hand may be tedious and error-prone. Portable cross-language signatures will require detailed understanding of both languages, which a programmer may lack. Integrating two or more programming languages into a single executable relies upon knowing how to interface the function calls, argument list and global data structures so the symbols match in the object code during linking. Byte alignment can be a source of data corruption if memory boundaries between the programming languages are different. Each language may also structure data differently. 6.46.2 Cross reference MISRA C 2012: 1.1 MISRA C++ 2008: 1-0-2 6.46.3 Mechanism of failure When the library and the application in which it is to be used are written in different languages, the specification of signatures is complicated by inter-language issues. As used in this vulnerability description, the term library includes the interface to the operating system, may be specified only for the language used to code the operating system itself. In this case, any program written in any other language faces the inter-language interoperability issue of creating a fully-functional signature. When the application language and the library language are different, then the ability to specify signatures according to either standard may not exist, or be very difficult. Thus, a translator-by-translator solution may be needed, which maximizes the probability of incorrect signatures (since the solution must be recreated for each translator pair). Incorrect signatures may or may not be caught during the linking phase. 6.46.4 Applicable language characteristics This vulnerability description is intended to be applicable to languages with the following characteristics: Languages that do not specify how to describe signatures for subprograms written in other languages. 6.46.5 Avoiding the vulnerability or mitigating its effects Software developers can avoid the vulnerability or mitigate its ill effects in the following ways: Use tools to create the signatures. Avoid using translator options or language features to reference library subprograms without proper signatures. 6.46.6 Implications for standardization In future standardization activities, the following items should be considered:
7.<y> Language specific Vulnerabilities for [language] [This section is where vulnerabilities not covered by TR 24772-1 will be placed]. It is possible that there are none for any given language. 8 Implications for standardization [This section provides the opportunity to discuss changes anticipated for future versions of the language specification. The section may be left empty] Index Ada, 13, 59, 63, 73, 76 AMV – Type-breaking Reinterpretation of Data, 72 API Application Programming Interface, 16 APL, 48 Apple OS X, 120 application vulnerabilities, 9 Application Vulnerabilities Adherence to Least Privilege [XYN], 113 Authentication Logic Error [XZO], 135 Cross-site Scripting [XYT], 125 Discrepancy Information Leak [XZL], 129 Distinguished Values in Data Types [KLK], 112 Download of Code Without Integrity Check [DLB], 137 Executing or Loading Untrusted Code [XYS], 116 Hard-coded Password [XYP], 136 Improper Restriction of Excessive Authentication Attempts [WPL], 140 Improperly Verified Signature [XZR], 128 Inclusion of Functionality from Untrusted Control Sphere [DHU], 139 Incorrect Authorization [BJE], 138 Injection [RST], 122 Insufficiently Protected Credentials [XYM], 133 Memory Locking [XZX], 117 Missing or Inconsistent Access Control [XZN], 134 Missing Required Cryptographic Step [XZS], 133 Path Traversal [EWR], 130 Privilege Sandbox Issues [XYO], 114 Resource Exhaustion [XZP], 118 Resource [HTS], 120 Sensitive Information Uncleared Before Use [XZK], 130 Unquoted Search Path or Element [XZQ], 127 Unrestricted File Upload [CBF], 119 Unspecified Functionality [BVQ], 111 URL Redirection to Untrusted Site ('Open Redirect') [PYQ], 140 Use of a One-Way Hash without a Salt [MVX], 141 application vulnerability, 5 Ariane 5, 21 bitwise operators, 48 BJE – Incorrect Authorization, 138 BJL – Namespace Issues, 43 black-list, 120, 124 BQF – Unspecified Behaviour, 92, 94, 95 break, 60 BRS – Obscure Language Features, 91
XZH – Off-by-one Error, 58 XZI – Sign Extension 36 XZK – Senitive Information Uncleared Before Use, 130 XZL – Discrepancy Information Leak, 129 XZN – Missing or Inconsistent Access Control, 134 XZO – Authentication Logic Error, 135 XZP – Resource Exhaustion, 118 XZQ – Unquoted Search Path or Element, 127 XZR – Improperly Verified Signature, 128 XZS – Missing Required Cryptographic Step, 133 XZX – Memory Locking, 117 YOW – Identifier Name Reuse, 41, 44 YZS – Unused Variable, 39, 40