DISA STIG version 6 IDs: C and C++
This article maps DISA Security Technical Implementation Guide version 6 IDs to Klocwork C/C++ checkers. For more information about DISA STIG, see the STIG web site.
| Rule | Checker name and description |
|---|---|
| V-222387 [APSC-DV-000010] (MEDIUM): The application must provide a capability to limit the number of logon sessions per user. | |
| V-222388 [APSC-DV-000060] (MEDIUM): The application must clear temporary storage and cookies when the session is terminated. | |
| V-222389 [APSC-DV-000070] (MEDIUM): The application must automatically terminate the non-privileged user session and log off non-privileged users after a 15 minute idle time period has elapsed. | |
| V-222390 [APSC-DV-000080] (MEDIUM): The application must automatically terminate the admin user session and log off admin users after a 10 minute idle time period is exceeded. | |
| V-222391 [APSC-DV-000090] (MEDIUM): Applications requiring user access authentication must provide a logoff capability for user initiated communication session. | |
| V-222392 [APSC-DV-000100] (LOW): The application must display an explicit logoff message to users indicating the reliable termination of authenticated communications sessions. | |
| V-222393 [APSC-DV-000110] (MEDIUM): The application must associate organization-defined types of security attributes having organization-defined security attribute values with information in storage. | |
| V-222394 [APSC-DV-000120] (MEDIUM): The application must associate organization-defined types of security attributes having organization-defined security attribute values with information in process. | |
| V-222395 [APSC-DV-000130] (MEDIUM): The application must associate organization-defined types of security attributes having organization-defined security attribute values with information in transmission. | |
| V-222396 [APSC-DV-000160] (MEDIUM): The application must implement DoD-approved encryption to protect the confidentiality of remote access sessions. |
RCA Risky cryptographic algorithm used RCA.HASH.SALT.EMPTY Use of a one-way hash with an empty salt |
| V-222397 [APSC-DV-000170] (MEDIUM): The application must implement cryptographic mechanisms to protect the integrity of remote access sessions. |
RCA Risky cryptographic algorithm used RCA.HASH.SALT.EMPTY Use of a one-way hash with an empty salt |
| V-222398 [APSC-DV-000180] (MEDIUM): Applications with SOAP messages requiring integrity must include the following message elements:-Message ID-Service Request-Timestamp-SAML Assertion (optionally included in messages) and all elements of the message must be digitally signed. | |
| V-222399 [APSC-DV-000190] (HIGH): Messages protected with WS_Security must use time stamps with creation and expiration times. | |
| V-222400 [APSC-DV-000200] (HIGH): Validity periods must be verified on all application messages using WS-Security or SAML assertions. | |
| V-222401 [APSC-DV-000210] (MEDIUM): The application must ensure each unique asserting party provides unique assertion ID references for each SAML assertion. | |
| V-222402 [APSC-DV-000220] (MEDIUM): The application must ensure encrypted assertions, or equivalent confidentiality protections are used when assertion data is passed through an intermediary, and confidentiality of the assertion data is required when passing through the intermediary. | |
| V-222403 [APSC-DV-000230] (HIGH): The application must use the NotOnOrAfter condition when using the SubjectConfirmation element in a SAML assertion. | |
| V-222404 [APSC-DV-000240] (HIGH): The application must use both the NotBefore and NotOnOrAfter elements or OneTimeUse element when using the Conditions element in a SAML assertion. | |
| V-222405 [APSC-DV-000250] (MEDIUM): The application must ensure if a OneTimeUse element is used in an assertion, there is only one of the same used in the Conditions element portion of an assertion. | |
| V-222406 [APSC-DV-000260] (MEDIUM): The application must ensure messages are encrypted when the SessionIndex is tied to privacy data. | |
| V-222407 [APSC-DV-000280] (MEDIUM): The application must provide automated mechanisms for supporting account management functions. | |
| V-222408 [APSC-DV-000290] (MEDIUM): Shared/group account credentials must be terminated when members leave the group. | |
| V-222409 [APSC-DV-000300] (MEDIUM): The application must automatically remove or disable temporary user accounts 72 hours after account creation. | |
| V-222410 [APSC-DV-000310] (LOW): The application must have a process, feature or function that prevents removal or disabling of emergency accounts. | |
| V-222411 [APSC-DV-000320] (LOW): The application must automatically disable accounts after a 35 day period of account inactivity. | |
| V-222412 [APSC-DV-000330] (MEDIUM): Unnecessary application accounts must be disabled, or deleted. | |
| V-222413 [APSC-DV-000340] (MEDIUM): The application must automatically audit account creation. | |
| V-222414 [APSC-DV-000350] (MEDIUM): The application must automatically audit account modification. | |
| V-222415 [APSC-DV-000360] (MEDIUM): The application must automatically audit account disabling actions. | |
| V-222416 [APSC-DV-000370] (MEDIUM): The application must automatically audit account removal actions. | |
| V-222417 [APSC-DV-000380] (LOW): The application must notify system administrators (SAs) and information system security officers (ISSOs) when accounts are created. | |
| V-222418 [APSC-DV-000390] (LOW): The application must notify system administrators (SAs) and information system security officers (ISSOs) when accounts are modified. | |
| V-222419 [APSC-DV-000400] (LOW): The application must notify system administrators (SAs) and information system security officers (ISSOs) of account disabling actions. | |
| V-222420 [APSC-DV-000410] (LOW): The application must notify system administrators (SAs) and information system security officers (ISSOs) of account removal actions. | |
| V-222421 [APSC-DV-000420] (MEDIUM): The application must automatically audit account enabling actions. | |
| V-222422 [APSC-DV-000430] (LOW): The application must notify system administrators (SAs) and information system security officers (ISSOs) of account enabling actions. | |
| V-222423 [APSC-DV-000440] (MEDIUM): Application data protection requirements must be identified and documented. | |
| V-222424 [APSC-DV-000450] (MEDIUM): The application must utilize organization-defined data mining detection techniques for organization-defined data storage objects to adequately detect data mining attempts. | |
| V-222425 [APSC-DV-000460] (HIGH): The application must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies. |
SV.BRM.HKEY_LOCAL_MACHINE HKEY_LOCAL_MACHINE Used as 'hkey' Parameter for Registry Manipulation Function SV.PIPE.CONST Potential pipe hijacking SV.PIPE.VAR Potential pipe hijacking |
| V-222426 [APSC-DV-000470] (MEDIUM): The application must enforce organization-defined discretionary access control policies over defined subjects and objects. | |
| V-222427 [APSC-DV-000480] (MEDIUM): The application must enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies. | |
| V-222428 [APSC-DV-000490] (MEDIUM): The application must enforce approved authorizations for controlling the flow of information between interconnected systems based on organization-defined information flow control policies. | |
| V-222429 [APSC-DV-000500] (MEDIUM): The application must prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures. | |
| V-222430 [APSC-DV-000510] (HIGH): The application must execute without excessive account permissions. |
SV.BRM.HKEY_LOCAL_MACHINE HKEY_LOCAL_MACHINE Used as 'hkey' Parameter for Registry Manipulation Function SV.LPP.CONST Use of Insecure Macro for Dangerous Functions SV.LPP.VAR Use of Insecure Parameter for Dangerous Functions SV.PIPE.CONST Potential pipe hijacking SV.PIPE.VAR Potential pipe hijacking SV.SIP.CONST Use of Insecure Macro for Dangerous Functions SV.SIP.VAR Use of Insecure Parameter for Dangerous Functions SV.USAGERULES.PERMISSIONS Use of Privilege Elevation |
| V-222431 [APSC-DV-000520] (MEDIUM): The application must audit the execution of privileged functions. | |
| V-222432 [APSC-DV-000530] (HIGH): The application must enforce the limit of three consecutive invalid logon attempts by a user during a 15 minute time period. |
CXX.SV.PWD_INPUT.REVIEW Password authentication should be checked against brute force attacks |
| V-222433 [APSC-DV-000540] (MEDIUM): The application administrator must follow an approved process to unlock locked user accounts. | |
| V-222434 [APSC-DV-000550] (LOW): The application must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the application. | |
| V-222435 [APSC-DV-000560] (LOW): The application must retain the Standard Mandatory DoD Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access. | |
| V-222436 [APSC-DV-000570] (LOW): The publicly accessible application must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the application. | |
| V-222437 [APSC-DV-000580] (LOW): The application must display the time and date of the users last successful logon. | |
| V-222438 [APSC-DV-000590] (MEDIUM): The application must protect against an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation. | |
| V-222439 [APSC-DV-000600] (MEDIUM): For applications providing audit record aggregation, the application must compile audit records from organization-defined information system components into a system-wide audit trail that is time-correlated with an organization-defined level of tolerance for the relationship between time stamps of individual records in the audit trail. | |
| V-222441 [APSC-DV-000620] (MEDIUM): The application must provide audit record generation capability for the creation of session IDs. | |
| V-222442 [APSC-DV-000630] (MEDIUM): The application must provide audit record generation capability for the destruction of session IDs. | |
| V-222443 [APSC-DV-000640] (MEDIUM): The application must provide audit record generation capability for the renewal of session IDs. | |
| V-222444 [APSC-DV-000650] (MEDIUM): The application must not write sensitive data into the application logs. | |
| V-222445 [APSC-DV-000660] (MEDIUM): The application must provide audit record generation capability for session timeouts. | |
| V-222446 [APSC-DV-000670] (MEDIUM): The application must record a time stamp indicating when the event occurred. | |
| V-222447 [APSC-DV-000680] (MEDIUM): The application must provide audit record generation capability for HTTP headers including User-Agent, Referer, GET, and POST. | |
| V-222448 [APSC-DV-000690] (MEDIUM): The application must provide audit record generation capability for connecting system IP addresses. | |
| V-222449 [APSC-DV-000700] (MEDIUM): The application must record the username or user ID of the user associated with the event. | |
| V-222450 [APSC-DV-000710] (MEDIUM): The application must generate audit records when successful/unsuccessful attempts to grant privileges occur. | |
| V-222451 [APSC-DV-000720] (MEDIUM): The application must generate audit records when successful/unsuccessful attempts to access security objects occur. | |
| V-222452 [APSC-DV-000730] (MEDIUM): The application must generate audit records when successful/unsuccessful attempts to access security levels occur. | |
| V-222453 [APSC-DV-000740] (MEDIUM): The application must generate audit records when successful/unsuccessful attempts to access categories of information (e.g., classification levels) occur. | |
| V-222454 [APSC-DV-000750] (MEDIUM): The application must generate audit records when successful/unsuccessful attempts to modify privileges occur. | |
| V-222455 [APSC-DV-000760] (MEDIUM): The application must generate audit records when successful/unsuccessful attempts to modify security objects occur. | |
| V-222456 [APSC-DV-000770] (MEDIUM): The application must generate audit records when successful/unsuccessful attempts to modify security levels occur. | |
| V-222457 [APSC-DV-000780] (MEDIUM): The application must generate audit records when successful/unsuccessful attempts to modify categories of information (e.g., classification levels) occur. | |
| V-222458 [APSC-DV-000790] (MEDIUM): The application must generate audit records when successful/unsuccessful attempts to delete privileges occur. | |
| V-222459 [APSC-DV-000800] (MEDIUM): The application must generate audit records when successful/unsuccessful attempts to delete security levels occur. | |
| V-222460 [APSC-DV-000810] (MEDIUM): The application must generate audit records when successful/unsuccessful attempts to delete application database security objects occur. | |
| V-222461 [APSC-DV-000820] (MEDIUM): The application must generate audit records when successful/unsuccessful attempts to delete categories of information (e.g., classification levels) occur. | |
| V-222462 [APSC-DV-000830] (MEDIUM): The application must generate audit records when successful/unsuccessful logon attempts occur. | |
| V-222463 [APSC-DV-000840] (MEDIUM): The application must generate audit records for privileged activities or other system-level access. | |
| V-222464 [APSC-DV-000850] (MEDIUM): The application must generate audit records showing starting and ending time for user access to the system. | |
| V-222465 [APSC-DV-000860] (MEDIUM): The application must generate audit records when successful/unsuccessful accesses to objects occur. | |
| V-222466 [APSC-DV-000870] (MEDIUM): The application must generate audit records for all direct access to the information system. | |
| V-222467 [APSC-DV-000880] (MEDIUM): The application must generate audit records for all account creations, modifications, disabling, and termination events. | |
| V-222468 [APSC-DV-000910] (MEDIUM): The application must initiate session auditing upon startup. | |
| V-222469 [APSC-DV-000940] (MEDIUM): The application must log application shutdown events. | |
| V-222470 [APSC-DV-000950] (MEDIUM): The application must log destination IP addresses. | |
| V-222471 [APSC-DV-000960] (MEDIUM): The application must log user actions involving access to data. | |
| V-222472 [APSC-DV-000970] (MEDIUM): The application must log user actions involving changes to data. | |
| V-222473 [APSC-DV-000980] (MEDIUM): The application must produce audit records containing information to establish when (date and time) the events occurred. | |
| V-222474 [APSC-DV-000990] (MEDIUM): The application must produce audit records containing enough information to establish which component, feature or function of the application triggered the audit event. | |
| V-222475 [APSC-DV-001000] (MEDIUM): When using centralized logging; the application must include a unique identifier in order to distinguish itself from other application logs. | |
| V-222476 [APSC-DV-001010] (MEDIUM): The application must produce audit records that contain information to establish the outcome of the events. | |
| V-222477 [APSC-DV-001020] (MEDIUM): The application must generate audit records containing information that establishes the identity of any individual or process associated with the event. | |
| V-222478 [APSC-DV-001030] (MEDIUM): The application must generate audit records containing the full-text recording of privileged commands or the individual identities of group account users. | |
| V-222479 [APSC-DV-001040] (MEDIUM): The application must implement transaction recovery logs when transaction based. | |
| V-222480 [APSC-DV-001050] (MEDIUM): The application must provide centralized management and configuration of the content to be captured in audit records generated by all application components. | |
| V-222481 [APSC-DV-001070] (MEDIUM): The application must off-load audit records onto a different system or media than the system being audited. | |
| V-222482 [APSC-DV-001080] (MEDIUM): The application must be configured to write application logs to a centralized log repository. | |
