| This thread was migrated from an old forum. It may contain information that are no longer valid. For further assistance, please post a new question or open a support ticket from the Customer Support portal. |
Issue in our Application during Vulnerability Assessment Scan:
It is possible to cause the application to disclose information contained within other memory structures of the application. This ability, if further exploited, could lead to any and all sensitive information stored on the heap being sent to the user and may lead to a complete compromise of the affected system.
Explanation
A determined attacker may be able to use this vulnerability to retrieve sensitive information from system memory.
Recommendation
Ensure the application sanitizes input in order to minimize the chance of exploitation.
Tips
Exploitation details are highly dependent on specific application and platform
References
Keep Sensitive Information in RAM for a Short Time http://www.androidsecurity.guru/keep-sensitive-information-in-ram-for-a-short-time/ Guideline 2-3: Consider purging highly sensitive data from memory after use http://www.oracle.com/technetwork/java/seccodeguide-139067.html#2