Vulnerabilities > CVE-2004-2761 - Cryptographic Issues vulnerability in Ietf MD5
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
The MD5 Message-Digest Algorithm is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by attacks on the use of MD5 in the signature algorithm of an X.509 certificate.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 2 |
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Signature Spoofing by Key Recreation An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
Exploit-Db
| description | MD5 Message Digest Algorithm Hash Collision Weakness. CVE-2004-2761. Dos exploits for multiple platform |
| id | EDB-ID:24807 |
| last seen | 2016-02-03 |
| modified | 2004-12-07 |
| published | 2004-12-07 |
| reporter | Dan Kaminsky |
| source | https://www.exploit-db.com/download/24807/ |
| title | MD5 Message Digest Algorithm Hash Collision Weakness |
Nessus
NASL family Fedora Local Security Checks NASL id FEDORA_2009-1276.NASL description This updates adds protection against rogue CA that was generated as a proof-of- concept of the MD5 collision attacks against X509 signatures: http://www.win.tue.nl/hashclash/rogue-ca/ , related to CVE-2004-2761. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 35595 published 2009-02-05 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/35595 title Fedora 9 : nss-3.12.2.0-2.fc9 (2009-1276) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Fedora Security Advisory 2009-1276. # include("compat.inc"); if (description) { script_id(35595); script_version ("1.17"); script_cvs_date("Date: 2019/08/02 13:32:29"); script_cve_id("CVE-2004-2761"); script_bugtraq_id(33065); script_xref(name:"FEDORA", value:"2009-1276"); script_name(english:"Fedora 9 : nss-3.12.2.0-2.fc9 (2009-1276)"); script_summary(english:"Checks rpm output for the updated package."); script_set_attribute( attribute:"synopsis", value:"The remote Fedora host is missing a security update." ); script_set_attribute( attribute:"description", value: "This updates adds protection against rogue CA that was generated as a proof-of- concept of the MD5 collision attacks against X509 signatures: http://www.win.tue.nl/hashclash/rogue-ca/ , related to CVE-2004-2761. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); # http://www.win.tue.nl/hashclash/rogue-ca/ script_set_attribute( attribute:"see_also", value:"https://www.win.tue.nl/hashclash/rogue-ca/" ); # https://lists.fedoraproject.org/pipermail/package-announce/2009-February/019736.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?8ba588ba" ); script_set_attribute(attribute:"solution", value:"Update the affected nss package."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_cwe_id(310); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:nss"); script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:9"); script_set_attribute(attribute:"patch_publication_date", value:"2009/02/05"); script_set_attribute(attribute:"plugin_publication_date", value:"2009/02/05"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Fedora Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora"); os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora"); os_ver = os_ver[1]; if (! ereg(pattern:"^9([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 9.x", "Fedora " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu); flag = 0; if (rpm_check(release:"FC9", reference:"nss-3.12.2.0-2.fc9")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "nss"); }NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-740-1.NASL description The MD5 algorithm is known not to be collision resistant. This update blacklists the proof of concept rogue certificate authority as discussed in http://www.win.tue.nl/hashclash/rogue-ca/. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 37463 published 2009-04-23 reporter Ubuntu Security Notice (C) 2009-2019 Canonical, Inc. / NASL script (C) 2009-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/37463 title Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : nss, firefox vulnerability (USN-740-1) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Ubuntu Security Notice USN-740-1. The text # itself is copyright (C) Canonical, Inc. See # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered # trademark of Canonical, Inc. # include("compat.inc"); if (description) { script_id(37463); script_version("1.14"); script_cvs_date("Date: 2019/08/02 13:33:02"); script_cve_id("CVE-2004-2761"); script_bugtraq_id(33065); script_xref(name:"USN", value:"740-1"); script_name(english:"Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : nss, firefox vulnerability (USN-740-1)"); script_summary(english:"Checks dpkg output for updated packages."); script_set_attribute( attribute:"synopsis", value: "The remote Ubuntu host is missing one or more security-related patches." ); script_set_attribute( attribute:"description", value: "The MD5 algorithm is known not to be collision resistant. This update blacklists the proof of concept rogue certificate authority as discussed in http://www.win.tue.nl/hashclash/rogue-ca/. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://usn.ubuntu.com/740-1/" ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_cwe_id(310); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:firefox"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:firefox-dbg"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:firefox-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:firefox-dom-inspector"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:firefox-gnome-support"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libnspr-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libnspr4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libnss-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libnss3"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libnss3-0d"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libnss3-0d-dbg"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libnss3-1d"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libnss3-1d-dbg"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libnss3-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libnss3-tools"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:mozilla-firefox"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:mozilla-firefox-dev"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:6.06:-:lts"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:7.10"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:8.04:-:lts"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:8.10"); script_set_attribute(attribute:"patch_publication_date", value:"2009/03/17"); script_set_attribute(attribute:"plugin_publication_date", value:"2009/04/23"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"Ubuntu Security Notice (C) 2009-2019 Canonical, Inc. / NASL script (C) 2009-2018 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Ubuntu Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l"); exit(0); } include("audit.inc"); include("ubuntu.inc"); include("misc_func.inc"); if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/Ubuntu/release"); if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu"); release = chomp(release); if (! ereg(pattern:"^(6\.06|7\.10|8\.04|8\.10)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 6.06 / 7.10 / 8.04 / 8.10", "Ubuntu " + release); if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu); flag = 0; if (ubuntu_check(osver:"6.06", pkgname:"firefox", pkgver:"1.5.dfsg+1.5.0.15~prepatch080614k-0ubuntu2")) flag++; if (ubuntu_check(osver:"6.06", pkgname:"firefox-dbg", pkgver:"1.5.dfsg+1.5.0.15~prepatch080614k-0ubuntu2")) flag++; if (ubuntu_check(osver:"6.06", pkgname:"firefox-dev", pkgver:"1.5.dfsg+1.5.0.15~prepatch080614k-0ubuntu2")) flag++; if (ubuntu_check(osver:"6.06", pkgname:"firefox-dom-inspector", pkgver:"1.5.dfsg+1.5.0.15~prepatch080614k-0ubuntu2")) flag++; if (ubuntu_check(osver:"6.06", pkgname:"firefox-gnome-support", pkgver:"1.5.dfsg+1.5.0.15~prepatch080614k-0ubuntu2")) flag++; if (ubuntu_check(osver:"6.06", pkgname:"libnspr-dev", pkgver:"1.firefox1.5.dfsg+1.5.0.15~prepatch080614k-0ubuntu2")) flag++; if (ubuntu_check(osver:"6.06", pkgname:"libnspr4", pkgver:"1.firefox1.5.dfsg+1.5.0.15~prepatch080614k-0ubuntu2")) flag++; if (ubuntu_check(osver:"6.06", pkgname:"libnss-dev", pkgver:"1.firefox1.5.dfsg+1.5.0.15~prepatch080614k-0ubuntu2")) flag++; if (ubuntu_check(osver:"6.06", pkgname:"libnss3", pkgver:"1.5.dfsg+1.5.0.15~prepatch080614k-0ubuntu2")) flag++; if (ubuntu_check(osver:"6.06", pkgname:"mozilla-firefox", pkgver:"1.5.dfsg+1.5.0.15~prepatch080614k-0ubuntu2")) flag++; if (ubuntu_check(osver:"6.06", pkgname:"mozilla-firefox-dev", pkgver:"1.5.dfsg+1.5.0.15~prepatch080614k-0ubuntu2")) flag++; if (ubuntu_check(osver:"7.10", pkgname:"libnss3-0d", pkgver:"3.11.5-3ubuntu0.7.10.2")) flag++; if (ubuntu_check(osver:"7.10", pkgname:"libnss3-0d-dbg", pkgver:"3.11.5-3ubuntu0.7.10.2")) flag++; if (ubuntu_check(osver:"7.10", pkgname:"libnss3-dev", pkgver:"3.11.5-3ubuntu0.7.10.2")) flag++; if (ubuntu_check(osver:"7.10", pkgname:"libnss3-tools", pkgver:"3.11.5-3ubuntu0.7.10.2")) flag++; if (ubuntu_check(osver:"8.04", pkgname:"libnss3-0d", pkgver:"3.12.0.3-0ubuntu0.8.04.5")) flag++; if (ubuntu_check(osver:"8.04", pkgname:"libnss3-1d", pkgver:"3.12.0.3-0ubuntu0.8.04.5")) flag++; if (ubuntu_check(osver:"8.04", pkgname:"libnss3-1d-dbg", pkgver:"3.12.0.3-0ubuntu0.8.04.5")) flag++; if (ubuntu_check(osver:"8.04", pkgname:"libnss3-dev", pkgver:"3.12.0.3-0ubuntu0.8.04.5")) flag++; if (ubuntu_check(osver:"8.04", pkgname:"libnss3-tools", pkgver:"3.12.0.3-0ubuntu0.8.04.5")) flag++; if (ubuntu_check(osver:"8.10", pkgname:"libnss3-0d", pkgver:"3.12.0.3-0ubuntu5.8.10.1")) flag++; if (ubuntu_check(osver:"8.10", pkgname:"libnss3-1d", pkgver:"3.12.0.3-0ubuntu5.8.10.1")) flag++; if (ubuntu_check(osver:"8.10", pkgname:"libnss3-1d-dbg", pkgver:"3.12.0.3-0ubuntu5.8.10.1")) flag++; if (ubuntu_check(osver:"8.10", pkgname:"libnss3-dev", pkgver:"3.12.0.3-0ubuntu5.8.10.1")) flag++; if (ubuntu_check(osver:"8.10", pkgname:"libnss3-tools", pkgver:"3.12.0.3-0ubuntu5.8.10.1")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : ubuntu_report_get() ); exit(0); } else { tested = ubuntu_pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "firefox / firefox-dbg / firefox-dev / firefox-dom-inspector / etc"); }NASL family Fedora Local Security Checks NASL id FEDORA_2009-1291.NASL description This updates adds protection against rogue CA that was generated as a proof-of- concept of the MD5 collision attacks against X509 signatures: http://www.win.tue.nl/hashclash/rogue-ca/ , related to CVE-2004-2761. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 37960 published 2009-04-23 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/37960 title Fedora 10 : nss-3.12.2.0-4.fc10 (2009-1291) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Fedora Security Advisory 2009-1291. # include("compat.inc"); if (description) { script_id(37960); script_version ("1.13"); script_cvs_date("Date: 2019/08/02 13:32:29"); script_xref(name:"FEDORA", value:"2009-1291"); script_name(english:"Fedora 10 : nss-3.12.2.0-4.fc10 (2009-1291)"); script_summary(english:"Checks rpm output for the updated package."); script_set_attribute( attribute:"synopsis", value:"The remote Fedora host is missing a security update." ); script_set_attribute( attribute:"description", value: "This updates adds protection against rogue CA that was generated as a proof-of- concept of the MD5 collision attacks against X509 signatures: http://www.win.tue.nl/hashclash/rogue-ca/ , related to CVE-2004-2761. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); # http://www.win.tue.nl/hashclash/rogue-ca/ script_set_attribute( attribute:"see_also", value:"https://www.win.tue.nl/hashclash/rogue-ca/" ); # https://lists.fedoraproject.org/pipermail/package-announce/2009-February/019754.