| V-222483 [APSC-DV-001090] (MEDIUM): The application must provide an immediate warning to the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75% of repository maximum audit record storage capacity. | |
| V-222484 [APSC-DV-001100] (MEDIUM): Applications categorized as having a moderate or high impact must provide an immediate real-time alert to the SA and ISSO (at a minimum) for all audit failure events. | |
| V-222485 [APSC-DV-001110] (MEDIUM): The application must alert the ISSO and SA (at a minimum) in the event of an audit processing failure. | |
| V-222486 [APSC-DV-001120] (MEDIUM): The application must shut down by default upon audit failure (unless availability is an overriding concern). | |
| V-222487 [APSC-DV-001130] (MEDIUM): The application must provide the capability to centrally review and analyze audit records from multiple components within the system. | |
| V-222488 [APSC-DV-001140] (MEDIUM): The application must provide the capability to filter audit records for events of interest based upon organization-defined criteria. | |
| V-222489 [APSC-DV-001150] (MEDIUM): The application must provide an audit reduction capability that supports on-demand reporting requirements. | |
| V-222490 [APSC-DV-001160] (MEDIUM): The application must provide an audit reduction capability that supports on-demand audit review and analysis. | |
| V-222491 [APSC-DV-001170] (MEDIUM): The application must provide an audit reduction capability that supports after-the-fact investigations of security incidents. | |
| V-222492 [APSC-DV-001180] (MEDIUM): The application must provide a report generation capability that supports on-demand audit review and analysis. | |
| V-222493 [APSC-DV-001190] (MEDIUM): The application must provide a report generation capability that supports on-demand reporting requirements. | |
| V-222494 [APSC-DV-001200] (MEDIUM): The application must provide a report generation capability that supports after-the-fact investigations of security incidents. | |
| V-222495 [APSC-DV-001210] (MEDIUM): The application must provide an audit reduction capability that does not alter original content or time ordering of audit records. | |
| V-222496 [APSC-DV-001220] (MEDIUM): The application must provide a report generation capability that does not alter original content or time ordering of audit records. | |
| V-222497 [APSC-DV-001250] (MEDIUM): The applications must use internal system clocks to generate time stamps for audit records. | |
| V-222498 [APSC-DV-001260] (MEDIUM): The application must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT). | |
| V-222499 [APSC-DV-001270] (MEDIUM): The application must record time stamps for audit records that meet a granularity of one second for a minimum degree of precision. | |
| V-222500 [APSC-DV-001280] (MEDIUM): The application must protect audit information from any type of unauthorized read access. | |
| V-222501 [APSC-DV-001290] (MEDIUM): The application must protect audit information from unauthorized modification. | |
| V-222502 [APSC-DV-001300] (MEDIUM): The application must protect audit information from unauthorized deletion. | |
| V-222503 [APSC-DV-001310] (MEDIUM): The application must protect audit tools from unauthorized access. | |
| V-222504 [APSC-DV-001320] (MEDIUM): The application must protect audit tools from unauthorized modification. | |
| V-222505 [APSC-DV-001330] (MEDIUM): The application must protect audit tools from unauthorized deletion. | |
| V-222506 [APSC-DV-001340] (MEDIUM): The application must back up audit records at least every seven days onto a different system or system component than the system or component being audited. | |
| V-222507 [APSC-DV-001350] (MEDIUM): The application must use cryptographic mechanisms to protect the integrity of audit information. | |
| V-222508 [APSC-DV-001360] (MEDIUM): Application audit tools must be cryptographically hashed. | |
| V-222509 [APSC-DV-001370] (MEDIUM): The integrity of the audit tools must be validated by checking the files for changes in the cryptographic hash value. | |
| V-222510 [APSC-DV-001390] (MEDIUM): The application must prohibit user installation of software without explicit privileged status. | |
| V-222511 [APSC-DV-001410] (MEDIUM): The application must enforce access restrictions associated with changes to application configuration. |
SV.BRM.HKEY_LOCAL_MACHINE HKEY_LOCAL_MACHINE Used as 'hkey' Parameter for Registry Manipulation Function SV.LPP.CONST Use of Insecure Macro for Dangerous Functions SV.LPP.VAR Use of Insecure Parameter for Dangerous Functions SV.PIPE.CONST Potential pipe hijacking SV.PIPE.VAR Potential pipe hijacking SV.SIP.CONST Use of Insecure Macro for Dangerous Functions SV.SIP.VAR Use of Insecure Parameter for Dangerous Functions SV.USAGERULES.PERMISSIONS Use of Privilege Elevation |
| V-222512 [APSC-DV-001420] (MEDIUM): The application must audit who makes configuration changes to the application. | |
| V-222513 [APSC-DV-001430] (MEDIUM): The application must have the capability to prevent the installation of patches, service packs, or application components without verification the software component has been digitally signed using a certificate that is recognized and approved by the organization. | |
| V-222514 [APSC-DV-001440] (MEDIUM): The applications must limit privileges to change the software resident within software libraries. | |
| V-222515 [APSC-DV-001460] (MEDIUM): An application vulnerability assessment must be conducted. | |
| V-222516 [APSC-DV-001480] (MEDIUM): The application must prevent program execution in accordance with organization-defined policies regarding software program usage and restrictions, and/or rules authorizing the terms and conditions of software program usage. | |
| V-222517 [APSC-DV-001490] (MEDIUM): The application must employ a deny-all, permit-by-exception (whitelist) policy to allow the execution of authorized software programs. | |
| V-222518 [APSC-DV-001500] (MEDIUM): The application must be configured to disable non-essential capabilities. | |
| V-222519 [APSC-DV-001510] (MEDIUM): The application must be configured to use only functions, ports, and protocols permitted to it in the PPSM CAL. | |
| V-222520 [APSC-DV-001520] (MEDIUM): The application must require users to reauthenticate when organization-defined circumstances or situations require reauthentication. | |
| V-222521 [APSC-DV-001530] (MEDIUM): The application must require devices to reauthenticate when organization-defined circumstances or situations requiring reauthentication. | |
| V-222522 [APSC-DV-001540] (HIGH): The application must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users). | |
| V-222523 [APSC-DV-001550] (MEDIUM): The application must use multifactor (Alt. Token) authentication for network access to privileged accounts. | |
| V-222524 [APSC-DV-001560] (MEDIUM): The application must accept Personal Identity Verification (PIV) credentials. | |
| V-222525 [APSC-DV-001570] (MEDIUM): The application must electronically verify Personal Identity Verification (PIV) credentials. | |
| V-222526 [APSC-DV-001580] (MEDIUM): The application must use multifactor (e.g., CAC, Alt. Token) authentication for network access to non-privileged accounts. | |
| V-222527 [APSC-DV-001590] (MEDIUM): The application must use multifactor (Alt. Token) authentication for local access to privileged accounts. | |
| V-222528 [APSC-DV-001600] (MEDIUM): The application must use multifactor (e.g., CAC, Alt. Token) authentication for local access to nonprivileged accounts. | |
| V-222529 [APSC-DV-001610] (MEDIUM): The application must ensure users are authenticated with an individual authenticator prior to using a group authenticator. | |
| V-222530 [APSC-DV-001620] (MEDIUM): The application must implement replay-resistant authentication mechanisms for network access to privileged accounts. | |
| V-222531 [APSC-DV-001630] (MEDIUM): The application must implement replay-resistant authentication mechanisms for network access to nonprivileged accounts. | |
