Impact of CVE-2004-2761 (Weak Hashing Algorithm in MD5 certificates) Vulnerability on DLO
Article ID: 100051497
Updated On:
Description
Reference:
More information on this vulnerability can be found at the National Vulnerability Database at the following link;
https://nvd.nist.gov/vuln/detail/CVE-2004-2761
Resolution
Veritas Desktop and Laptop Option (DLO) is not affected by this vulnerability as DLO does not use MD5 certificates. Vulnerabilities shown against DLO will be related to the SQL server version being used and any mitigation would be required there.
The SQL Express installation package does not include any default certificates and the SQL server will generate a self-signed certificate as part of the login process, which could include MD5 certificates, in older SQL versions, although Certificates already issued with MD5 signatures are not at risk. The exploit only affects new certificate acquisitions. In SQL 2016 and newer versions, all algorithms except SHA2_256 & SHA2_512, have been deprecated.
To mitigate this in SQL, if MD5 certificates are being used, acquire a Certificate Authority (CA) certificate and install\import that to the SQL server.
Issue/Introduction
