Drupal AES Encryption Module Information Disclosure Vulnerability

Bugtraq ID:	46116
Class:	Design Error
CVE:	CVE-2011-0899
Remote:	Yes
Local:	No
Published:	Feb 02 2011 12:00AM
Updated:	Apr 13 2015 09:01PM
Credit:	Shawn Smiley
Vulnerable:	Drupal AES encryption 7.x-1.4
Not Vulnerable:	Drupal AES encryption 7.x-1.5

Drupal AES Encryption Module Information Disclosure Vulnerability

The AES encryption module for Drupal is prone to an information-disclosure vulnerability.

Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks.

AES encryption 7.x-1.4 is vulnerable; other versions may also be affected.

Drupal AES Encryption Module Information Disclosure Vulnerability

Attackers can use a browser to exploit this issue.

Drupal AES Encryption Module Information Disclosure Vulnerability

Solution:
Updates are available; please see the references for more information.


Drupal AES encryption 7.x-1.4

• Drupal aes-7.x-1.5.tar.gz
  http://drupal.org/node/1040728

Drupal AES Encryption Module Information Disclosure Vulnerability

References:

• AES Encryption Homepage (Drupal)
  
• Drupal Homepage (Drupal)
  
• SA-CONTRIB-2011-005 - AES encryption - Information disclosure (Drupal)