CVE-2001-1125: Critical severity Symantec LiveUpdate vulnerability
Published Oct 5, 2001
·Updated
Symantec LiveUpdate before 1.6 does not use cryptography to ensure the integrity of download files, which allows remote attackers to execute arbitrary code via DNS spoofing of the update.symantec.com site.
Affected Software
3 affected components
Symantec LiveUpdate<1.6
Symantec LiveUpdate=1.4
Symantec LiveUpdate=1.5
Remediation
Patch Available
Patch Available
Event History
Oct 5, 2001
CVE Published
via NVD·04:00 AM
Mar 15, 2002
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2001-1125?
CVE-2001-1125 is considered a high severity vulnerability due to the potential for remote code execution.
2
How do I fix CVE-2001-1125?
To fix CVE-2001-1125, upgrade to Symantec LiveUpdate version 1.6 or later which includes cryptographic protections.
3
What kind of attack does CVE-2001-1125 allow?
CVE-2001-1125 allows attackers to execute arbitrary code through DNS spoofing.
4
Which versions of Symantec LiveUpdate are affected by CVE-2001-1125?
CVE-2001-1125 affects Symantec LiveUpdate versions 1.4 and 1.5.
5
Is CVE-2001-1125 still a threat today?
CVE-2001-1125 is less of a threat today if users have updated to the latest versions, but outdated software can still be vulnerable.