Check: SRG-APP-000516-DNS-000103
Domain Name System (DNS) SRG:
SRG-APP-000516-DNS-000103
(in versions v3 r2 through v2 r4)
Title
The DNS name server software must be at the latest version. (Cat II impact)
Discussion
Each newer version of the name server software, especially the BIND software, generally is devoid of vulnerabilities found in earlier versions because it has design changes incorporated to take care of those vulnerabilities. These vulnerabilities have been exploited (i.e., some form of attack was launched), and sufficient information has been generated with respect to the nature of those exploits. It makes good business sense to run the latest version of name server software because theoretically it is the safest version. Even if the software is the latest version, it is not safe to run it in default mode. The security administrator should always configure the software to run in the recommended secure mode of operation after becoming familiar with the new security settings for the latest version.
Check Content
Review the DNS implementation to determine the name server software version. If the installed name server software version is not the latest production version, this is a finding.
Fix Text
Update the installed name server software with the latest production version.
Additional Identifiers
Rule ID: SV-205244r879887_rule
Vulnerability ID: V-205244
Group Title: SRG-APP-000516
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000366 |
The organization implements the security configuration settings. |
Controls
Number | Title |
---|---|
CM-6 |
Configuration Settings |