SARA Password Disclosure


Summary

SARA password disclosure via flawed HTML clients or environmental problems

Impact

Unauthorized users may execute commands through SARA

Background

By default, SARA runs as a custom HTML (hypertext markup language) server, executing requests from a user-provided HTML browser, or client program. Examples of common HTML clients are Netscape, NCSA Mosaic and Lynx.

An HTML client request is nothing but a network message, and network messages may be sent by any user on the network. To defend itself against requests from unauthorized users, SARA takes the following precautions:

The protection scheme used by SARA is in essence the same as the scheme used by many implementations of the X Window system: MIT magic cookies. These secrets are normally kept in the user's home directory, in a file called .Xauthority. Before it is granted access to the screen, keyboard and mouse, an X client program needs to prove that it is authorized, by handing over the correct magic cookie. This requirement prevents unauthorized access, provided that the magic cookie information is kept secret.

The problem

It is important that the current SARA password is kept secret. When the password leaks out, unauthorized users can send commands to the SARA HTML server where the commands will be executed with the privileges of the SARA process.

Note that SARA generates a new password everytime you start it up under an HTML client, so if you are suspicious, simply restart the program.

SARA never sends its current password over the network. However, the password, or parts of it, may be disclosed due to flaws in HTML clients or due to weak protection of the environment that SARA is running in. One possible scenario for disclosure is:

Other scenarios for SARA password disclosure are discussed in the next section, as part of a list of counter measures.

Preventing SARA password disclosure

The security of SARA is highly dependent on the security of environment that it runs in. In the case of an X Window environment: Steps that can help to keep the X magic cookie information secret: Finally, steps that can help to keep the current SARA password secret:

Additional SARA defenses

The SARA software spends a lot of effort to protect your computer and data against password disclosure. With version 1.1 and later, SARA even attempts to protect you after the password has fallen into the hands of unauthorized users: