Description
The MD5 Message-Digest Algorithm is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by attacks on the use of MD5 in the signature algorithm of an X.509 certificate.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://www.securityfocus.com/bid/33065 ↗
- https://rhn.redhat.com/errata/RHSA-2010-0837.html ↗
- http://www.phreedom.org/research/rogue-ca/ ↗
- http://www.kb.cert.org/vuls/id/836068 ↗
- http://securityreason.com/securityalert/4866 ↗
- http://blog.mozilla.com/security/2008/12/30/md5-weaknesses-could-lead-to-certificate-forgery/ ↗
- http://www.cisco.com/en/US/products/products_security_response09186a0080a5d24a.html ↗
- http://www.win.tue.nl/hashclash/SoftIntCodeSign/ ↗
- http://secunia.com/advisories/33826 ↗
- http://secunia.com/advisories/34281 ↗
- http://www.microsoft.com/technet/security/advisory/961509.mspx ↗
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03814en_us ↗
- http://blogs.technet.com/swi/archive/2008/12/30/information-regarding-md5-collisions-problem.aspx ↗
- http://www.doxpara.com/research/md5/md5_someday.pdf ↗
- https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02 ↗
- https://rhn.redhat.com/errata/RHSA-2010-0838.html ↗
- https://blogs.verisign.com/ssl-blog/2008/12/on_md5_vulnerabilities_and_mit.php ↗
- http://www.ubuntu.com/usn/usn-740-1 ↗
- http://securitytracker.com/id?1024697 ↗
- https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00096.html ↗
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05336888 ↗
- http://www.securityfocus.com/archive/1/499685/100/0/threaded ↗
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289935 ↗
- http://secunia.com/advisories/42181 ↗
- http://www.win.tue.nl/hashclash/rogue-ca/ ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=648886 ↗