-2001-1099: Malicious File Upload
First published: Fri Sep 07 2001(Updated: )
The default configuration of Norton AntiVirus for Microsoft Exchange 2000 2.x allows remote attackers to identify the recipient's INBOX file path by sending an email with an attachment containing malicious content, which includes the path in the rejection notice.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Symantec Norton Antivirus | =2.5 | |
| Microsoft Exchange Server | =2000 | |
| Microsoft Exchange Server | =2000-sp1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2001-1099?
CVE-2001-1099 is considered a moderate security vulnerability due to the potential for remote attackers to discover sensitive file paths.
How do I fix CVE-2001-1099?
To fix CVE-2001-1099, update Norton AntiVirus to a newer version that addresses this vulnerability.
What does CVE-2001-1099 affect?
CVE-2001-1099 specifically affects Norton AntiVirus for Microsoft Exchange 2000 version 2.5.
Can CVE-2001-1099 lead to further attacks?
Yes, if exploited, CVE-2001-1099 could potentially allow further attacks by revealing the victim's INBOX file path.
Is there a workaround for CVE-2001-1099?
A workaround for CVE-2001-1099 may include disabling the automatic processing of attachments in Norton AntiVirus.
- collector/nvd-historical
- agent/references
- agent/softwarecombine
- agent/first-publish-date
- agent/type
- agent/weakness
- agent/severity
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/symantec
- canonical/symantec norton antivirus with backup
- version/symantec norton antivirus with backup/2.5
- vendor/microsoft
- canonical/microsoft exchange server
- version/microsoft exchange server/2000
- version/microsoft exchange server/2000-sp1