CVE-2004-2761

Published: Jan 5, 2009Modified: May 28, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The MD5 Message-Digest Algorithm is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by attacks on the use of MD5 in the signature algorithm of an X.509 certificate.

Affected (1)

Products: Ietf: Md5

Ietf

1 product

Md5

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ietf Md5	All versions

Running on/with	Platform Versions
Ietf X.509 Certificate	All versions

Related CWEs

CWE-310

CWE-328

Use of Weak Hash

The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).

References (52)

http://blog.mozilla.com/security/2008/12/30/md5-weaknesses-could-lead-to-certificate-forgery/

Source: cve@mitre.org

http://blogs.technet.com/swi/archive/2008/12/30/information-regarding-md5-collisions-problem.aspx

Source: cve@mitre.org

http://secunia.com/advisories/33826

Source: cve@mitre.org

http://secunia.com/advisories/34281

Source: cve@mitre.org

http://secunia.com/advisories/42181

Source: cve@mitre.org

http://securityreason.com/securityalert/4866

Source: cve@mitre.org

http://securitytracker.com/id?1024697

Source: cve@mitre.org

http://www.cisco.com/en/US/products/products_security_response09186a0080a5d24a.html

Source: cve@mitre.org

http://www.doxpara.com/research/md5/md5_someday.pdf

Source: cve@mitre.org

http://www.kb.cert.org/vuls/id/836068

Source: cve@mitre.org

Third Party AdvisoryUS Government Resource

http://www.microsoft.com/technet/security/advisory/961509.mspx

Source: cve@mitre.org

MitigationPatchVendor Advisory

http://www.phreedom.org/research/rogue-ca/

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/499685/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/33065

Source: cve@mitre.org

http://www.ubuntu.com/usn/usn-740-1

Source: cve@mitre.org

http://www.win.tue.nl/hashclash/SoftIntCodeSign/

Source: cve@mitre.org

http://www.win.tue.nl/hashclash/rogue-ca/

Source: cve@mitre.org

https://blogs.verisign.com/ssl-blog/2008/12/on_md5_vulnerabilities_and_mit.php

Source: cve@mitre.org

https://bugzilla.redhat.com/show_bug.cgi?id=648886

Source: cve@mitre.org

Issue Tracking

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289935

Source: cve@mitre.org

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05336888

Source: cve@mitre.org

https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02

Source: cve@mitre.org

https://rhn.redhat.com/errata/RHSA-2010-0837.html

Source: cve@mitre.org

https://rhn.redhat.com/errata/RHSA-2010-0838.html

Source: cve@mitre.org

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03814en_us

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00096.html

Source: cve@mitre.org

http://blog.mozilla.com/security/2008/12/30/md5-weaknesses-could-lead-to-certificate-forgery/