The DNS name server software must be at the latest version.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-215592	WDNS-CM-000023	SV-215592r561297_rule		Medium

Description
Each newer version of the name server software, especially the BIND software, generally is devoid of vulnerabilities found in earlier versions because it has design changes incorporated to take care of those vulnerabilities. These vulnerabilities have been exploited (i.e., some form of attack was launched), and sufficient information has been generated with respect to the nature of those exploits. It makes good business sense to run the latest version of name server software because theoretically it is the safest version. Even if the software is the latest version, it is not safe to run it in default mode. The security administrator should always configure the software to run in the recommended secure mode of operation after becoming familiar with the new security settings for the latest version.

Description

Each newer version of the name server software, especially the BIND software, generally is devoid of vulnerabilities found in earlier versions because it has design changes incorporated to take care of those vulnerabilities. These vulnerabilities have been exploited (i.e., some form of attack was launched), and sufficient information has been generated with respect to the nature of those exploits. It makes good business sense to run the latest version of name server software because theoretically it is the safest version. Even if the software is the latest version, it is not safe to run it in default mode. The security administrator should always configure the software to run in the recommended secure mode of operation after becoming familiar with the new security settings for the latest version.

STIG	Date
Microsoft Windows 2012 Server Domain Name System Security Technical Implementation Guide	2021-10-06

Details

Check Text ( C-16786r314251_chk )
Consult with the network IAVM scanner to confirm all Microsoft Operating System IAVMs have been applied to the Windows DNS server. If all Microsoft Operating System IAVMs have not been applied to the DNS server, this is a finding.

Fix Text (F-16784r314252_fix)
Apply all related Microsoft Operating System IAVM patches to the DNS server.