| V-222532 [APSC-DV-001640] (MEDIUM): The application must utilize mutual authentication when endpoint device non-repudiation protections are required by DoD policy or by the data owner. | |
| V-222533 [APSC-DV-001650] (MEDIUM): The application must authenticate all network connected endpoint devices before establishing any connection. | |
| V-222534 [APSC-DV-001660] (MEDIUM): Service-Oriented Applications handling non-releasable data must authenticate endpoint devices via mutual SSL/TLS. | |
| V-222535 [APSC-DV-001670] (MEDIUM): The application must disable device identifiers after 35 days of inactivity unless a cryptographic certificate is used for authentication. | |
| V-222536 [APSC-DV-001680] (HIGH): The application must enforce a minimum 15-character password length. |
CXX.SV.PWD.PLAIN.LENGTH Attempt to set password with a length less than 15 characters CXX.SV.PWD.PLAIN.LENGTH.ZERO Attempt to set password with a length of zero characters |
| V-222537 [APSC-DV-001690] (MEDIUM): The application must enforce password complexity by requiring that at least one uppercase character be used. | |
| V-222538 [APSC-DV-001700] (MEDIUM): The application must enforce password complexity by requiring that at least one lowercase character be used. | |
| V-222539 [APSC-DV-001710] (MEDIUM): The application must enforce password complexity by requiring that at least one numeric character be used. | |
| V-222540 [APSC-DV-001720] (MEDIUM): The application must enforce password complexity by requiring that at least one special character be used. | |
| V-222541 [APSC-DV-001730] (MEDIUM): The application must require the change of at least eight of the total number of characters when passwords are changed. | |
| V-222542 [APSC-DV-001740] (HIGH): The application must only store cryptographic representations of passwords. |
HCC Use of hardcoded credentials HCC.PWD Use of a hardcoded password HCC.USER Use of a hardcoded user name RCA Risky cryptographic algorithm used RCA.HASH.SALT.EMPTY Use of a one-way hash with an empty salt SV.WEAK_CRYPTO.WEAK_HASH Weak Hash Function |
| V-222543 [APSC-DV-001750] (HIGH): The application must transmit only cryptographically-protected passwords. |
HCC Use of hardcoded credentials HCC.PWD Use of a hardcoded password HCC.USER Use of a hardcoded user name RCA Risky cryptographic algorithm used RCA.HASH.SALT.EMPTY Use of a one-way hash with an empty salt SV.WEAK_CRYPTO.WEAK_HASH Weak Hash Function |
| V-222544 [APSC-DV-001760] (MEDIUM): The application must enforce 24 hours/1 day as the minimum password lifetime. | |
| V-222545 [APSC-DV-001770] (MEDIUM): The application must enforce a 60-day maximum password lifetime restriction. | |
| V-222546 [APSC-DV-001780] (MEDIUM): The application must prohibit password reuse for a minimum of five generations. | |
| V-222547 [APSC-DV-001790] (MEDIUM): The application must allow the use of a temporary password for system logons with an immediate change to a permanent password. | |
| V-222548 [APSC-DV-001795] (MEDIUM): The application password must not be changeable by users other than the administrator or the user with which the password is associated. | |
| V-222549 [APSC-DV-001800] (MEDIUM): The application must terminate existing user sessions upon account deletion. | |
| V-222550 [APSC-DV-001810] (HIGH): The application, when utilizing PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor. | |
| V-222551 [APSC-DV-001820] (HIGH): The application, when using PKI-based authentication, must enforce authorized access to the corresponding private key. |
CXX.SV.PRIVATE_KEY.EMPTY_PASSWD Attempt to serialize private key in an unauthorized way CXX.SV.PRIVATE_KEY.UNENCRYPTED Attempt to serialize private key in an unauthorized way |
| V-222552 [APSC-DV-001830] (MEDIUM): The application must map the authenticated identity to the individual user or group account for PKI-based authentication. | |
| V-222553 [APSC-DV-001840] (MEDIUM): The application, for PKI-based authentication, must implement a local cache of revocation data to support path discovery and validation in case of the inability to access revocation information via the network. | |
| V-222554 [APSC-DV-001850] (HIGH): The application must not display passwords/PINs as clear text. |
CXX.SV.PWD.PLAIN Attempt to set password using a plain string |
| V-222555 [APSC-DV-001860] (HIGH): The application must use mechanisms meeting the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module. |
HCC Use of hardcoded credentials HCC.PWD Use of a hardcoded password HCC.USER Use of a hardcoded user name RCA Risky cryptographic algorithm used RCA.HASH.SALT.EMPTY Use of a one-way hash with an empty salt SV.WEAK_CRYPTO.WEAK_HASH Weak Hash Function |
| V-222556 [APSC-DV-001870] (MEDIUM): The application must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users). | |
| V-222557 [APSC-DV-001880] (MEDIUM): The application must accept Personal Identity Verification (PIV) credentials from other federal agencies. | |
| V-222558 [APSC-DV-001890] (MEDIUM): The application must electronically verify Personal Identity Verification (PIV) credentials from other federal agencies. | |
| V-222559 [APSC-DV-001900] (MEDIUM): The application must accept Federal Identity, Credential, and Access Management (FICAM)-approved third-party credentials. | |
| V-222560 [APSC-DV-001910] (MEDIUM): The application must conform to Federal Identity, Credential, and Access Management (FICAM)-issued profiles. | |
| V-222561 [APSC-DV-001930] (MEDIUM): Applications used for non-local maintenance sessions must audit non-local maintenance and diagnostic sessions for organization-defined auditable events. | |
| V-222562 [APSC-DV-001940] (MEDIUM): Applications used for non-local maintenance sessions must implement cryptographic mechanisms to protect the integrity of non-local maintenance and diagnostic communications. | |
| V-222563 [APSC-DV-001950] (MEDIUM): Applications used for non-local maintenance sessions must implement cryptographic mechanisms to protect the confidentiality of non-local maintenance and diagnostic communications. | |
| V-222564 [APSC-DV-001960] (MEDIUM): Applications used for non-local maintenance sessions must verify remote disconnection at the termination of non-local maintenance and diagnostic sessions. | |
| V-222565 [APSC-DV-001970] (MEDIUM): The application must employ strong authenticators in the establishment of non-local maintenance and diagnostic sessions. | |
| V-222566 [APSC-DV-001980] (MEDIUM): The application must terminate all sessions and network connections when nonlocal maintenance is completed. |
RH.LEAK Resource leak |
| V-222567 [APSC-DV-001995] (MEDIUM): The application must not be vulnerable to race conditions. |
SV.TOCTOU.FILE_ACCESS Time of Creation/Time of Use Race condition in File Access |
| V-222568 [APSC-DV-002000] (MEDIUM): The application must terminate all network connections associated with a communications session at the end of the session. |
RH.LEAK Resource leak |
| V-222570 [APSC-DV-002020] (MEDIUM): The application must utilize FIPS-validated cryptographic modules when signing application components. | |
| V-222571 [APSC-DV-002030] (MEDIUM): The application must utilize FIPS-validated cryptographic modules when generating cryptographic hashes. |
RCA Risky cryptographic algorithm used RCA.HASH.SALT.EMPTY Use of a one-way hash with an empty salt SV.WEAK_CRYPTO.WEAK_HASH Weak Hash Function |
| V-222572 [APSC-DV-002040] (MEDIUM): The application must utilize FIPS-validated cryptographic modules when protecting unclassified information that requires cryptographic protection. |
RCA Risky cryptographic algorithm used RCA.HASH.SALT.EMPTY Use of a one-way hash with an empty salt SV.WEAK_CRYPTO.WEAK_HASH Weak Hash Function |
| V-222573 [APSC-DV-002050] (MEDIUM): Applications making SAML assertions must use FIPS-approved random numbers in the generation of SessionIndex in the SAML element AuthnStatement. | |
