The MD5 Message-Digest Algorithm is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by attacks on the use of MD5 in the signature algorithm of an X.509 certificate.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2010:0838 advisory.

    Red Hat Certificate System is an enterprise software system designed to     manage enterprise public key infrastructure (PKI) deployments. Simple     Certificate Enrollment Protocol (SCEP) is a PKI communication protocol     used to automatically enroll certificates for network devices.

    The certificate authority allowed unauthenticated users to request the     one-time PIN in an SCEP request to be decrypted. An attacker able to sniff     an SCEP request from a network device could request the certificate     authority to decrypt the request, allowing them to obtain the one-time     PIN. With this update, the certificate authority only handles decryption     requests from authenticated registration authorities. (CVE-2010-3868)

    The certificate authority allowed the one-time PIN used in SCEP requests     to be re-used. An attacker possessing a valid SCEP enrollment one-time PIN     could use it to generate an unlimited number of certificates.
    (CVE-2010-3869)

    The certificate authority used the MD5 hash algorithm to sign all SCEP     protocol responses. As MD5 is not collision resistant, an attacker could     use this flaw to perform an MD5 chosen-prefix collision attack to generate     attack-chosen output signed using the certificate authority's key.
    (CVE-2004-2761)

    This update also adds the following enhancements:

    * New configuration options for the SCEP server can define the default and     allowed encryption and hash algorithms. These options allow disabling uses     of the weaker algorithms not required by network devices and prevent     possible downgrade attacks. These can be configured by adding the following     options to the certificate authority's CS.cfg configuration file:

       ca.scep.encryptionAlgorithm=DES3        ca.scep.allowedEncryptionAlgorithms=DES3        ca.scep.hashAlgorithm=SHA1        ca.scep.allowedHashAlgorithms=SHA1,SHA256,SHA512

    * With this update, the certificate authority's SCEP server is disabled by     default. The SCEP server can be enabled by adding the 'ca.scep.enable=true'     option to the certificate authority's CS.cfg configuration file.

    * A separate key pair can now be configured for use in SCEP communication.
    Previously, the main certificate authority's key pair was used for SCEP     communication too. A designated SCEP key pair can be referenced by adding     a new option, ca.scep.nickname=[scep certificate nickname], to the     certificate authority's CS.cfg configuration file.

    * The certificate authority now allows the size of nonces used in SCEP     requests to be restricted by adding a new option, ca.scep.nonceSizeLimit=     [number of bytes], to the certificate authority's CS.cfg configuration     file. The limit is set to 16 bytes in the default CS.cfg configuration     file.

    All users of Red Hat Certificate System 8 should upgrade to these updated     packages, which resolve these issues and add these enhancements.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote service uses an SSL certificate that has been signed using a cryptographically weak hashing algorithm - MD5. This algorithm is known to be vulnerable to collision attacks. In theory, a determined attacker may be able to leverage this weakness to generate another certificate with the same digital signature, which could allow them to masquerade as the affected service.

The MD5 algorithm is known not to be collision resistant. This update blacklists the proof of concept rogue certificate authority as discussed in http://www.win.tue.nl/hashclash/rogue-ca/.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This updates adds protection against rogue CA that was generated as a proof-of- concept of the MD5 collision attacks against X509 signatures: http://www.win.tue.nl/hashclash/rogue-ca/ , related to CVE-2004-2761.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote service uses an SSL certificate that has been signed using a cryptographically weak hashing algorithm - MD2.  These algorithms are known to be vulnerable to collision attacks.  In theory, a determined attacker may be able to leverage this weakness to generate another certificate with the same digital signature, which could allow him to masquerade as the affected service.

The remote service uses an SSL certificate that has been signed using a cryptographically weak hashing algorithm - MD4.  These algorithms are known to be vulnerable to collision attacks.  In theory, a determined attacker may be able to leverage this weakness to generate another certificate with the same digital signature, which could allow him to masquerade as the affected service.

The remote service uses an SSL certificate that has been signed using a cryptographically weak hashing algorithm - MD5.  These algorithms are known to be vulnerable to collision attacks.  In theory, a determined attacker may be able to leverage this weakness to generate another certificate with the same digital signature, which could allow him to masquerade as the affected service.

The remote service uses an SSL certificate chain that has been signed using a cryptographically weak hashing algorithm (e.g. MD2, MD4, MD5, or SHA1). These signature algorithms are known to be vulnerable to collision attacks. An attacker can exploit this to generate another certificate with the same digital signature, allowing an attacker to masquerade as the affected service.

Note that this plugin reports all SSL certificate chains signed with SHA-1 that expire after January 1, 2017 as vulnerable. This is in accordance with Google's gradual sunsetting of the SHA-1 cryptographic hash algorithm.

Note that certificates in the chain that are contained in the Nessus CA database (known_CA.inc) have been ignored.

ID	Name	Product	Family	Severity
193666	RHEL 5 : pki (RHSA-2010:0838)	Nessus	Red Hat Local Security Checks	critical
7201	TLS Certificate Signed Using Weak Hashing Algorithm - MD5	Nessus Network Monitor	Generic	medium
37463	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : nss, firefox vulnerability (USN-740-1)	Nessus	Ubuntu Local Security Checks	medium
35595	Fedora 9 : nss-3.12.2.0-2.fc9 (2009-1276)	Nessus	Fedora Local Security Checks	medium
4805	SSL Certificate Signed Using Weak Hashing Algorithm	Nessus Network Monitor	Generic	medium
4804	SSL Certificate Signed Using Weak Hashing Algorithm	Nessus Network Monitor	Generic	medium
4803	SSL Certificate Signed Using Weak Hashing Algorithm	Nessus Network Monitor	Generic	medium
35291	SSL Certificate Signed Using Weak Hashing Algorithm	Nessus	General	high

Detections

Analytics

CVE-2004-2761

critical

Tenable Plugins

critical

medium

medium

medium

medium

medium

medium

high