Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 521
Alerts This Week
Warning Icon 1 521

Charles Schwab Cross-Site Scripting Advisory: Account Risk Report

Calendar Dec 07, 2000 • User Avatar Anthony Pell
1 - 2 min read
General Esm H446
Topics%20covered

Topics Covered

security advisory cross-site scripting web application data leak account security
Charles Schwab & Co.'s Web site is vulnerable to a well-known attack that could allow a hacker to gain access to sensitive account information, the financial services company acknowledged Wednesday. Reported by San Francisco-based programmer Jeff Baker on the Bugtraq security . . . Charles Schwab & Co.'s Web site is vulnerable to a well-known attack that could allow a hacker to gain access to sensitive account information, the financial services company acknowledged Wednesday. Reported by San Francisco-based programmer Jeff Baker on the Bugtraq security mailing list on Wednesday, the vulnerability involves "cross-site scripting." The vulnerability, which uses popular Web programming languages such as JavaScript to hijack a customer's Web browser, is similar to one acknowledged by E*Trade Group Inc. (Nasdaq: EGRP) in September.

By exploiting the vulnerability, "malicious users can fool other users' Web clients...which allows them to do things such as stealing that client/server's cookies," Elias Levy, Bugtraq's moderator and the chief technology officer of SecurityFocus.com, wrote in an advisory. Calling the vulnerability a "common flaw," Levy blamed the problem in part on "the lack of good practices by programmers of Web-based applications."

The link for this article located at ZDNet is no longer available.