| V-222574 [APSC-DV-002150] (MEDIUM): The application user interface must be either physically or logically separated from data storage and management interfaces. | |
| V-222575 [APSC-DV-002210] (MEDIUM): The application must set the HTTPOnly flag on session cookies. | |
| V-222576 [APSC-DV-002220] (MEDIUM): The application must set the secure flag on session cookies. | |
| V-222577 [APSC-DV-002230] (HIGH): The application must not expose session IDs. |
CXX.SV.INSECURE_COOKIE Insecure cookie |
| V-222578 [APSC-DV-002240] (HIGH): The application must destroy the session ID value and/or cookie on logoff or browser close. |
CXX.SV.PERSISTENT_COOKIE Illegal usage of a persistent cookie |
| V-222579 [APSC-DV-002250] (MEDIUM): Applications must use system-generated session identifiers that protect against session fixation. | |
| V-222580 [APSC-DV-002260] (MEDIUM): Applications must validate session identifiers. | |
| V-222581 [APSC-DV-002270] (MEDIUM): Applications must not use URL embedded session IDs. | |
| V-222582 [APSC-DV-002280] (MEDIUM): The application must not re-use or recycle session IDs. | |
| V-222583 [APSC-DV-002290] (MEDIUM): The application must generate a unique session identifier using a FIPS 140-2/140-3 approved random number generator. |
RCA Risky cryptographic algorithm used RCA.HASH.SALT.EMPTY Use of a one-way hash with an empty salt SV.WEAK_CRYPTO.WEAK_HASH Weak Hash Function |
| V-222584 [APSC-DV-002300] (MEDIUM): The application must only allow the use of DoD-approved certificate authorities for verification of the establishment of protected sessions. | |
| V-222585 [APSC-DV-002310] (HIGH): The application must fail to a secure state if system initialization fails, shutdown fails, or aborts fail. | |
| V-222586 [APSC-DV-002320] (MEDIUM): In the event of a system failure, applications must preserve any information necessary to determine cause of failure and any information necessary to return to operations with least disruption to mission processes. | |
| V-222587 [APSC-DV-002330] (MEDIUM): The application must protect the confidentiality and integrity of stored information when required by DoD policy or the information owner. | |
| V-222588 [APSC-DV-002340] (HIGH): The application must implement approved cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest on organization-defined information system components. | |
| V-222589 [APSC-DV-002350] (HIGH): The application must use appropriate cryptography in order to protect stored DOD information when required by the information owner or DOD policy. |
RCA Risky cryptographic algorithm used RCA.HASH.SALT.EMPTY Use of a one-way hash with an empty salt SV.WEAK_CRYPTO.WEAK_HASH Weak Hash Function |
| V-222590 [APSC-DV-002360] (MEDIUM): The application must isolate security functions from non-security functions. | |
| V-222591 [APSC-DV-002370] (MEDIUM): The application must maintain a separate execution domain for each executing process. | |
| V-222592 [APSC-DV-002380] (MEDIUM): Applications must prevent unauthorized and unintended information transfer via shared system resources. |
SV.USAGERULES.PERMISSIONS Use of Privilege Elevation |
| V-222593 [APSC-DV-002390] (MEDIUM): XML-based applications must mitigate DoS attacks by using XML filters, parser options, or gateways. | |
| V-222594 [APSC-DV-002400] (MEDIUM): The application must restrict the ability to launch Denial of Service (DoS) attacks against itself or other information systems. |
FMM.MIGHT Freeing Mismatched Memory - possible FMM.MUST Freeing Mismatched Memory INFINITE_LOOP.GLOBAL Infinite loop INFINITE_LOOP.LOCAL Infinite loop INFINITE_LOOP.MACRO Infinite loop SV.STR_PAR.UNDESIRED_STRING_PARAMETER Undesired String for File Path SV.TAINTED.ALLOC_SIZE Use of Unvalidated Integer in Memory Allocation SV.TAINTED.FMTSTR Use of Unvalidated Data in a Format String SV.TAINTED.PATH_TRAVERSAL Use of Unvalidated Data in a Path Traversal SV.TAINTED.SECURITY_DECISION Security Decision |
| V-222595 [APSC-DV-002410] (MEDIUM): The web service design must include redundancy mechanisms when used with high-availability systems. | |
| V-222596 [APSC-DV-002440] (HIGH): The application must protect the confidentiality and integrity of transmitted information. |
SPECTRE.VARIANT1 Potential exploit of speculative execution |
| V-222597 [APSC-DV-002450] (MEDIUM): The application must implement cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission unless otherwise protected by alternative physical safeguards, such as, at a minimum, a Protected Distribution System (PDS). | |
| V-222598 [APSC-DV-002460] (MEDIUM): The application must maintain the confidentiality and integrity of information during preparation for transmission. | |
| V-222599 [APSC-DV-002470] (MEDIUM): The application must maintain the confidentiality and integrity of information during reception. | |
| V-222600 [APSC-DV-002480] (MEDIUM): The application must not disclose unnecessary information to users. | |
| V-222601 [APSC-DV-002485] (HIGH): The application must not store sensitive information in hidden fields. | |
| V-222602 [APSC-DV-002490] (HIGH): The application must protect from Cross-Site Scripting (XSS) vulnerabilities. |
SV.TAINTED.XSS.REFLECTED Cross-site Scripting Vulnerability |
| V-222603 [APSC-DV-002500] (MEDIUM): The application must protect from Cross-Site Request Forgery (CSRF) vulnerabilities. | |
| V-222604 [APSC-DV-002510] (HIGH): The application must protect from command injection. |
SV.CODE_INJECTION.SHELL_EXEC Command Injection into Shell Execution SV.DLLPRELOAD.NONABSOLUTE.DLL Potential DLL-preload hijack vector SV.DLLPRELOAD.NONABSOLUTE.EXE Potential process injection vector SV.DLLPRELOAD.SEARCHPATH Do not use SearchPath to find DLLs SV.FIU.PROCESS_VARIANTS Use of Dangerous Process Creation |
| V-222605 [APSC-DV-002520] (MEDIUM): The application must protect from canonical representation vulnerabilities. |
SV.DLLPRELOAD.NONABSOLUTE.DLL Potential DLL-preload hijack vector SV.DLLPRELOAD.NONABSOLUTE.EXE Potential process injection vector SV.DLLPRELOAD.SEARCHPATH Do not use SearchPath to find DLLs |
| V-222606 [APSC-DV-002530] (MEDIUM): The application must validate all input. |
ABV.TAINTED Buffer Overflow from Unvalidated Input NNTS.TAINTED Unvalidated User Input Causing Buffer Overflow - Non-Null Terminated String SV.TAINTED.ALLOC_SIZE Use of Unvalidated Integer in Memory Allocation SV.TAINTED.BINOP Use of Unvalidated Integer in Binary Operation SV.TAINTED.CALL.BINOP Use of Unvalidated Integer in Binary Operation SV.TAINTED.CALL.DEREF Dereference Of An Unvalidated Pointer SV.TAINTED.CALL.INDEX_ACCESS Use of Unvalidated Integer as Array Index by Function Call SV.TAINTED.CALL.LOOP_BOUND Use of Unvalidated Integer in Loop Condition through a Function Call SV.TAINTED.FMTSTR Use of Unvalidated Data in a Format String SV.TAINTED.INDEX_ACCESS Use of Unvalidated Integer as Array Index SV.TAINTED.INJECTION Command Injection SV.TAINTED.LOOP_BOUND Use of Unvalidated Integer in Loop Condition SV.TAINTED.PATH_TRAVERSAL Use of Unvalidated Data in a Path Traversal SV.TAINTED.SECURITY_DECISION Security Decision |
| V-222607 [APSC-DV-002540] (HIGH): The application must not be vulnerable to SQL Injection. |
ABV.TAINTED Buffer Overflow from Unvalidated Input CXX.SQL.INJECT SQL Injection SV.TAINTED.INJECTION Command Injection SV.USAGERULES.PERMISSIONS Use of Privilege Elevation |
| V-222608 [APSC-DV-002550] (HIGH): The application must not be vulnerable to XML-oriented attacks. |
CXX.SV.XXE Attempting to resolve external entities while parsing a XML file can lead to XXE attack |
| V-222609 [APSC-DV-002560] (HIGH): The application must not be subject to input handling vulnerabilities. |
