I am in the process of writing up a vulnerability report for a thick client application. One of the findings for the executable is ASLR being disabled. As part of reporting, I'm required to provide a CWE to the client that best describes the vulnerability. I can't seem to find a strong CWE that describes ASLR being disabled.
Some of my co-workers have used http://cwe.mitre.org/data/definitions/119.html but that is just wrong, as that CWE does not describe anything along the lines of the randomization that ASLR tries to perform.
What CWE have people used in the past?
Thanks in advanced.