Gisle Aas Digest-MD5 UTF-8 Incorrect Digest Calculation Threat

Bugtraq ID:	4716
Class:	Environment Error
CVE:
Remote:	Unknown
Local:	Unknown
Published:	May 10 2002 12:00AM
Updated:	May 10 2002 12:00AM
Credit:	Published in Red Hat Security Advisory RHSA-2002:081-06.
Vulnerable:	Gisle Aas Digest::MD5 2.19 Gisle Aas Digest::MD5 2.18 Gisle Aas Digest::MD5 2.17 Gisle Aas Digest::MD5 2.16 + Redhat Linux 7.3 i386 + Redhat Linux 7.3
Not Vulnerable:	Gisle Aas Digest::MD5 2.20

Gisle Aas Digest-MD5 UTF-8 Incorrect Digest Calculation Threat

Reportedly, Digest-MD5 may operate incorrectly on some UTF-8 encoded strings. As a result, it is possible that incorrect MD5 digests will be calculated on some input strings. Exploitation of this issue is likely to be highly dependent on additional programs making use of this module.

This vulnerability may result in weakness or failure of systems using Digest-MD5 to verify the integrity of data.

Gisle Aas Digest-MD5 UTF-8 Incorrect Digest Calculation Threat

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Gisle Aas Digest-MD5 UTF-8 Incorrect Digest Calculation Threat

Solution:
Updates are avaiable:


Gisle Aas Digest::MD5 2.16

• Gisle Aas Digest-MD5-2.20.tar.gz
  http://www.cpan.org/authors/id/GAAS/Digest-MD5-2.20.tar.gz


• Red Hat perl-Digest-MD5-2.20-1.i386.rpm
  ftp://updates.redhat.com/7.3/en/os/i386/perl-Digest-MD5-2.20-1.i386.rp m

Gisle Aas Digest::MD5 2.17

• Gisle Aas Digest-MD5-2.20.tar.gz
  http://www.cpan.org/authors/id/GAAS/Digest-MD5-2.20.tar.gz

Gisle Aas Digest::MD5 2.18

• Gisle Aas Digest-MD5-2.20.tar.gz
  http://www.cpan.org/authors/id/GAAS/Digest-MD5-2.20.tar.gz

Gisle Aas Digest::MD5 2.19

• Gisle Aas Digest-MD5-2.20.tar.gz
  http://www.cpan.org/authors/id/GAAS/Digest-MD5-2.20.tar.gz

Gisle Aas Digest-MD5 UTF-8 Incorrect Digest Calculation Threat

References:

• Digest-MD5 (CPAN)