| By definition, mobile code is software obtained from remote systems outside the enclave boundary, transferred across a network, and then downloaded and executed on a local system without explicit installation or execution by the recipient.
For a complete list of mobile code categorizations, refer to the overview document included with this STIG.
Categorized mobile code includes but is not limited to:
- ActiveX
- Windows Scripting Host when used as mobile code
- Unix Shell Scripts when used as mobile code
- DOS batch scripts when used as mobile code
- Java applets and other Java mobile code
- Visual Basic for Applications (VBA)
- LotusScript
- PerfectScript
- Postscript
- JavaScript (including Jscript and ECMAScript variants)
- VBScript
- Portable Document Format (PDF)
- Shockwave/Flash
- Rich Internet Applications
The following technologies are not currently designated as mobile code:
- XML
- SMIL
- QuickTime
- VRML (exclusive of any associated Java applets or JavaScript scripts)
The following are outside the scope of the mobile code requirements:
- Scripts and applets embedded in or linked to web pages and executed in the context of the web server. Examples of this are Java servlets, Java Server pages, CGI, Active Server Pages, CFML, PHP, SSI, server-side JavaScript, server-side LotusScript.
- Local programs and command scripts
- Distributed object-oriented programming systems (e.g., CORBA, DCOM).
- Software patches, updates, including self-extracting updates - software updates that must be invoked explicitly by the user are outside the mobile code policy. Examples of technologies in this area include: Netscape SmartUpdate, Microsoft Windows Update, Netscape web browser plug-ins and Linux.
If other types of mobile code technologies are present that are not listed here, a written waiver must be granted by the CIO (allowing use of emerging mobile code technology). Also uncategorized mobile code must be submitted for AO approval. |
