Every NS record in a zone file on a BIND 9.x server must point to an active name server and that name server must be authoritative for the domain specified in that record.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-72505	BIND-9X-001611	SV-87129r1_rule		Medium

Description
Poorly constructed NS records pose a security risk because they create conditions under which an adversary might be able to provide the missing authoritative name services that are improperly specified in the zone file. The adversary could issue bogus responses to queries that clients would accept because they learned of the adversary's name server from a valid authoritative name server, one that need not be compromised for this attack to be successful. The list of slave servers must remain current within 72 hours of any changes to the zone architecture that would affect the list of slaves. If a slave server has been retired or is not operational but remains on the list, then an adversary might have a greater opportunity to impersonate that slave without detection, rather than if the slave were actually online. For example, the adversary may be able to spoof the retired slave's IP address without an IP address conflict, which would not be likely to occur if the true slave were active.

Description

Poorly constructed NS records pose a security risk because they create conditions under which an adversary might be able to provide the missing authoritative name services that are improperly specified in the zone file. The adversary could issue bogus responses to queries that clients would accept because they learned of the adversary's name server from a valid authoritative name server, one that need not be compromised for this attack to be successful. The list of slave servers must remain current within 72 hours of any changes to the zone architecture that would affect the list of slaves. If a slave server has been retired or is not operational but remains on the list, then an adversary might have a greater opportunity to impersonate that slave without detection, rather than if the slave were actually online. For example, the adversary may be able to spoof the retired slave's IP address without an IP address conflict, which would not be likely to occur if the true slave were active.

STIG	Date
BIND 9.x Security Technical Implementation Guide	2018-01-02

Details

Check Text ( C-72707r1_chk )
Verify that each name server listed on the BIND 9.x server is authoritative for the domain it supports. Inspect the "named.conf" file and identify all of the zone files that the BIND 9.x server is using. zone "example.com" { file "zone_file"; }; Inspect each zone file and identify each NS record listed. 86400 NS ns1.example.com 86400 NS ns2.example.com With the assistance of the DNS Administrator, verify that each name server listed is authoritative for that domain. If there are name servers listed in the zone file that are not authoritative for the specified domain, this is a finding.

Check Text ( C-72707r1_chk )

Verify that each name server listed on the BIND 9.x server is authoritative for the domain it supports.

Inspect the "named.conf" file and identify all of the zone files that the BIND 9.x server is using.

zone "example.com" {
file "zone_file";
};

Inspect each zone file and identify each NS record listed.

86400 NS ns1.example.com
86400 NS ns2.example.com

With the assistance of the DNS Administrator, verify that each name server listed is authoritative for that domain.

If there are name servers listed in the zone file that are not authoritative for the specified domain, this is a finding.

Fix Text (F-78861r1_fix)
Edit the zone file(s). Remove any name server that the BIND 9.x server is not authoritative for. Restart the BIND 9.x process.