PT-2009-1143 · Rsa Security · Md5

Tomas Hoger · Publicado 2009-01-05 · Atualizado 2026-05-28 · CVE-2004-2761

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MD5 (affected versions not specified)

Description The MD5 Message-Digest Algorithm lacks collision resistance, making it easier for attackers to conduct spoofing attacks. This issue has been demonstrated through attacks on the use of MD5 in the signature algorithm of an X.509 certificate.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of a Broken Cryptographic Algorithm

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-310

CWE-327

CWE-347

CWE-328

Identificadores relacionados

CVE-2004-2761

GHSA-M5M3-46GJ-WCH8

RHSA-2010:0837

RHSA-2010:0838

Produtos afetados

Md5

Referências · 39

• 🔥 https://exploit-db.com/exploits/24807 · Exploit
• https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8 · Nota
• https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaa · Nota
• https://github.com/sylabs/sif/releases/tag/v2.8.1 · Nota
• https://github.com/sylabs/sif · Nota
• http://microsoft.com/technet/security/advisory/961509.mspx · Aviso do Fabricante
• http://blog.mozilla.com/security/2008/12/30/md5-weaknesses-could-lead-to-certificate-forgery · Nota
• https://rhn.redhat.com/errata/RHSA-2010-0837.html · Aviso do Fabricante
• http://phreedom.org/research/rogue-ca · Nota
• http://cisco.com/en/US/products/products_security_response09186a0080a5d24a.html · Aviso do Fabricante
• https://t.me/cveNotify/165088 · Publicação no Telegram
• http://win.tue.nl/hashclash/rogue-ca · Nota
• http://securityfocus.com/archive/1/499685/100/0/threaded · Nota
• http://doxpara.com/research/md5/md5_someday.pdf · Nota
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289935 · Nota