OAuth 2.0 and OpenID vulnerable to Covert Redirect

[Justin Bull <me () justinbull ca>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

While we're still recovering (or benefiting, to some) from the sting
of Heartbleed, this makes an appearance:

http://tetraph.com/covert_redirect/oauth2_openid_covert_redirect.html

c|net writeup:
http://www.cnet.com/news/serious-security-flaw-in-oauth-and-openid-discovered/

Happy Friday.

- -- 
Best Regards,
Justin Bull
E09D 38DE 8FB7 5745 2044 A0F4 1A2B DEAA 68FD B34C
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJTY8IfAAoJEESFZfv8+htYfOcP/27D+Sy1kQOF+Id6I/P1F2qA
228myh0yvnvKa+VfHnLtCaoFsxvc9Jp1418P7A/Rly32dCgyVsqEnLBoLSRD2Zgj
mAwNyAfM/9W6M/CC3sZfCsLW/9LlZ3wWHF4SIzntFPzTAaSKxQPphoDqRSiP92EM
ifuc8/b2fxl42SMzTRGXTfZ94UrJOG7zlcqJlXEi82CB1DBvUOKz546mBqNpx/PS
DiFUoP9OKyzOtEl3ktUU50aTGhgbJV1ijSMD9jO1VEZ0oZ/W/MfDAa609wziF+mk
+GnNEY+C1LLzMXXuWmkDiz/SHEDIa+uZi8t7mdXWFhNCgjEgViJWzSjU4y5UxCEM
iI+GHjjof37VqFdu6I3dmS/cbUg7pXjja970DSHSzAVfdrwfs03LUoNTVCF1XTnG
GEVmDjpMC6XGvCCFENdGHCJiNSdG3O53zCMpsmM1uLpmLjN36sPLTIvpfkbNwHr5
7NBuHBiUnR+XiJUP7lQH1okI9AhKNU2OLTLBame34OdpAvRltXemaF+yono/zN4h
JU/QLQR8PA1RBaw2elsZv96HKycI8+ZA7Kba6kPHKzzN8WigFm1S1gNFdKl93Fwy
TCvAdTI80mjeES41Lvj6syg0TNS839RLsPEoRjGtZxWRS/W9EjxxrjMWchbm7nFw
9j1m9q+ejF10ElWojBzr
=6/EU
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/