| V-4488 | High | The DNS software does not log, at a minimum, success and failure of starting and stopping of the name server service daemon, zone transfers, zone update notifications, and dynamic updates. | Logging must be comprehensive to be useful for both intrusion monitoring and security investigations. Setting logging at the severity notice should capture most relevant events without requiring... |
| V-4481 | High | Dynamic updates are not cryptographically authenticated. | The dynamic update capability has considerable appeal in an environment in which IP addresses change so frequently that it would be unacceptably burdensome or expensive to dedicate the time of a... |
| V-4482 | High | The DNS software administrator will configure each master/slave server supporting a zone to cryptographically authenticate zone transfers. | A slave updates its zone information by requesting a zone transfer from its master. In this transaction, the risk for the slave is that the response to its request is not in fact from its... |
| V-4491 | High | Valid root name servers do not appear in the local root zone file. G and H root servers, at a minimum, do not appear in the local root zone files. | All caching name servers must be authoritative for the root zone because without this starting point, they would have no knowledge of the DNS infrastructure and thus would be unable to respond to... |
| V-4470 | High | The DNS database administrator has not ensured each NS record in a zone file points to an active name server authoritative for the domain specified in that record. | Poorly constructed NS records pose a security risk because they create conditions under which an adversary might be able to provide the missing authoritative name services that are improperly... |
| V-14766 | High | The DNSSEC private key file is not owned by the DNS administrator or the permissions are not set to a minimum of 600. | The private keys in the KSK and ZSK key pairs should be protected from unauthorized access. If possible, the private keys should be stored offline (with respect to the DNSSEC-aware name server) in... |
| V-3618 | Medium | A UNIX or UNIX-based name server is running unnecessary daemon/services and/or is configured to start an unnecessary daemon, service, or program upon boot up. | Unnecessary software running on a name server could introduce security vulnerabilities that would be avoided if it were not present. |
| V-14758 | Medium | The DNS software administrator will ensure the named.conf options statement does not include the option "listen-on-v6 { any; };” when an IPv6 interface is not configured and enabled. | To prevent the possibility of a denial of service in relation to an IPv4 DNS server trying to respond to an IPv6 request, the server should be configured not to listen on any of its IPv6... |
| V-4489 | Medium | The DNS software administrator has not configured the DNS software to send all log data to either the system logging facility (e.g., UNIX syslog or Windows Application Event Log) or an alternative logging facility with security configuration equivalent to or more restrictive than the system logging facility. | On name servers, DNS log data is typically more sensitive than system log data and, consequently, should benefit from security controls at least as restrictive as those for the system logging... |
| V-4480 | Medium | A cryptographic key used to secure DNS transactions has been utilized on a name server for more than one year. | Keys are more likely to be compromised if they remain in use for over a year. |
| V-4483 | Medium | A zone master server does not limit zone transfers to a list of active slave name servers authoritative for that zone. | The risk to the master in this situation, is that it would honor a request from a host that is not an authorized slave, but rather an adversary seeking information about the zone. To protect... |
| V-4485 | Medium | A name server is not configured to only accept notifications of zone changes from a host authoritative for that zone. | A slave updates its zone information by requesting a zone transfer from its master. In this transaction, the risk for the slave is that the response to its request is not in fact from its... |
| V-4487 | Medium | A caching name server does not restrict recursive queries to only the IP addresses and IP address ranges of known supported clients. | Any host that can query a resolving name server has the potential to poison the servers name cache or take advantage of other vulnerabilities that may be accessed through the query service. The... |
| V-4486 | Medium | Recursion is not prohibited on an authoritative name server. | A potential vulnerability of DNS is that an attacker can poison a name server's cache by sending queries that will cause the server to obtain host-to-IP address mappings from bogus name servers... |
| V-24997 | Medium | All DNS caching resolvers (A/K/A “recursive name servers”) will have port and Query ID randomization enabled for all DNS querypackets/frames. | DNS queries are normally conducted over UDP for performance reasons, although the protocol will fall back to TCP in certain cases. Unfortunately, the lack of a true bi-directional connection in... |
| V-39138 | Medium | DNSSEC is not enabled for verifying signed files between names servers with DNSSEC capabilities. | A powerful feature of DNSSEC is the ability to sign record sets to ensure their integrity and authenticity throughout the DNS infrastructure and not just between the authoritative name server and... |