SV.TAINTED.ALLOC_SIZE Use of Unvalidated Integer in Memory Allocation SV.TAINTED.BINOP Use of Unvalidated Integer in Binary Operation SV.TAINTED.CALL.BINOP Use of Unvalidated Integer in Binary Operation SV.TAINTED.CALL.INDEX_ACCESS Use of Unvalidated Integer as Array Index by Function Call SV.TAINTED.CALL.LOOP_BOUND Use of Unvalidated Integer in Loop Condition through a Function Call SV.TAINTED.FMTSTR Use of Unvalidated Data in a Format String SV.TAINTED.INDEX_ACCESS Use of Unvalidated Integer as Array Index SV.TAINTED.LOOP_BOUND Use of Unvalidated Integer in Loop Condition SV.TAINTED.PATH_TRAVERSAL Use of Unvalidated Data in a Path Traversal SV.TAINTED.SECURITY_DECISION Security Decision |
| V-222610 [APSC-DV-002570] (MEDIUM): The application must generate error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries. | |
| V-222611 [APSC-DV-002580] (MEDIUM): The application must reveal error messages only to the ISSO, ISSM, or SA. | |
| V-222612 [APSC-DV-002590] (HIGH): The application must not be vulnerable to overflow attacks. |
ABV.ANY_SIZE_ARRAY Buffer Overflow - Array Index Out of Bounds ABV.GENERAL Buffer Overflow - Array Index Out of Bounds ABV.GENERAL.MULTIDIMENSION Buffer Overflow - Array Index Out of Bounds ABV.ITERATOR Buffer Overflow - Array Index may be out of Bounds ABV.MEMBER Buffer Overflow - Array Index Out of Bounds ABV.NON_ARRAY Non-array object is used as an array ABV.STACK Buffer Overflow - Local Array Index Out of Bounds ABV.TAINTED Buffer Overflow from Unvalidated Input ABV.UNICODE.BOUND_MAP Buffer overflow in mapping character function ABV.UNICODE.FAILED_MAP Mapping function failed ABV.UNICODE.NNTS_MAP Buffer overflow in mapping character function ABV.UNKNOWN_SIZE Buffer Overflow - Array Index Out of Bounds CXX.FUNC.T2OLE.LOOP Do not call T2OLE or OLE2CT within a loop CXX.SUSPICIOUS_INDEX_CHECK Suspicious use of index after boundary check CXX.SUSPICIOUS_INDEX_CHECK.CALL Suspicious use of index in a function call after a boundary check CXX.SUSPICIOUS_INDEX_CHECK.ZERO Suspicious use of index after index check for zero INCORRECT.ALLOC_SIZE Incorrect Allocation Size MISRA.CAST.FLOAT Non-trivial float expression is cast to a wider type MISRA.CAST.FLOAT.WIDER Cast of floating point expression to a wider floating point type MISRA.CAST.FLOAT_INT Cast of floating point expression to integral type MISRA.CAST.FUNC_PTR Cast between a function pointer and a non-integral type MISRA.CAST.FUNC_PTR.2012 Conversion performed between a pointer to a function and another incompatible type MISRA.CAST.FUNC_PTR.CPP Cast converts function pointer to other pointer type MISRA.CAST.INCOMPLETE_PTR_TO_ANY.2012 Conversion performed between a pointer to an incomplete type and a different type MISRA.CAST.INT Non-trivial integer expression is cast to a wider type, or type with a different signedness MISRA.CAST.INT.SIGN Non-trivial integral expression is cast to type with different signedness MISRA.CAST.INT.WIDER Cast of integral expression to a wider integral type MISRA.CAST.INT_FLOAT Cast of integral expression to floating point type MISRA.CAST.INT_TO_PTR Object with integer type or pointer to void cast to pointer type MISRA.CAST.OBJ_PTR_TO_INT.2012 Conversion performed between a pointer to an object and an integer type MISRA.CAST.OBJ_PTR_TO_NON_INT.2012 A cast between a pointer to object and a non-integer arithmetic type MISRA.CAST.OBJ_PTR_TO_OBJ_PTR.2012 Cast between a pointer to object type and a pointer to a different object type MISRA.CAST.POLY.TYPE Cast from a polymorphic base class to a derived class MISRA.CAST.PTR Cast between a pointer to object type and a different pointer to object type MISRA.CAST.PTR.UNRELATED Object of pointer type cast to unrelated type MISRA.CAST.PTR.VRCLASS A cast form pointer to a virtual base class to pointer to a derived class does not use 'dynamic_cast' MISRA.CAST.PTR_TO_INT Cast between a pointer and an integral type MISRA.CAST.UNSIGNED_BITS The result of bitwise operation on unsigned char or short is not cast back to original type MISRA.CAST.VOID_PTR_TO_INT.2012 Cast between a pointer to void and an arithmetic type MISRA.CAST.VOID_PTR_TO_OBJ_PTR.2012 Conversion performed from a pointer to void to a pointer to an object MISRA.SIGNED_CHAR.NOT_NUMERIC 'signed char' or 'unsigned char' is used for non-numeric value MISRA.UMINUS.UNSIGNED Operand of unary minus is unsigned NNTS.MIGHT Buffer Overflow - Non-null Terminated String NNTS.MUST Buffer Overflow - Non-null Terminated String NNTS.TAINTED Unvalidated User Input Causing Buffer Overflow - Non-Null Terminated String PRECISION.LOSS Loss of Precision PRECISION.LOSS.CALL Loss of Precision during function call PRECISION.LOSS.INIT Loss of Precision during initialization RABV.CHECK Suspicious use of index before boundary check SV.FMTSTR.GENERIC Format String Vulnerability SV.FMT_STR.BAD_SCAN_FORMAT Input format specifier error SV.FMT_STR.PRINT_FORMAT_MISMATCH.BAD Incompatible type of a print function parameter SV.FMT_STR.PRINT_FORMAT_MISMATCH.UNDESIRED Unexpected type of a print function parameter SV.FMT_STR.PRINT_IMPROP_LENGTH Improper use of length modifier in a print function call SV.FMT_STR.PRINT_PARAMS_WRONGNUM.FEW Too few arguments in a print function call SV.FMT_STR.PRINT_PARAMS_WRONGNUM.MANY Too many arguments in a print function call SV.FMT_STR.UNKWN_FORMAT Unknown format specifier in a print function call SV.STRBO.BOUND_COPY.OVERFLOW Buffer Overflow in Bound String Copy SV.STRBO.BOUND_COPY.UNTERM Possible Buffer Overflow in Following String Operations SV.STRBO.BOUND_SPRINTF Buffer Overflow in Bound sprintf SV.STRBO.UNBOUND_COPY Buffer Overflow in Unbound String Copy SV.STRBO.UNBOUND_SPRINTF Buffer Overflow in Unbound sprintf SV.TAINTED.BINOP Use of Unvalidated Integer in Binary Operation SV.TAINTED.CALL.BINOP Use of Unvalidated Integer in Binary Operation SV.TAINTED.CALL.INDEX_ACCESS Use of Unvalidated Integer as Array Index by Function Call SV.TAINTED.CALL.LOOP_BOUND Use of Unvalidated Integer in Loop Condition through a Function Call SV.TAINTED.INDEX_ACCESS Use of Unvalidated Integer as Array Index SV.TAINTED.INJECTION Command Injection SV.TAINTED.LOOP_BOUND Use of Unvalidated Integer in Loop Condition |
| V-222613 [APSC-DV-002610] (MEDIUM): The application must remove organization-defined software components after updated versions have been installed. | |
| V-222614 [APSC-DV-002630] (MEDIUM): Security-relevant software updates and patches must be kept up to date. | |
| V-222615 [APSC-DV-002760] (MEDIUM): The application performing organization-defined security functions must verify correct operation of security functions. | |
| V-222616 [APSC-DV-002770] (MEDIUM): The application must perform verification of the correct operation of security functions: upon system startup and/or restart; upon command by a user with privileged access; and/or every 30 days. | |
| V-222617 [APSC-DV-002780] (LOW): The application must notify the ISSO and ISSM of failed security verification tests. | |
| V-222618 [APSC-DV-002870] (MEDIUM): Unsigned Category 1A mobile code must not be used in the application in accordance with DoD policy. | |
| V-222619 [APSC-DV-002880] (MEDIUM): The ISSO must ensure an account management process is implemented, verifying only authorized users can gain access to the application, and individual accounts designated as inactive, suspended, or terminated are promptly removed. | |
| V-222620 [APSC-DV-002890] (HIGH): Application web servers must be on a separate network segment from the application and database servers if it is a tiered application operating in the DoD DMZ. | |
| V-222621 [APSC-DV-002900] (MEDIUM): The ISSO must ensure application audit trails are retained for at least 1 year for applications without SAMI data, and 5 years for applications including SAMI data. | |
| V-222622 [APSC-DV-002910] (MEDIUM): The ISSO must review audit trails periodically based on system documentation recommendations or immediately upon system security events. | |
| V-222623 [APSC-DV-002920] (MEDIUM): The ISSO must report all suspected violations of IA policies in accordance with DoD information system IA procedures. | |
| V-222624 [APSC-DV-002930] (MEDIUM): The ISSO must ensure active vulnerability testing is performed. | |
