Secunia

A vulnerability has been reported in sbox, which can be exploited by malicious people to see path information.

The problem is that the error message returned when requesting a non-existant CGI script includes the full path to the user's "cgi-bin" directory. This also reveals the username (name of home directory often equals username).

The issue has been reported to affect version 1.04.

Solution
If this is of great concern, then edit the source code to make sure that error messages don't include path information.

Provided and/or discovered by
EightOne Research Facility

Deep Links
Links available in Customer Area