CWE一覧に戻る
CWE-1269

非リリース構成でリリースされた製品

Product Released in Non-Release Configuration
脆弱性 作成中
JA

市場にリリースされる製品は、プリプロダクションまたは製造形態でリリースされる。

生産前または製造段階の製品は、多くのデバッグ・フックとデバッグ機能を持つように構成されている:

上記は決して網羅的なリストではありませんが、生産前または製造段階の製品がより大きな能力を持ち、より脆弱な状態にあることを示唆しています。

最終的な製造バージョンの前に、複数の関係者がテストの実行に関与する場合、複雑さが増す。例えば、チップメーカーがチップを製造し、独自の製造前テストを実施した後、そのチップは相手先商標製品製造業者(OEM)に引き渡され、OEMは同じチップに対して2回目の異なる製造前テストを実施する。これら両方の活動が完了して初めて、全体的な製造段階が「完了」と呼ばれ、「製造完了」のヒューズが切れる。しかし、OEMが「製造完了」のヒューズを切り忘れた場合、システムは製造段階に留まり、システムは露出して脆弱になる。

EN

The product released to market is released in pre-production or manufacturing configuration.

Products in the pre-production or manufacturing stages are configured to have many debug hooks and debug capabilities, including but not limited to:

The above is by no means an exhaustive list, but it alludes to the greater capability and the greater state of vulnerability of a product during it's preproduction or manufacturing state.

Complexity increases when multiple parties are involved in executing the tests before the final production version. For example, a chipmaker might fabricate a chip and run its own preproduction tests, following which the chip would be delivered to the Original Equipment Manufacturer (OEM), who would now run a second set of different preproduction tests on the same chip. Only after both of these sets of activities are complete, can the overall manufacturing phase be called "complete" and have the "Manufacturing Complete" fuse blown. However, if the OEM forgets to blow the Manufacturing Complete fuse, then the system remains in the manufacturing stage, rendering the system both exposed and vulnerable.

Scope: Confidentiality, Integrity, Availability, Access Control, Accountability, Authentication, Authorization, Non-Repudiation / Impact: Other
Ensure that there exists a marker for denoting the Manufacturing Complete stage and that the Manufacturing Complete marker gets updated at the Manufacturing Complete stage (i.e., the Manufacturing Complete fuse gets blown).
Ensure that there exists a marker for denoting the Manufacturing Complete stage and that the Manufacturing Complete marker gets updated at the Manufacturing Complete stage (i.e., the Manufacturing Complete fuse gets blown).
Ensure that there exists a marker for denoting the Manufacturing Complete stage and that the Manufacturing Complete marker gets updated at the Manufacturing Complete stage (i.e., the Manufacturing Complete fuse gets blown).
MITRE公式ページ — CWE-1269