SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals

Experience SANS training through course previews.
Learn MoreLet us help.
Contact usBecome a member for instant access to our free resources.
Sign UpWe're here to help.
Contact UsSince modern web applications are implemented in memory-safe languages, vulnerabilities arising from erroneous memory handling are often overlooked during web application testing. Recent research however shows that some memory-unsafe parsers are still popular members of the software supply chain, reanimating old bug classes. Disclosure of uninitialized memory is one of these bug classes that poses unique challenges for black- and white-box testing and vulnerability research as well. This paper will give an overview on the bug class and public cases of such vulnerabilities affecting web applications. Challenges, and possible approaches of black-box detection will be discussed in detail. Since the processing model of the affected software has a determining effect on the impact of memory disclosures, the effect of the vulnerabilities will be assessed against multiple application platforms.