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?256a8dfc" ); script_set_attribute(attribute:"solution", value:"Update the affected nss package."); script_set_attribute(attribute:"risk_factor", value:"High"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:nss"); script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:10"); script_set_attribute(attribute:"patch_publication_date", value:"2009/02/05"); script_set_attribute(attribute:"plugin_publication_date", value:"2009/04/23"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Fedora Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora"); os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora"); os_ver = os_ver[1]; if (! ereg(pattern:"^10([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 10.x", "Fedora " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu); flag = 0; if (rpm_check(release:"FC10", reference:"nss-3.12.2.0-4.fc10")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "nss"); }NASL family General NASL id SSL_WEAK_HASH.NASL description The remote service uses an SSL certificate chain that has been signed using a cryptographically weak hashing algorithm (e.g. MD2, MD4, MD5, or SHA1). These signature algorithms are known to be vulnerable to collision attacks. An attacker can exploit this to generate another certificate with the same digital signature, allowing an attacker to masquerade as the affected service. Note that this plugin reports all SSL certificate chains signed with SHA-1 that expire after January 1, 2017 as vulnerable. This is in accordance with Google last seen 2020-04-30 modified 2009-01-05 plugin id 35291 published 2009-01-05 reporter This script is Copyright (C) 2009-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/35291 title SSL Certificate Signed Using Weak Hashing Algorithm code # # (C) Tenable Network Security, Inc. # if ( NASL_LEVEL < 3208 ) exit(0); include("compat.inc"); if (description) { script_id(35291); script_version("1.31"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/04/27"); script_cve_id("CVE-2004-2761"); script_bugtraq_id(11849, 33065); script_xref(name:"CERT", value:"836068"); script_name(english:"SSL Certificate Signed Using Weak Hashing Algorithm"); script_summary(english:"Checks signature algorithm used to sign SSL certificates in chain."); script_set_attribute(attribute:"synopsis", value: "An SSL certificate in the certificate chain has been signed using a weak hash algorithm."); script_set_attribute(attribute:"description", value: "The remote service uses an SSL certificate chain that has been signed using a cryptographically weak hashing algorithm (e.g. MD2, MD4, MD5, or SHA1). These signature algorithms are known to be vulnerable to collision attacks. An attacker can exploit this to generate another certificate with the same digital signature, allowing an attacker to masquerade as the affected service. Note that this plugin reports all SSL certificate chains signed with SHA-1 that expire after January 1, 2017 as vulnerable. This is in accordance with Google's gradual sunsetting of the SHA-1 cryptographic hash algorithm. Note that certificates in the chain that are contained in the Nessus CA database (known_CA.inc) have been ignored."); script_set_attribute(attribute:"see_also", value:"https://tools.ietf.org/html/rfc3279"); # https://docs.microsoft.com/en-us/security-updates/SecurityAdvisories/2008/961509 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9bb87bf2"); # https://web.archive.org/web/20170429062248/http://www.phreedom.org/research/rogue-ca/ script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e120eea1"); # https://security.googleblog.com/2014/09/gradually-sunsetting-sha-1.html script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5d894816"); # https://shattered.io script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?51db68aa"); # https://www.schneier.com/blog/archives/2005/02/cryptanalysis_o.html script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9dc7bfba"); script_set_attribute(attribute:"solution", value: "Contact the Certificate Authority to have the SSL certificate reissued."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"); script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2004-2761"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_cwe_id(310); script_set_attribute(attribute:"vuln_publication_date", value:"2004/08/18"); script_set_attribute(attribute:"plugin_publication_date", value:"2009/01/05"); script_set_attribute(attribute:"plugin_type", value:"remote"); script_set_attribute(attribute:"cpe", value:"cpe:/a:ietf:md5"); script_set_attribute(attribute:"cpe", value:"cpe:/a:ietf:x.509_certificate"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"General"); script_copyright(english:"This