CVE-2010-3845
📋 TL;DR
CVE-2010-3845 is a critical information disclosure vulnerability in libapache-authenhook-perl where usernames and passwords are logged in plaintext to Apache vhost error logs. This affects systems using this Perl module for Apache authentication. Attackers with access to error logs can steal credentials and potentially compromise authenticated sessions.
💻 Affected Systems
- libapache-authenhook-perl
📦 What is this software?
Apache Authenhook by Apache Authenhook Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative credentials, leading to complete system compromise, data theft, and lateral movement across the network.
Likely Case
Credential theft allowing unauthorized access to web applications and services protected by the authentication module.
If Mitigated
Limited impact if logs are properly secured with restricted permissions and monitored for unauthorized access.
🎯 Exploit Status
Exploitation does not require special tools; attackers can simply read the error log files to extract credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 2.00-05 or later in Debian-based distributions; check specific vendor updates.
Vendor Advisory: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=599712
Restart Required: Yes
Instructions:
1. Update the package using your distribution's package manager (e.g., 'apt-get update && apt-get upgrade libapache-authenhook-perl'). 2. Restart Apache to apply changes (e.g., 'systemctl restart apache2' or 'service apache2 restart'). 3. Verify the update with 'dpkg -l libapache-authenhook-perl' on Debian/Ubuntu systems.
🔧 Temporary Workarounds
Secure Apache Log Permissions
linuxRestrict read access to Apache error logs to prevent unauthorized credential extraction.
chmod 640 /var/log/apache2/error.log
chown root:adm /var/log/apache2/error.log
Disable libapache-authenhook-perl Module
linuxRemove or disable the module if not required, eliminating the vulnerability.
a2dismod authenhook
systemctl restart apache2
🧯 If You Can't Patch
- Implement strict access controls on Apache log directories to limit read permissions to trusted users only.
- Monitor Apache error logs for unusual access patterns and set up alerts for any credential-like strings appearing in logs.
🔍 How to Verify
Check if Vulnerable:
Check if libapache-authenhook-perl version 2.00-04 is installed: 'dpkg -l libapache-authenhook-perl' on Debian/Ubuntu. Also, inspect Apache error logs for plaintext usernames and passwords.Check Version:
dpkg -l libapache-authenhook-perl | grep ^iiVerify Fix Applied:
Confirm the package is updated to version 2.00-05 or later using 'dpkg -l libapache-authenhook-perl'. Test authentication and check that credentials no longer appear in error logs.📡 Detection & Monitoring
Log Indicators:
- Plaintext usernames and passwords in Apache vhost error logs, especially after authentication attempts.
Network Indicators:
- Unusual access to Apache log files from unauthorized IP addresses or user accounts.
SIEM Query:
source="apache_error_log" AND ("username" OR "password") AND NOT "hashed" AND NOT "encrypted"