| V-3624 | Medium | The appropriate encryption software is not correctly installed and configured on Windows ISC BIND name servers and it is required that in-band remote management be performed from hosts outside the enclave in which the name server resides. | In administrative network traffic is in the clear between external clients and name servers, then there is significant potential that authorized individuals can intercept and view that traffic,... |
| V-3626 | Medium | The ownership and permissions on all Windows ISC BIND name servers are not as restrictive as required. | Weak permissions could allow an intruder to view or modify zone, configuration and/or program files. |
| V-3620 | Medium | Permissions on critical UNIX name server files are not as restrictive as required. | Weak permissions could allow an intruder to view or modify zone, configuration and/or program files. |
| V-3621 | Medium | ISC BIND is not configured to run as a dedicated non-privileged service user account. | If an intruder gains control of named (BIND), then the intruder will acquire the privileges of the user ID under which it runs. Running as a non-privileged user account limits the extent of any... |
| V-12774 | Medium | The forwarding configuration of DNS servers allows the forwarding of queries to servers controlled by organizations outside of the U.S. Government. | A side-effect of forwarding is that if the link between the forwarding server and the server to
which queries are being forwarded is broken, DNS resolution will not work for the domain or
domains... |
| V-4478 | Medium | The name server’s IP address is NOT statically defined and configured locally on the server. The name server has a DHCP address. | Static IP addresses permit a machine to offer Internet services like web, ftp, DNS, and email. Because a specific, known address is associated with your connection, other machines on the Internet... |
| V-4479 | Medium | An integrity checking tool is not installed or not monitoring for modifications to the root.hints and named.conf files.
| An integrity checking tool compares file and directory integrity to the baseline. It can alert the system administrator to unauthorized changes in files or directories. Unauthorized changes in... |
| V-4473 | Medium | DNS software does not run on dedicated (running only those services required for DNS) hardware. The only currently accepted exception of this requirement is Windows 2000/2003 DNS, which must run on a domain controller that is integrated with Active Directory services.
| Even a securely configured operating system is vulnerable to the flaws of the programs that run on it. To prevent DNS software from being subjected to the vulnerabilities of other programs and... |
| V-4511 | Medium | A BIND name server is not configured to accept control messages only when the control messages are cryptographically authenticated and sent from an explicitly defined list of DNS administrator workstations. | The controls statement and the associated use of the rndc or ndc commands introduces the risk that an adversary could use them to remotely control the name server without having to authenticate to... |
| V-14767 | Medium | DNSSEC is not enabled for signing files between names servers with DNSSEC capabilities. | A powerful feature of DNSSEC is the ability to sign record sets to ensure their integrity and authenticity throughout the DNS infrastructure and not just between the authoritative name server and... |
| V-4475 | Medium | Permissions on files containing DNS encryption keys are inadequate. | Weak permissions could allow an intruder to view or modify DNS encryption key files. These keys should never be readable by Other or Everyone. |
| V-4476 | Medium | Users and/or processes other than the DNS software Process ID (PID) and/or the DNS database administrator have edit/write access to the zone database files. | Weak permissions on key files could allow an intruder to view or modify DNS zone files. Permissions on these files will be 640 or more restrictive. |
| V-12966 | Medium | Inadequate file permissions on BIND name servers. | Weak permissions could allow an intruder to view or modify zone, configuration and/or program files. |
| V-4477 | Medium | Users or processes other than the DNS software administrator and the DNS software PID have read access to the DNS software configuration files and/or users other than the DNS software administrator have write access to these files. | Weak permissions on key DNS configuration files could allow an intruder to view or modify DNS name server configuration files. |
| V-4494 | Medium | A TSIG key is not in its own dedicated file. | Ideally, nobody even DNS and Systems Administrators should view the key. If it is included in named.conf, they will view it on a regular basis, which means computer forensics is less likely to... |
| V-4495 | Medium | A unique TSIG key is not utilized for communication between name servers sharing zone information. | If a secret key shared between two servers is not unique, then any breach of the key is not limited to those two servers. In particular, if all servers in a zone share the same key, then there is... |
| V-3619 | Low | It is possible to obtain a command shell by logging on to the DNS user account. | If an intruder gains access to a command shell, the intruder may be able to execute unauthorized commands. |
| V-14756 | Low | The DNS administrator will ensure non-routeable IPv6 link-local scope addresses are not configured in any zone. Such addresses begin with the prefixes of “FE8”, “FE9”, “FEA”, or “FEB”. | IPv6 link local scope addresses are not globally routable and must not be configured in any DNS zone. Similar to RFC1918, addresses, if a link-local scope address is inserted into a zone provided... |
