CVE-2001-1125

Critical

Published: 05/10/2001(UTC)Translated: 30/05/2026(UTC)NVD NIST

Summary

Symantec LiveUpdate before 1.6 does not use cryptography to ensure the integrity of download files, allowing remote attackers to execute arbitrary code via DNS spoofing of the update.symantec.com site.

Risk Assessment

The lack of proper security measures may lead to remote code execution, posing a serious threat to systems using LiveUpdate.

Recommendation

It is recommended to update Symantec LiveUpdate to version 1.6 or later to ensure adequate protection against such attacks.

Original NVD description (English source)

Symantec LiveUpdate before 1.6 does not use cryptography to ensure the integrity of download files, which allows remote attackers to execute arbitrary code via DNS spoofing of the update.symantec.com site.