http://www.cryptography.com/cnews/hash.html

Note that MD5-HMAC is somewhat unaffected by the vulnerability. Also, the hashing collisions have been discussed elsewhere here.

Your best bet is a newer algorithm such as SHA-256.