MD5 - Message Digest Algorithm Hash Collision

CVE编号

CVE-2004-2761

利用情况

暂无

补丁情况

N/A

披露时间

2009-01-06

漏洞描述

The MD5 Message-Digest Algorithm is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by attacks on the use of MD5 in the signature algorithm of an X.509 certificate.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
http://blog.mozilla.com/security/2008/12/30/md5-weaknesses-could-lead-to-cert...
http://blogs.technet.com/swi/archive/2008/12/30/information-regarding-md5-col...
http://secunia.com/advisories/33826
http://secunia.com/advisories/34281
http://secunia.com/advisories/42181
http://securityreason.com/securityalert/4866
http://securitytracker.com/id?1024697
http://www.cisco.com/en/US/products/products_security_response09186a0080a5d24a.html
http://www.doxpara.com/research/md5/md5_someday.pdf
http://www.kb.cert.org/vuls/id/836068
http://www.microsoft.com/technet/security/advisory/961509.mspx
http://www.phreedom.org/research/rogue-ca/
http://www.securityfocus.com/archive/1/499685/100/0/threaded
http://www.securityfocus.com/bid/33065
http://www.ubuntu.com/usn/usn-740-1
http://www.win.tue.nl/hashclash/rogue-ca/
http://www.win.tue.nl/hashclash/SoftIntCodeSign/
https://blogs.verisign.com/ssl-blog/2008/12/on_md5_vulnerabilities_and_mit.php
https://bugzilla.redhat.com/show_bug.cgi?id=648886
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_n...
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_n...
https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02
https://rhn.redhat.com/errata/RHSA-2010-0837.html
https://rhn.redhat.com/errata/RHSA-2010-0838.html
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-...
https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00096.html

受影响软件情况

#	类型	厂商	产品	版本	影响面
1
	运行在以下环境
	应用	ietf	md5	-	-
	运行在以下环境
	应用	ietf	x.509_certificate	-	-

CVSS3评分 5.0

• 攻击路径 网络
• 攻击复杂度 低
• 权限要求 无
• 影响范围 N/A
• 用户交互 无
• 可用性 无
• 保密性 无
• 完整性 部分地

AV:N/AC:L/Au:N/C:N/I:P/A:N CWE-ID 漏洞类型