Rule Definition
This weakness is especially dangerous when the hash is used in security algorithms that require the one-way property to hold. For example, if an authentication system takes an incoming password and generates a hash, then compares the hash to another hash that it has stored in its authentication database, then the ability to create a collision could allow an attacker to provide an alternate password that produces the same target hash, bypassing authentication.

Remediation
Use a recommended hash method. Example: SHA-2.

Violation Code Sample

Sample 1: 
---------
String plainText = new String(plainTextIn);
MessageDigest encer = MessageDigest.getInstance("SHA");
encer.update(plainTextIn);
byte[] digest = password.digest();

//Login if hash matches stored hash 
if (equal(digest,secret_password())) {
login_user();
}

Sample 2:
--------
String plainText = new String(plainTextIn);
MessageDigest encer = MessageDigest.getInstance("MD5");
encer.update(plainTextIn);
byte[] digest = password.digest();

//Login if hash matches stored hash 
if (equal(digest,secret_password())) {
login_user();
}

Fixed Code Sample

Sample 1: 
---------
String plainText = new String(plainTextIn);
MessageDigest encer = MessageDigest.getInstance("SHA-256");
encer.update(plainTextIn);
byte[] digest = password.digest();

//Login if hash matches stored hash 
if (equal(digest,secret_password())) {
login_user();
}

Sample 2:
--------
String plainText = new String(plainTextIn);
MessageDigest encer = MessageDigest.getInstance("SHA-512");
encer.update(plainTextIn);
byte[] digest = password.digest();

//Login if hash matches stored hash 
if (equal(digest,secret_password())) {
login_user();
}

CWE-328 http://cwe.mitre.org/data/definitions/328.html