SARA Password Disclosure
Summary
SARA password disclosure via flawed HTML clients or environmental problems
Impact
Unauthorized users may execute commands through SARA
Background
By default, SARA runs as a custom HTML (hypertext markup language)
server, executing requests from a user-provided HTML browser, or client
program. Examples of common HTML clients are Netscape, NCSA
Mosaic and Lynx.
An HTML client request is nothing but a network message, and network
messages may be sent by any user on the network. To defend itself
against requests from unauthorized users, SARA takes the
following precautions:
- SARA generates a session key, to be used as a secret
password, each time it starts up an HTML client. The session key is in
the form of a 32-byte quasi-random number. The number is called
quasi-random because it is impossible to generate real random
numbers using only software.
- SARA creates HTML files with the secret password embedded in
URL (uniform resource locator) links. The HTML file access permissions
are restricted to the owner of the SARA process (and the superuser).
- SARA rejects HTML requests whose URL does not contain the current
SARA password. This requirement prevents access by unauthorized
clients, provided that the current SARA password is kept secret.
The protection scheme used by SARA is in essence the same as the
scheme used by many implementations of the X Window system: MIT magic
cookies. These secrets are normally kept in the user's home directory,
in a file called .Xauthority. Before it is granted access to the
screen, keyboard and mouse, an X client program needs to prove that it
is authorized, by handing over the correct magic cookie. This
requirement prevents unauthorized access, provided that the magic
cookie information is kept secret.
The problem
It is important that the current SARA password is kept secret. When
the password leaks out, unauthorized users can send commands to the
SARA HTML server where the commands will be executed with the
privileges of the SARA process.
Note that SARA generates a new password everytime you start it
up under an HTML client, so if you are suspicious, simply restart
the program.
SARA never sends its current password over the network. However, the
password, or parts of it, may be disclosed due to flaws in HTML clients
or due to weak protection of the environment that SARA is running in.
One possible scenario for disclosure is:
- When the user selects other HTML servers from within a SARA
session, some HTML client programs (Netscape and Lynx)
disclose the current SARA URL, including SARA password information.
The intention of this feature is to help service providers find out the
structure of the world-wide web. However, the feature can also reveal
confidential information. With version 1.1 and later, SARA displays a
warning when the HTML client program exhibits this questionable (i.e.
stupid) feature.
Other scenarios for SARA password disclosure are discussed in the
next section, as part of a list of counter measures.
Preventing SARA password disclosure
The security of SARA is highly dependent on the security of environment
that it runs in. In the case of an X Window environment:
- Avoid using the xhost mechanism, but use xauth and
MIT magic cookies or better. Otherwise, unauthorized users can see and
manipulate everything that happens with the screen, keyboard and
mouse. Of course, this can also be a problem when you are not
running the SARA program at all.
Steps that can help to keep the X magic cookie information secret:
- Avoid sharing your home directory, including .Xauthority
file, with other hosts. Otherwise, X magic cookie information may be
captured from the network while the X software accesses that file, so
that unauthorized users can take over the screen, keyboard and mouse.
- Avoid running X applications with output to a remote display.
Otherwise, X magic cookie information can be captured from the network
while X clients connect to the remote display, so that unauthorized
users can take over the screen, keyboard and mouse.
Finally, steps that can help to keep the current SARA password
secret:
- Avoid sharing the SARA directories with other hosts. Otherwise,
SARA password information may be captured from the network while the
HTML software accesses passworded files, so that unauthorized users can
take over the SARA HTML server.
- Avoid running SARA with output to a remote display. Otherwise,
SARA password information can be captured from the network while URL
information is shown on the remote display, so that unauthorized users can
take over the SARA HTML server.
Additional SARA defenses
The SARA software spends a lot of effort to protect your computer and
data against password disclosure. With version 1.1 and later, SARA
even attempts to protect you after the password has fallen into
the hands of unauthorized users:
- SARA displays a warning and advises the user to not contact other
HTML servers from within a SARA session, when it finds that the HTML
client program reveals SARA password information as part of parent URL
information.
- SARA rejects requests that appear to come from hosts other than
the one it is running on, that refer to resources outside its own HTML
tree, or that contain unexpected data.
- SARA terminates with a warning when it finds a valid SARA
password in an illegal request: SARA assumes the password has fallen
into the hands of unauthorized users and assumes the worst.