script is Copyright (C) 2009-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("ssl_certificate_chain.nasl"); script_require_keys("SSL/Chain/WeakHash"); exit(0); } include("global_settings.inc"); include("misc_func.inc"); include("ssl_funcs.inc"); # Get the port that has a weak hash algorithm from the KB. key = "SSL/Chain/WeakHash"; port = get_kb_item_or_exit(key); key += "/" + port; # If the user doesn't want the details, let's stop right here. if (report_verbosity == 0) { security_warning(port); exit(0); } # Get the list of certificates with weak hash algorithms. certs = get_kb_list_or_exit(key); # Add the certificates to the report. attrs = make_list(); foreach attr (certs) { attrs = make_list(attrs, attr); } # Report our findings. report = '\nThe following certificates were part of the certificate chain sent by' + '\nthe remote host, but contain hashes that are considered to be weak.' + '\n' + '\n' + cert_report(attrs, chain:FALSE); security_warning(port:port, extra:report);NASL family General NASL id SSL_WEAK_HASH_CA.NASL description The remote service uses a known CA certificate in the SSL certificate chain that has been signed using a cryptographically weak hashing algorithm (e.g., MD2, MD4, MD5, or SHA1). These signature algorithms are known to be vulnerable to collision attacks. An attacker can exploit this to generate another certificate with the same digital signature, allowing the attacker to masquerade as the affected service. Note that this plugin reports all SSL certificate chains signed with SHA-1 that expire after January 1, 2017 as vulnerable. This is in accordance with Google last seen 2020-06-01 modified 2020-06-02 plugin id 95631 published 2016-12-08 reporter This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/95631 title SSL Certificate Signed Using Weak Hashing Algorithm (Known CA) code # # (C) Tenable Network Security, Inc. # if ( NASL_LEVEL < 3208 ) exit(0); include("compat.inc"); if (description) { script_id(95631); script_version("1.12"); script_cvs_date("Date: 2019/11/26"); script_cve_id("CVE-2004-2761"); script_bugtraq_id(11849, 33065); script_xref(name:"CERT", value:"836068"); script_name(english:"SSL Certificate Signed Using Weak Hashing Algorithm (Known CA)"); script_summary(english:"Checks signature algorithm used to sign SSL certificates in chain."); script_set_attribute(attribute:"synopsis", value: "A known CA SSL certificate in the certificate chain has been signed using a weak hashing algorithm."); script_set_attribute(attribute:"description", value: "The remote service uses a known CA certificate in the SSL certificate chain that has been signed using a cryptographically weak hashing algorithm (e.g., MD2, MD4, MD5, or SHA1). These signature algorithms are known to be vulnerable to collision attacks. An attacker can exploit this to generate another certificate with the same digital signature, allowing the attacker to masquerade as the affected service. Note that this plugin reports all SSL certificate chains signed with SHA-1 that expire after January 1, 2017 as vulnerable. This is in accordance with Google's gradual sunsetting of the SHA-1 cryptographic hash algorithm."); script_set_attribute(attribute:"see_also", value:"https://tools.ietf.org/html/rfc3279"); script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityAdvisories/2008/961509"); script_set_attribute(attribute:"solution", value: "Contact the Certificate Authority to have the certificate reissued."); script_set_attribute(attribute:"risk_factor", value:"None"); script_set_attribute(attribute:"cvss_score_source", value:"manual"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_cwe_id(310); script_set_attribute(attribute:"vuln_publication_date", value:"2004/08/18"); script_set_attribute(attribute:"plugin_publication_date", value:"2016/12/08"); script_set_attribute(attribute:"plugin_type", value:"remote"); script_set_attribute(attribute:"cpe", value:"cpe:/a:ietf:md5"); script_set_attribute(attribute:"cpe", value:"cpe:/a:ietf:x.509_certificate"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"General"); script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("ssl_certificate_chain.nasl"); script_require_keys("SSL/Chain/KnownCA/WeakHash"); exit(0); } include("global_settings.inc"); include("misc_func.inc"); include("ssl_funcs.inc"); # Get the port that has a weak hash algorithm from the KB. key = "SSL/Chain/KnownCA/WeakHash"; port = get_kb_item_or_exit(key); key += "/" + port; # If the user doesn't want the details, let's stop right here. if (report_verbosity == 0) { security_report_v4(port:port, severity:SECURITY_NOTE); exit(0); } # Get the list of certificates with weak hash algorithms. certs = get_kb_list_or_exit(key); # Add the certificates to the report. attrs = make_list(); foreach attr (certs) { attrs = make_list(attrs, attr); } # Report our findings. report = '\nThe following known CA certificates were part of the certificate' + '\nchain sent by the remote host, but contain hashes that are considered' + '\nto be weak.' + '\n' + '\n' + cert_report(attrs, chain:FALSE); security_report_v4(port:port, extra:report, severity:SECURITY_NOTE);
Redhat
| advisories |
| ||||||||
| rpms |
|
Statements
| contributor | Mark J Cox |
| lastmodified | 2009-01-07 |
| organization | Red Hat |
| statement | Please see http://kbase.redhat.com/faq/docs/DOC-15379 |
References
- http://blog.mozilla.com/security/2008/12/30/md5-weaknesses-could-lead-to-certificate-forgery/
- http://blog.mozilla.com/security/2008/12/30/md5-weaknesses-could-lead-to-certificate-forgery/
- http://blogs.technet.com/swi/archive/2008/12/30/information-regarding-md5-collisions-problem.aspx
- http://blogs.technet.com/swi/archive/2008/12/30/information-regarding-md5-collisions-problem.aspx
- http://secunia.com/advisories/33826
- http://secunia.com/advisories/33826
- http://secunia.com/advisories/34281
- http://secunia.com/advisories/34281
- http://secunia.com/advisories/42181
- http://secunia.com/advisories/42181
- http://securityreason.com/securityalert/4866
- http://securityreason.com/securityalert/4866
- http://securitytracker.com/id?1024697
- http://securitytracker.com/id?1024697
- http://www.cisco.com/en/US/products/products_security_response09186a0080a5d24a.html
- http://www.cisco.com/en/US/products/products_security_response09186a0080a5d24a.html
- http://www.doxpara.com/research/md5/md5_someday.pdf
- http://www.doxpara.com/research/md5/md5_someday.pdf
- http://www.kb.cert.org/vuls/id/836068
- http://www.kb.cert.org/vuls/id/836068
- http://www.microsoft.com/technet/security/advisory/961509.mspx
- http://www.microsoft.com/technet/security/advisory/961509.mspx
- http://www.phreedom.org/research/rogue-ca/
- http://www.phreedom.org/research/rogue-ca/
- http://www.securityfocus.com/archive/1/499685/100/0/threaded
- http://www.securityfocus.com/archive/1/499685/100/0/threaded
- http://www.securityfocus.com/bid/33065
- http://www.securityfocus.com/bid/33065
- http://www.ubuntu.com/usn/usn-740-1
- http://www.ubuntu.com/usn/usn-740-1
- http://www.win.tue.nl/hashclash/rogue-ca/
- http://www.win.tue.nl/hashclash/rogue-ca/
- http://www.win.tue.nl/hashclash/SoftIntCodeSign/
- http://www.win.tue.nl/hashclash/SoftIntCodeSign/
- https://blogs.verisign.com/ssl-blog/2008/12/on_md5_vulnerabilities_and_mit.php
- https://blogs.verisign.com/ssl-blog/2008/12/on_md5_vulnerabilities_and_mit.php
- https://bugzilla.redhat.com/show_bug.cgi?id=648886
- https://bugzilla.redhat.com/show_bug.cgi?id=648886
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289935
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289935
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05336888
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05336888
- https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02
- https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02
- https://rhn.redhat.com/errata/RHSA-2010-0837.html
- https://rhn.redhat.com/errata/RHSA-2010-0837.html
- https://rhn.redhat.com/errata/RHSA-2010-0838.html
- https://rhn.redhat.com/errata/RHSA-2010-0838.html
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03814en_us
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03814en_us
- https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00096.html
- https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00096.html