CVE-2004-2761

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 10.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-01-05 · updated 2026-06-16
Weakness: CWE-310

Description

The MD5 Message-Digest Algorithm is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by attacks on the use of MD5 in the signature algorithm of an X.509 certificate.

Affected products

IETF Md5: all versions

References

http://blog.mozilla.com/security/2008/12/30/md5-weaknesses-could-lead-to-certificate-forgery/
http://blogs.technet.com/swi/archive/2008/12/30/information-regarding-md5-collisions-problem.aspx
http://secunia.com/advisories/33826
http://secunia.com/advisories/34281
http://secunia.com/advisories/42181
http://securityreason.com/securityalert/4866
http://securitytracker.com/id?1024697
http://www.cisco.com/en/US/products/products_security_response09186a0080a5d24a.html
http://www.doxpara.com/research/md5/md5_someday.pdf
http://www.kb.cert.org/vuls/id/836068
http://www.microsoft.com/technet/security/advisory/961509.mspx
http://www.phreedom.org/research/rogue-ca/

Get alerted when CVE-2004-2761 or the next vulnerability affects your stack