| V-222625 [APSC-DV-002950] (MEDIUM): Execution flow diagrams and design documents must be created to show how deadlock and recursion issues in web services are being mitigated. |
CONC.DL Deadlock |
| V-222626 [APSC-DV-002960] (MEDIUM): The designer must ensure the application does not store configuration and control files in the same directory as user data. | |
| V-222627 [APSC-DV-002970] (MEDIUM): The ISSO must ensure if a DoD STIG or NSA guide is not available, a third-party product will be configured by following available guidance. | |
| V-222628 [APSC-DV-002980] (MEDIUM): New IP addresses, data services, and associated ports used by the application must be submitted to the appropriate approving authority for the organization, which in turn will be submitted through the DoD Ports, Protocols, and Services Management (DoD PPSM) | |
| V-222629 [APSC-DV-002990] (MEDIUM): The application must be registered with the DoD Ports and Protocols Database. | |
| V-222630 [APSC-DV-002995] (MEDIUM): The Configuration Management (CM) repository must be properly patched and STIG compliant. | |
| V-222631 [APSC-DV-003000] (MEDIUM): Access privileges to the Configuration Management (CM) repository must be reviewed every three months. | |
| V-222632 [APSC-DV-003010] (MEDIUM): A Software Configuration Management (SCM) plan describing the configuration control and change management process of application objects developed by the organization and the roles and responsibilities of the organization must be created and maintained. | |
| V-222633 [APSC-DV-003020] (MEDIUM): A Configuration Control Board (CCB) that meets at least every release cycle, for managing the Configuration Management (CM) process must be established. | |
| V-222634 [APSC-DV-003030] (MEDIUM): The application services and interfaces must be compatible with and ready for IPv6 networks. | |
| V-222635 [APSC-DV-003040] (MEDIUM): The application must not be hosted on a general purpose machine if the application is designated as critical or high availability by the ISSO. | |
| V-222636 [APSC-DV-003050] (MEDIUM): A contingency plan must exist in accordance with DOD policy based on the application's availability requirements. | |
| V-222637 [APSC-DV-003060] (MEDIUM): Recovery procedures and technical system features must exist so recovery is performed in a secure and verifiable manner. The ISSO will document circumstances inhibiting a trusted recovery. | |
| V-222638 [APSC-DV-003070] (MEDIUM): Data backup must be performed at required intervals in accordance with DoD policy. | |
| V-222639 [APSC-DV-003080] (MEDIUM): Back-up copies of the application software or source code must be stored in a fire-rated container or stored separately (offsite). | |
| V-222640 [APSC-DV-003090] (MEDIUM): Procedures must be in place to assure the appropriate physical and technical protection of the backup and restoration of the application. | |
| V-222641 [APSC-DV-003100] (MEDIUM): The application must use encryption to implement key exchange and authenticate endpoints prior to establishing a communication channel for key exchange. |
RCA Risky cryptographic algorithm used RCA.HASH.SALT.EMPTY Use of a one-way hash with an empty salt |
| V-222642 [APSC-DV-003110] (HIGH): The application must not contain embedded authentication data. |
HCC Use of hardcoded credentials HCC.PWD Use of a hardcoded password HCC.USER Use of a hardcoded user name |
| V-222643 [APSC-DV-003120] (HIGH): The application must have the capability to mark sensitive/classified output when required. | |
| V-222644 [APSC-DV-003130] (LOW): Prior to each release of the application, updates to system, or applying patches; tests plans and procedures must be created and executed. | |
| V-222645 [APSC-DV-003140] (MEDIUM): Application files must be cryptographically hashed prior to deploying to DoD operational networks. | |
| V-222646 [APSC-DV-003150] (MEDIUM): At least one tester must be designated to test for security flaws in addition to functional testing. | |
| V-222647 [APSC-DV-003160] (LOW): Test procedures must be created and at least annually executed to ensure system initialization, shutdown, and aborts are configured to verify the system remains in a secure state. | |
| V-222648 [APSC-DV-003170] (MEDIUM): An application code review must be performed on the application. |
ABV.ANY_SIZE_ARRAY Buffer Overflow - Array Index Out of Bounds ABV.GENERAL Buffer Overflow - Array Index Out of Bounds ABV.GENERAL.MULTIDIMENSION Buffer Overflow - Array Index Out of Bounds ABV.ITERATOR Buffer Overflow - Array Index may be out of Bounds ABV.MEMBER Buffer Overflow - Array Index Out of Bounds ABV.STACK Buffer Overflow - Local Array Index Out of Bounds ABV.TAINTED Buffer Overflow from Unvalidated Input ABV.UNICODE.BOUND_MAP Buffer overflow in mapping character function ABV.UNICODE.FAILED_MAP Mapping function failed ABV.UNICODE.NNTS_MAP Buffer overflow in mapping character function ABV.UNKNOWN_SIZE Buffer Overflow - Array Index Out of Bounds CL.MLK Memory Leak - in destructor CL.MLK.ASSIGN Memory Leak - in assignment operator CL.MLK.VIRTUAL Memory Leak - possible in destructor CXX.FUNC.T2OLE.LOOP Do not call T2OLE or OLE2CT within a loop CXX.SQL.INJECT SQL Injection CXX.SUSPICIOUS_INDEX_CHECK Suspicious use of index after boundary check CXX.SUSPICIOUS_INDEX_CHECK.CALL Suspicious use of index in a function call after a boundary check CXX.SUSPICIOUS_INDEX_CHECK.ZERO Suspicious use of index after index check for zero FMM.MIGHT Freeing Mismatched Memory - possible FMM.MUST Freeing Mismatched Memory INCORRECT.ALLOC_SIZE Incorrect Allocation Size INFINITE_LOOP.GLOBAL Infinite loop INFINITE_LOOP.LOCAL Infinite loop INFINITE_LOOP.MACRO Infinite loop LA_UNUSED Label unused LV_UNUSED.GEN Local variable unused MISRA.CAST.FLOAT Non-trivial float expression is cast to a wider type MISRA.CAST.FLOAT.WIDER Cast of floating point expression to a wider floating point type MISRA.CAST.FLOAT_INT Cast of floating point expression to integral type MISRA.CAST.FUNC_PTR Cast between a function pointer and a non-integral type MISRA.CAST.FUNC_PTR.2012 Conversion performed between a pointer to a function and another incompatible type MISRA.CAST.FUNC_PTR.CPP Cast converts function pointer to other pointer type MISRA.CAST.INCOMPLETE_PTR_TO_ANY.2012 Conversion performed between a pointer to an incomplete type and a different type MISRA.CAST.INT Non-trivial integer expression is cast to a wider type, or type with a different signedness MISRA.CAST.INT.SIGN Non-trivial integral expression is cast to type with different signedness MISRA.CAST.INT.WIDER Cast of integral expression to a wider integral type MISRA.CAST.INT_FLOAT Cast of integral expression to floating point type MISRA.CAST.INT_TO_PTR Object with integer type or pointer to void cast to pointer type MISRA.CAST.OBJ_PTR_TO_INT.2012 Conversion performed between a pointer to an object and an integer type MISRA.CAST.OBJ_PTR_TO_NON_INT.2012 A cast between a pointer to object and a non-integer arithmetic type MISRA.CAST.OBJ_PTR_TO_OBJ_PTR.2012 Cast between a pointer to object type and a pointer to a different object type MISRA.CAST.POLY.TYPE Cast from a polymorphic base class to a derived class MISRA.CAST.PTR Cast between a pointer to object type and a different pointer to object type MISRA.CAST.PTR.UNRELATED Object of pointer type cast to unrelated type MISRA.CAST.PTR.VRCLASS A cast form pointer to a virtual base class to pointer to a derived class does not use 'dynamic_cast' MISRA.CAST.PTR_TO_INT Cast between a pointer and an integral type MISRA.CAST.UNSIGNED_BITS The result of bitwise operation on unsigned char or short is not cast back to original type MISRA.CAST.VOID_PTR_TO_INT.2012 Cast between a pointer to void and an arithmetic type MISRA.CAST.VOID_PTR_TO_OBJ_PTR.2012 Conversion performed from a pointer to void to a pointer to an object MISRA.SIGNED_CHAR.NOT_NUMERIC 'signed char' or 'unsigned char' is used for non-numeric value MISRA.UMINUS.UNSIGNED Operand of unary minus is unsigned MLK.MIGHT Memory Leak - possible MLK.MUST Memory Leak