OpenControls Logo

STIG Viewer

STIGViewer Support

Unsigned Category 1A mobile code must not be used in the application in accordance with DoD policy.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-222618APSC-DV-002870SV-222618r961083_ruleCCI-001166medium
Description
Use of un-trusted Level 1A mobile code technologies can introduce security vulnerabilities and malicious code into the client system. 1A code is defined as: - ActiveX controls - Mobile code script (JavaScript, VBScript) - Windows Scripting Host (WSH) (downloaded via URL or email) When JavaScript and VBScript execute within the browser they are Category 3, however, when they execute in WSH, they are 1A.
STIGDate
Application Security and Development Security Technical Implementation Guide2025-09-09

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

END-10Mobile Code
0.50
VPM-02Vulnerability Remediation Process
0.50
VPM-04Continuous Vulnerability Remediation Activities
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (19) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AC-3Access Enforcement
1.00
AC-6(10)Prohibit Non-privileged Users from Executing Privileged Functions
1.00
AC-6(8)Privilege Levels for Code Execution
1.00
CM-5(6)Limit Library Privileges
1.00
CM-7(2)Prevent Program Execution
1.00
IA-5(1)Password-based Authentication
1.00
IA-7Cryptographic Module Authentication
1.00
SC-12(3)Asymmetric Keys
1.00
SC-13Cryptographic Protection
1.00

+9 more (top 10 by confidence shown)

CCI1 mapping
CCI-001166
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

ID.RA-08
0.50
PR.PS-02
0.50

Details

Check Text (C-222618r961083_chk)

Review the application documentation and interview the application administrator to identify any mobile code that is provided by the application for client consumption. If the application does not contain mobile code, or if the mobile code executes within the client browser, this is not applicable. The URL of the application must be added to the Trusted Sites zone. This is accomplished via the Tools, Internet Options, and “Security” Tab. Select the “Trusted Sites” zone. Click the “sites” button. Enter the URL into the text box below the “Add this site to this zone” message. Click "Add”. Click “OK”. Note: This requires administrator privileges to add URL to sites on a STIG compliant workstation. Next, test the application. This testing should include functional testing from all major components of the application. If mobile code is in use, the browser will prompt to download the control. At the download prompt, the browser will indicate that code has been digitally signed. If the code has not been signed or the application warns that a control cannot be invoked due to security settings, this is a finding.

Fix Text (F-24277r493763_fix)

Configure the application so Category 1A mobile code is signed.