ISO/IEC JTC 1/SC 22/WG 23/N 0432
Draft Minutes: Meeting #24
ISO/IEC JTC 1/SC 22/WG 23: Programming Language Vulnerabilities
12-14 December 2012

Meeting Times:

Three hours each day, starting at 17:00 Germany, 16:00 UK, 11:00 US-east coast, 8:00 US-west coast, 6:00 US-Hawaii, and 1:00 Japan

12 December 2012: 08:00 am to 11:00 am (US-west coast)
13 December 2012: 08:00 am to 11:00 am (US-west coast)
14 December 2012: 08:00 am to 11:00 am (US-west coast)

Meeting Location:

This is a web/teleconference only meeting

Teleconference information:

Topic: WG 23 Meeting #24
Date: Every 1 day, from Wednesday, December 12, 2012 to Friday, December 14, 2012
Time:

17:00 Germany

16:00 United Kingdom

11:00 New York

08:00 California

06:00 Hawaii

01:00 Japan

Meeting Number: 951 970 652
Meeting Password: wg23

To start or join the online meeting, go to iso_meetings

To receive a call back, provide your phone number when you join the meeting, or call the number below and enter the access code.

Switzerland toll free: 0800-894627
USA/Canada toll free: 1-855-299-5224

Having trouble dialing in? Try these backup numbers:

Call-in toll-free number (UK): 0800-051-3810
Call-in toll number (UK): +44-20-310-64804
Global call-in numbers: iso_meetings call-in numbers
Toll-free dialing restrictions: toll-free restrictions

Access code: 951 970 652

For assistance:

1. Go to iso_meetings support
2. On the left navigation bar, click "Support".
To add this meeting to your calendar program (for example Microsoft Outlook), click this link: iso_meetings to calendar

Agenda

1. Opening activities

1.1 Opening Comments

1.2 Introduction of Participants/Roll Call

John Benito - Convener

Larry Wagoner- US

David Keaton - US, HoD

Tom Plum - US

Erhard Ploedereder - WG 9

Clive Pygott - UK, HoD

Kazuyoshi Korosue - Japan

Tatsuaki Takebe - Japan, HoD

Stephen Michell - Canada, HoD

1.3 Procedures for this Meeting

The normal procedures for teleconferences will be use.

1.4 Approval of previous Minutes [N 0420]

1.5 Review of actions items and resolutions, Action Item and Decision Logs

23-01 — Remains Open, WG 21 will meet in June of 2014, this AI will be reworded to match the WG 21 schedule. WG 21 will meet 16-21 June 2014

23-02 — Remains Open

23-03 — Closed

23-04 — Closed

22-02 — Closed

22-03 — Remains Open

22-12 — Remains Open

1.6 Approval of Agenda [N 0430]

1.7 Future Meeting Schedule

2013
WG23 #28	2013-12	Web conference	—
WG23 #27	2013-09	Tokyo, Japan	WG23 meeting co-located with SC22 plenary meeting.	It was reported by Tatsuaki Takebe that the meeting is to be held in Toyko, the hotel recommended would be the Shiba Park Hotel. Dates for Plenary are 17-18, WG 23 19-21 of Sept 2013
WG23 #26	2013-06	Berlin, DE	Co-located with WG 9, Ada Europe
WG23 #25	2013-03-13/15	New York, USA - ANSI	See [N0374]

2. Reports on Liaison Activities

2.1 SC 22

ISO is conducting a trial to evaluate if the CD stage is necessary, JTC 1 has chosen not to participate.

2.2 PL22.3/WG5 (Fortran)

WG 5 has an internal ballot running on their language specific annex, should let us know in the next month or so on when we can expect a contribution.

2.3 PL22.4/WG4 (COBOL)

No report

2.4 WG9 (Ada)

Ada has a new Standard, used a new process that allowed WG 9 to complete the process in 9 months.

2.5 PL22.11/WG14 (C)

WG 14 had a meeting in October in Portland

An editorial meeting is scheduled for 17-18 of December for final comments before PDTS ballot on the working draft of 17961

A new work item proposal for the C binding to IEC 60559:2012 is currently in ballot

2.6 PL22.16/WG21 (C++)

No report

2.7 Ecma International, TC49/TG2 (C#)

No report

2.8 Ecma International, TC39 (ECMAScript)

No report

2.9 MISRA (C)

Still moving through the publication process, looking a first quarter of 2013 to publish.

2.10 MISRA (C++)

No report

2.11 SPARK

No report, the current liaison is no longer active, Erhard took an AI to locate another point of contact or liaison for the SPARK effort.

2.12 SC7/WG19 (UML)

No report

2.13 Other Liaison Activities or National body reports

None

3. Document Review

NOTE: The DTR ballot will still be active, this meeting will be used to review documents not related to the 2nd edition of TR 24772.

• Proposed New Vulnerabilities – [N 0429]

  12-Dec-12

  Comments were collected by Benito, will be incorporated into a working draft that will be reviewed on the 13^th

  • 7.Z invokes should be invoke, and 7.Z.3 needs to be worded to make "host server" a little clearer
  • 7.Y, is inefficient part of the CWE description, and if not should we remove it
  • 7.U is better suited for 6. Programming Language Vulnerabilities
  • 7.U is very C specific, might be better is the vulnerability was written in more generic terms
  • 7.V some discussion on what a trusted location was, no consensus on words
  • Discussion on if 7.T is also a better candidate for 6, Tom to check if C++ is working on a Hash Library

  13-Dec-12

  Reviewed the revised edition furnished by Benito, agreed to add the text furnished by Clive

  • 7.Z.1 Some applications download source code or executables from a remote, and implicitly trusted, location (such as the application author) and use the source code or invokes the executables without sufficiently verifying the integrity of the downloaded files.
  • 7.X.1 The software imports, requires, or includes executable functionality (such as a library) from a source that is unknown to the user, unexpected or otherwise untrusted ...

• Revised Working draft 17960, Code Signing for Source Code

12-Dec-12

Comments were collected by Wagoner, will be incorporated into a working draft that will be reviewed on the 13^th, along with comments that were furnished by Clive earlier

• Some discussion about the use of may, should and others. Need to review document and revise document to match ISO requirements on the use of such words.
• Discussion on the definitions on clause 3, should have a reference.
• Use of the word format seems incorrect, Larry will reword.
• Erhard to send Larry some editorial issues.

13-Dec-12

Reviewed the revised edition furnished by Larry

• Verified all comments furnished by Erhard had been incorporated into the review text.
• Takebe looked up the correct reference that should be used in 6.1 paragraph 3 — ISO/IEC 10118-3:2004
• A liaison with SC 22/WG 2 would be beneficial to this effort. We have no one identified currently.
• Formed a small editorial committee to check the next version of the working draft, if editorial committee believes draft is ready they should ask the convener to forward to ISO for ballot.

Editorial Committee:

Convener

Tom Plum

Kazuyoshi Korosue

Stephen Michell

Clive Pygott

4. Other Business

4.1 Promotion of WG23 Products, Steve Michell, per Action Item #21-6

The Convener reported that a link to the freely available TR 24772:2010 is on the MITRE Making Security Measurable at MSM reference.

We still need to work on making the freely available document visible.

5. Resolutions

6. Adjournment