MLK.RET.MIGHT Memory Leak - possible MLK.RET.MUST Memory Leak NNTS.MIGHT Buffer Overflow - Non-null Terminated String NNTS.MUST Buffer Overflow - Non-null Terminated String NNTS.TAINTED Unvalidated User Input Causing Buffer Overflow - Non-Null Terminated String PRECISION.LOSS Loss of Precision PRECISION.LOSS.CALL Loss of Precision during function call PRECISION.LOSS.INIT Loss of Precision during initialization RABV.CHECK Suspicious use of index before boundary check SV.FMTSTR.GENERIC Format String Vulnerability SV.FMT_STR.BAD_SCAN_FORMAT Input format specifier error SV.FMT_STR.PRINT_FORMAT_MISMATCH.BAD Incompatible type of a print function parameter SV.FMT_STR.PRINT_FORMAT_MISMATCH.UNDESIRED Unexpected type of a print function parameter SV.FMT_STR.PRINT_IMPROP_LENGTH Improper use of length modifier in a print function call SV.FMT_STR.PRINT_PARAMS_WRONGNUM.FEW Too few arguments in a print function call SV.FMT_STR.PRINT_PARAMS_WRONGNUM.MANY Too many arguments in a print function call SV.FMT_STR.UNKWN_FORMAT Unknown format specifier in a print function call SV.STRBO.BOUND_COPY.OVERFLOW Buffer Overflow in Bound String Copy SV.STRBO.BOUND_COPY.UNTERM Possible Buffer Overflow in Following String Operations SV.STRBO.BOUND_SPRINTF Buffer Overflow in Bound sprintf SV.STRBO.UNBOUND_COPY Buffer Overflow in Unbound String Copy SV.STRBO.UNBOUND_SPRINTF Buffer Overflow in Unbound sprintf SV.STR_PAR.UNDESIRED_STRING_PARAMETER Undesired String for File Path SV.TAINTED.ALLOC_SIZE Use of Unvalidated Integer in Memory Allocation SV.TAINTED.BINOP Use of Unvalidated Integer in Binary Operation SV.TAINTED.CALL.BINOP Use of Unvalidated Integer in Binary Operation SV.TAINTED.CALL.DEREF Dereference Of An Unvalidated Pointer SV.TAINTED.CALL.INDEX_ACCESS Use of Unvalidated Integer as Array Index by Function Call SV.TAINTED.CALL.LOOP_BOUND Use of Unvalidated Integer in Loop Condition through a Function Call SV.TAINTED.FMTSTR Use of Unvalidated Data in a Format String SV.TAINTED.INDEX_ACCESS Use of Unvalidated Integer as Array Index SV.TAINTED.INJECTION Command Injection SV.TAINTED.LOOP_BOUND Use of Unvalidated Integer in Loop Condition SV.TAINTED.PATH_TRAVERSAL Use of Unvalidated Data in a Path Traversal SV.TAINTED.SECURITY_DECISION Security Decision SV.TOCTOU.FILE_ACCESS Time of Creation/Time of Use Race condition in File Access SV.USAGERULES.PERMISSIONS Use of Privilege Elevation UNUSED.FUNC.GEN Function defined but not used UNUSED.FUNC.WARN Potential unused function VA_UNUSED.GEN Value is Never Used after Assignment VA_UNUSED.INIT Value is Never Used after Initialization |
| V-222649 [APSC-DV-003180] (LOW): Code coverage statistics must be maintained for each release of the application. | |
| V-222650 [APSC-DV-003190] (MEDIUM): Flaws found during a code review must be tracked in a defect tracking system. | |
| V-222651 [APSC-DV-003200] (MEDIUM): The changes to the application must be assessed for IA and accreditation impact prior to implementation. | |
| V-222652 [APSC-DV-003210] (MEDIUM): Security flaws must be fixed or addressed in the project plan. | |
| V-222653 [APSC-DV-003215] (LOW): The application development team must follow a set of coding standards. | |
| V-222654 [APSC-DV-003220] (LOW): The designer must create and update the Design Document for each release of the application. | |
| V-222655 [APSC-DV-003230] (MEDIUM): Threat models must be documented and reviewed for each application release and updated as required by design and functionality changes or when new threats are discovered. | |
| V-222656 [APSC-DV-003235] (MEDIUM): The application must not be subject to error handling vulnerabilities. |
CERT.EXIT.HANDLER_TERMINATE All exit handlers must return normally CWARN.PASSBYVALUE.EXC Exception object passed by value is too large CXX.ERRNO.INCORRECTLY_CHECKED Errno condition check not required after calling library function CXX.ERRNO.NOT_CHECKED Errno condition check is missing after calling library function CXX.ERRNO.NOT_SET Errno is not reset to zero before calling library function MISRA.CATCH.ALL No ellipsis exception handler in a try-catch block MISRA.CATCH.BY_VALUE Exception object of class type is caught by value MISRA.CATCH.NOALL Ellipsis exception handler is not the last one in a try-catch block MISRA.CATCH.WRONGORD Handler for a base exception class precedes to a handler for a derived exception class in a try-catch block MISRA.DECL.EXCPT.SPEC Function is declared with different exception specifications MISRA.THROW.EMPTY Empty throw expression does not belong to a catch block MISRA.THROW.NULL NULL is thrown explicitly MISRA.THROW.PTR Exception object is a pointer SV.INCORRECT_RESOURCE_HANDLING.URH Insecure Resource Handling SV.INCORRECT_RESOURCE_HANDLING.WRONG_STATUS Insecure Resource Handling SV.RVT.RETVAL_NOTTESTED Ignored Return Value |
| V-222657 [APSC-DV-003236] (MEDIUM): The application development team must provide an application incident response plan. | |
| V-222658 [APSC-DV-003240] (HIGH): All products must be supported by the vendor or the development team. | |
| V-222659 [APSC-DV-003250] (HIGH): The application must be decommissioned when maintenance or support is no longer available. | |
| V-222660 [APSC-DV-003260] (LOW): Procedures must be in place to notify users when an application is decommissioned. | |
| V-222661 [APSC-DV-003270] (MEDIUM): Unnecessary built-in application accounts must be disabled. | |
| V-222662 [APSC-DV-003280] (HIGH): Default passwords must be changed. |
HCC.PWD Use of a hardcoded password |
| V-222663 [APSC-DV-003285] (MEDIUM): An Application Configuration Guide must be created and included with the application. | |
| V-222664 [APSC-DV-003290] (MEDIUM): If the application contains classified data, a Security Classification Guide must exist containing data elements and their classification. | |
| V-222665 [APSC-DV-003300] (MEDIUM): The designer must ensure uncategorized or emerging mobile code is not used in applications. | |
| V-222666 [APSC-DV-003310] (MEDIUM): Production database exports must have database administration credentials and sensitive data removed before releasing the export. | |
| V-222667 [APSC-DV-003320] (MEDIUM): Protections against DoS attacks must be implemented. |
FMM.MIGHT Freeing Mismatched Memory - possible FMM.MUST Freeing Mismatched Memory INFINITE_LOOP.GLOBAL Infinite loop INFINITE_LOOP.LOCAL Infinite loop INFINITE_LOOP.MACRO Infinite loop SV.STR_PAR.UNDESIRED_STRING_PARAMETER Undesired String for File Path SV.TAINTED.ALLOC_SIZE Use of Unvalidated Integer in Memory Allocation SV.TAINTED.FMTSTR Use of Unvalidated Data in a Format String SV.TAINTED.PATH_TRAVERSAL Use of Unvalidated Data in a Path Traversal SV.TAINTED.SECURITY_DECISION Security Decision |
| V-222668 [APSC-DV-003330] (MEDIUM): The system must alert an administrator when low resource conditions are encountered. | |
| V-222669 [APSC-DV-003340] (LOW): At least one application administrator must be registered to receive update notifications, or security alerts, when automated alerts are available. | |
| V-222670 [APSC-DV-003345] (LOW): The application must provide notifications or alerts when product update and security related patches are available. | |
| V-222671 [APSC-DV-003350] (MEDIUM): Connections between the DoD enclave and the Internet or other public or commercial wide area networks must require a DMZ. | |
| V-222672 [APSC-DV-003360] (LOW): The application must generate audit records when concurrent logons from different workstations occur. | |
| V-222673 [APSC-DV-003400] (MEDIUM): The Program Manager must verify all levels of program management, designers, developers, and testers receive annual security training pertaining to their job function. | |
| V-265634 [APSC-DV-002010] (MEDIUM): The application must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. |
RCA Risky cryptographic algorithm used RCA.HASH.SALT.EMPTY Use of a one-way hash with an empty salt SV.WEAK_CRYPTO.WEAK_HASH Weak Hash Function |
Support Summary:
- 40 rules