| V-3617 | Low | BIND is not configured to run as a dedicated non-privileged user account. BIND is running as a root user. | If an intruder gains control of named (BIND), the intruder will acquire the privileges of the user ID under which it runs. Running as a non-privileged user account limits the extent of any... |
| V-12440 | Low | A unique TSIG key is not generated and utilized for each type of transaction. | To enable zone transfer (requests and responses) through authenticated messages, it is necessary to generate a key for every pair of name servers. The key also can be used for securing other... |
| V-3622 | Low | The ISC BIND service user is a member of a group other than Everyone and Authenticated Users. | Membership in configurable groups gives the BIND service user unnecessary privileges that could be used by an intruder to further breach name server security. |
| V-3623 | Low | The ISC BIND service does not have the appropriate user rights required for the proper configuration and security of ISC BIND. | Having user rights beyond the minimum necessary gives the BIND service user unnecessary privileges that could be used by an intruder to further breach name server security. |
| V-14764 | Low | The DNSSEC zone signing key size is not at least 1024 bits. | As far as the choice of key size for the ZSK is concerned, performance certainly will be a factor because the ZSK is used for signing all RRsets in the zone. In terms of impact, however, it is... |
| V-14765 | Low | The DNSSEC zone signing key minimum roll over period is not at least 60 days. | In the case of ZSK, the risk of key guessing is higher because of larger key exposure. The larger key exposure is a result of the fact that the number of signature sets generated is very large... |
| V-14762 | Low | The DNSSEC key signing key does not have a minimum roll over period of one year. | A good practice is to generate an extra set of key signing keys for rollover purposes. The additional key will be readily available for emergency situations such as key compromise. The key... |
| V-14761 | Low | The DNSSEC key signing key is not at least 2048 bits. | The choice of key size is a tradeoff between the risk of key compromise and performance. The performance variables are signature generation and verification times. The size of the DNS response... |
| V-12967 | Low | The SA has not configured BIND in a chroot(ed) directory structure. | With any network service, there is the potential that an attacker can exploit a vulnerability within the program that allows the attacker to gain control of the process and even run system... |
| V-14757 | Low | AAAA addresses are configured on a host that is not IPv6 aware. | DNS is only responsible for resolving a domain name to an ip address. Applications and operating systems are responsible for processing the IPv6 or IPv4 record that may be returned. With this in... |
| V-4492 | Low | The DNS software administrator has not removed the root hints file on an authoritative name server in order for it to resolve only those records for which it is authoritative, and ensure that all other queries are refused. | A potential vulnerability of DNS is that an attacker can poison a name servers cache by sending queries that will cause the server to obtain host-to-IP address mappings from bogus name servers... |
| V-4493 | Low | The DNS software administrator has not utilized at least 160 bit HMAC-SHA1 keys if available. | SHA-1 is the algorithm currently specified in the National Institute of Standards and Technology's (NISTs) Secure Hashing Standard (FIPS 180-1) and required throughout DoD. HMAC-MD5 will be... |
| V-4490 | Low | Entries in the name server logs do not contain timestamps and severity information. | Forensic analysis of security incidents and day-to-day monitoring are substantially more difficult if there are no timestamps on log entries. |
| V-4467 | Low | Record owners will validate their zones no less than annually. The DNS database administrator will remove all zone records that have not been validated in over a year. | If zone information has not been validated in over a year, then there is no assurance that it is still valid. If invalid records are in a zone, then an adversary could potentially use their... |
| V-14760 | Low | The DNSSEC algorithm for digital signatures is not RSASHA1. | Due to its wide availability and performance, RSASHA1 is the preferred algorithm for zone signatures. |
| V-14759 | Low | The DNS administrator, when implementing DNSSEC, will create and maintain separate key-pairs for key signing and zone signing. | DNSSEC specifies generation and verification of digital signatures using asymmetric keys. This requires generation of a public key-private key pair. Although the DNSSEC specification does not call... |
| V-4469 | Low | Zone-spanning CNAME records, that point to a zone with lesser security, are active for more than six months. | The use of CNAME records for exercises, tests or zone-spanning aliases should be temporary (e.g., to facilitate a migration). When a host name is an alias for a record in another zone, an... |
| V-4468 | Low | Resource records for a host in a zone file are included and their fully qualified domain name resides in another zone. The exception is a glue record or CNAME record supporting a system migration. | If a name server were able to claim authority for a resource record in a domain for which it was not authoritative, this would pose a security risk. In this environment, an adversary could use... |
