All programming languages have constructs that are undefined, imperfectly defined, implementation-dependent, or difficult to use correctly. As a result, software programs can execute differently than intended by the writer. In some cases, these vulnerabilities can be exploited by an attacker to compromise the security of a system, or lead to unanticipated situations where safety or privacy are compromised.
ISO/IEC JTC 1/SC 22/WG 23 prepares comparative guidance spanning multiple programming languages, so that application developers will be better able to avoid the programming errors that lead to vulnerabilities in these languages and their attendant consequences. This guidance can also be used by developers to select source code processing tools that can discover and eliminate coding errors that lead to vulnerabilities. Finally the guidance can be used by the developers of the language specifications themselves to improve language design.
The project has prepared an ISO/IEC Technical Report containing guidance to users of programming languages on how to avoid the vulnerabilities that exist in the programming language selected for a particular project. The first edition of the Technical Report was published in 2010 and is available for free. Unlike many ISO/IEC documents, single-user copies are licensed at no charge.
The project is now preparing a second edition describing additional vulnerabilities and providing annexes that describe how the vulnerabilities manifest themselves in different languages.
Currently, the group enjoys the participation of representatives from many of the important programming languages and hopes to attract more. The group plans to obtain information about vulnerabilities and their treatment from initiatives such as MISRA (C and C++), the Common Weakness Enumeration dictionary, and the CERT Secure Coding Initiative.
[ Project Organization ] [ Project Status ]
The work of WG23 is supplemented by an archived mailer.
You can use Google to search this web site:
ISO/IEC JTC1/SC22 has the scope of "programming languages and their environments". WG 23 (Vulnerabilities) is a working group reporting to SC 22. It has been assigned responsibility for project 22.24772 to write an ISO/IEC Technical Report, "Programming Language Vulnerabilities." More information regarding the project can be found in our FAQ.
(All email addresses have been altered to discourage automatic harvesting of them):
Many individuals have attended meetings or participated via email. The following persons are officers of WG 23 or identified points of contact for participating organizations:
Those interested in representing their national body or participating in a national "shadow group" should contact the standards body of the nation in which they reside or work. In the case of the following nations, a point of contact has been identified. (All email addresses have been altered to discourage automatic harvesting of them):
SC22 Secretariat announced balloting results, assigned project number and directed OWG:Vulnerability to begin work [N0002]:
Please note that this project has been assigned the ISO/IEC designation "24772". The OWG: Vulnerabilities is instructed to begin work on this project and prepare a disposition of comments for those National Body comments received on the SC 22 ballot.
The work of the study group leading to creation of the OWGV and, ultimately, WG 23, is summarized on the History page.
The web site is maintained for the convenience of the participants in SC 22/WG 23 by: