Full Disclosure mailing list archives
OAuth 2.0 and OpenID vulnerable to Covert Redirect
From: Justin Bull <me () justinbull ca>
Date: Fri, 02 May 2014 12:04:53 -0400
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 While we're still recovering (or benefiting, to some) from the sting of Heartbleed, this makes an appearance: http://tetraph.com/covert_redirect/oauth2_openid_covert_redirect.html c|net writeup: http://www.cnet.com/news/serious-security-flaw-in-oauth-and-openid-discovered/ Happy Friday. - -- Best Regards, Justin Bull E09D 38DE 8FB7 5745 2044 A0F4 1A2B DEAA 68FD B34C -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJTY8IfAAoJEESFZfv8+htYfOcP/27D+Sy1kQOF+Id6I/P1F2qA 228myh0yvnvKa+VfHnLtCaoFsxvc9Jp1418P7A/Rly32dCgyVsqEnLBoLSRD2Zgj mAwNyAfM/9W6M/CC3sZfCsLW/9LlZ3wWHF4SIzntFPzTAaSKxQPphoDqRSiP92EM ifuc8/b2fxl42SMzTRGXTfZ94UrJOG7zlcqJlXEi82CB1DBvUOKz546mBqNpx/PS DiFUoP9OKyzOtEl3ktUU50aTGhgbJV1ijSMD9jO1VEZ0oZ/W/MfDAa609wziF+mk +GnNEY+C1LLzMXXuWmkDiz/SHEDIa+uZi8t7mdXWFhNCgjEgViJWzSjU4y5UxCEM iI+GHjjof37VqFdu6I3dmS/cbUg7pXjja970DSHSzAVfdrwfs03LUoNTVCF1XTnG GEVmDjpMC6XGvCCFENdGHCJiNSdG3O53zCMpsmM1uLpmLjN36sPLTIvpfkbNwHr5 7NBuHBiUnR+XiJUP7lQH1okI9AhKNU2OLTLBame34OdpAvRltXemaF+yono/zN4h JU/QLQR8PA1RBaw2elsZv96HKycI8+ZA7Kba6kPHKzzN8WigFm1S1gNFdKl93Fwy TCvAdTI80mjeES41Lvj6syg0TNS839RLsPEoRjGtZxWRS/W9EjxxrjMWchbm7nFw 9j1m9q+ejF10ElWojBzr =6/EU -----END PGP SIGNATURE----- _______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Current thread:
- OAuth 2.0 and OpenID vulnerable to Covert Redirect Justin Bull (May 02)