CVE-2001-1125

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2001-10-05 · updated 2026-06-16
Weakness: CWE-494

Description

Symantec LiveUpdate before 1.6 does not use cryptography to ensure the integrity of download files, which allows remote attackers to execute arbitrary code via DNS spoofing of the update.symantec.com site.

Affected products

Symantec Liveupdate: before 1.6 — fixed in 1.6

How to fix

Upgrade to a fixed version: Symantec Liveupdate 1.6. Check the vendor advisory for mitigations.

References

http://www.sarc.com/avcenter/security/Content/2001.10.05.html
http://www.securityfocus.com/archive/1/218717
http://www.securityfocus.com/bid/3403
https://exchange.xforce.ibmcloud.com/vulnerabilities/7235
http://www.sarc.com/avcenter/security/Content/2001.10.05.html
http://www.securityfocus.com/archive/1/218717
http://www.securityfocus.com/bid/3403
https://exchange.xforce.ibmcloud.com/vulnerabilities/7235

Get alerted when CVE-2001-1125 or the next vulnerability affects your stack