CVE:CVE-2003-0994
CNNVD:CNNVD-200402-002
Symantec LiveUpdate是大量symantec应用系统用于自动升级的程序。
Symantec LiveUpdate在建立交互会话时不够安全，本地攻击者可以利用这个漏洞提升权限。
当非特权用户登后，在Windows任务栏中可以会显示"there are Live Updates available，
click here to run LiveUpdate"的小 窗口，如果点击运行在线自动升级，会发现LUALL.exe和LUCOMS~1.exe会以用户SYSTEM上下文运行，点击帮助按钮，会出现"LiveUpdate Help"窗口，点击文件并打开，浏览c:\windows\system32，就可以以SYSTEM权限运行cmd.exe程序。
solution:Upgrade symantec norton_antivirus to a higher version than 2.1,2001,2002,2003,2004,v3.0,and avoid the version 2.1,2001,2002,2003,2004,v3.0; Upgrade symantec norton_internet_security to a higher version than 2001,2002,2003,2004,and avoid the version 2001,2002,2003,2004; Upgrade symantec norton_system_works to a higher version than 2001,2002,2003,2004,and avoid the version 2001,2002,2003,2004; Upgrade symantec windows_liveupdate to a higher version than 1.70.x,1.90.x,and avoid the version 1.70.x,1.90.x