full-disclosure - [FD] OAuth 2.0 and OpenID vulnerable to Covert Redirect

Open Source and information security mailing list archives

Date: Fri, 02 May 2014 12:04:53 -0400
From: Justin Bull <me@...tinbull.ca>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] OAuth 2.0 and OpenID vulnerable to Covert Redirect

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

While we're still recovering (or benefiting, to some) from the sting
of Heartbleed, this makes an appearance:

http://tetraph.com/covert_redirect/oauth2_openid_covert_redirect.html

c|net writeup:
http://www.cnet.com/news/serious-security-flaw-in-oauth-and-openid-discovered/

Happy Friday.

- -- 
Best Regards,
Justin Bull
E09D 38DE 8FB7 5745 2044 A0F4 1A2B DEAA 68FD B34C
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJTY8IfAAoJEESFZfv8+htYfOcP/27D+Sy1kQOF+Id6I/P1F2qA
228myh0yvnvKa+VfHnLtCaoFsxvc9Jp1418P7A/Rly32dCgyVsqEnLBoLSRD2Zgj
mAwNyAfM/9W6M/CC3sZfCsLW/9LlZ3wWHF4SIzntFPzTAaSKxQPphoDqRSiP92EM
ifuc8/b2fxl42SMzTRGXTfZ94UrJOG7zlcqJlXEi82CB1DBvUOKz546mBqNpx/PS
DiFUoP9OKyzOtEl3ktUU50aTGhgbJV1ijSMD9jO1VEZ0oZ/W/MfDAa609wziF+mk
+GnNEY+C1LLzMXXuWmkDiz/SHEDIa+uZi8t7mdXWFhNCgjEgViJWzSjU4y5UxCEM
iI+GHjjof37VqFdu6I3dmS/cbUg7pXjja970DSHSzAVfdrwfs03LUoNTVCF1XTnG
GEVmDjpMC6XGvCCFENdGHCJiNSdG3O53zCMpsmM1uLpmLjN36sPLTIvpfkbNwHr5
7NBuHBiUnR+XiJUP7lQH1okI9AhKNU2OLTLBame34OdpAvRltXemaF+yono/zN4h
JU/QLQR8PA1RBaw2elsZv96HKycI8+ZA7Kba6kPHKzzN8WigFm1S1gNFdKl93Fwy
TCvAdTI80mjeES41Lvj6syg0TNS839RLsPEoRjGtZxWRS/W9EjxxrjMWchbm7nFw
9j1m9q+ejF10ElWojBzr
=6/EU
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives