CVE-2001-1125

critical

Description

Symantec LiveUpdate before 1.6 does not use cryptography to ensure the integrity of download files, which allows remote attackers to execute arbitrary code via DNS spoofing of the update.symantec.com site.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/7235

https://euvd.enisa.europa.eu/vulnerability/EUVD-2001-1106

http://www.securityfocus.com/bid/3403

http://www.securityfocus.com/archive/1/218717

http://www.sarc.com/avcenter/security/Content/2001.10.05.html

Details

Source: Mitre, NVD

Published: 2001-10-05

Updated: 2026-06-16

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.04578

Detections

Analytics