CVE-2001-1126: Medium severity Symantec LiveUpdate vulnerability
Published Oct 5, 2001
·Updated
Symantec LiveUpdate 1.4 through 1.6, and possibly later versions, allows remote attackers to cause a denial of service (flood) via DNS spoofing of the update.symantec.com site.
Affected Software
3 affected components
Symantec LiveUpdate=1.5
Symantec LiveUpdate=1.6
Symantec LiveUpdate=1.4
Remediation
Patch Available
Event History
Oct 5, 2001
CVE Published
04:00 AM
Mar 15, 2002
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2001-1126?
CVE-2001-1126 is considered a medium severity vulnerability as it allows remote attackers to cause a denial of service.
2
How do I fix CVE-2001-1126?
To fix CVE-2001-1126, upgrade to a version of Symantec LiveUpdate that is not affected, preferably a version later than 1.6.
3
What versions of Symantec LiveUpdate are affected by CVE-2001-1126?
CVE-2001-1126 affects Symantec LiveUpdate versions 1.4, 1.5, and 1.6.
4
What type of attack does CVE-2001-1126 involve?
CVE-2001-1126 involves a denial of service attack caused by DNS spoofing.
5
Is it necessary to take action if I am using an unpatched version of Symantec LiveUpdate?
Yes, it is necessary to upgrade if you are using an unpatched version of Symantec LiveUpdate to protect against the denial of service risk presented by CVE-2001-1126.