| V-4501 | High | The DHCP server service is not disabled on any Windows 2000/2003 DNS server that supports dynamic updates. | There is a significant vulnerability potential when the DHCP service runs using the computer account of a Windows Domain Controller, as in the default Windows configuration. This account has full... |
| V-4502 | High | Zone transfers are not prohibited or a VPN solution is not implemented that requires cryptographic authentication of communicating devices and is used exclusively by name servers authoritative for the zone. | If zone transfers are not cryptographically authenticated, then there is the potential for an adversary to masquerade as a legitimate zone partner and update zone records without authorization. |
| V-4505 | High | WINS lookups is not prohibited on a Windows 2000 DNS server. | Integration of WINS and Windows 2000 DNS leaves Windows 2000 DNS open to all the vulnerabilities of WINS, including the ability to update records without authentication. |
| V-4488 | High | The DNS software must log success and failure events when starting and stopping of the name server service daemon, zone transfers, zone update notifications, and dynamic updates. | Logging must be comprehensive to be useful for both intrusion monitoring and security investigations. Setting logging at the severity notice should capture most relevant events without requiring... |
| V-4481 | High | Dynamic updates are not cryptographically authenticated. | The dynamic update capability has considerable appeal in an environment in which IP addresses change so frequently that it would be unacceptably burdensome or expensive to dedicate the time of a... |
| V-4482 | High | The DNS software administrator will configure each master/slave server supporting a zone to cryptographically authenticate zone transfers. | A slave updates its zone information by requesting a zone transfer from its master. In this transaction, the risk for the slave is that the response to its request is not in fact from its... |
| V-4470 | High | The DNS database administrator has not ensured each NS record in a zone file points to an active name server authoritative for the domain specified in that record. | Poorly constructed NS records pose a security risk because they create conditions under which an adversary might be able to provide the missing authoritative name services that are improperly... |
| V-4503 | Medium | Forwarders on an authoritative Windows 2000/2003 DNS server are not disabled. | Windows DNS has historically been more vulnerable to cache poisoning attacks than BIND as the algorithm used for answering recursive queries also makes it more prone to self-imposed denial of... |
| V-4489 | Medium | The DNS software administrator has not configured the DNS software to send all log data to either the system logging facility (e.g., UNIX syslog or Windows Application Event Log) or an alternative logging facility with security configuration equivalent to or more restrictive than the system logging facility. | On name servers, DNS log data is typically more sensitive than system log data and, consequently, should benefit from security controls at least as restrictive as those for the system logging... |
| V-4483 | Medium | A zone master server does not limit zone transfers to a list of active slave name servers authoritative for that zone. | The risk to the master in this situation, is that it would honor a request from a host that is not an authorized slave, but rather an adversary seeking information about the zone. To protect... |
| V-4485 | Medium | A name server is not configured to only accept notifications of zone changes from a host authoritative for that zone. | A slave updates its zone information by requesting a zone transfer from its master. In this transaction, the risk for the slave is that the response to its request is not in fact from its... |
| V-4487 | Medium | A caching name server does not restrict recursive queries to only the IP addresses and IP address ranges of known supported clients. | Any host that can query a resolving name server has the potential to poison the servers name cache or take advantage of other vulnerabilities that may be accessed through the query service. The... |
| V-4486 | Medium | Recursion is not prohibited on an authoritative name server. | A potential vulnerability of DNS is that an attacker can poison a name server's cache by sending queries that will cause the server to obtain host-to-IP address mappings from bogus name servers... |
| V-3625 | Medium | Shares other than the default administrative shares are enabled on a name server. | Non-administrative shares are unnecessary for name server operation and provide adversaries with an additional possible point of attack. |
| V-4478 | Medium | The name server’s IP address is NOT statically defined and configured locally on the server. The name server has a DHCP address. | Static IP addresses permit a machine to offer Internet services like web, ftp, DNS, and email. Because a specific, known address is associated with your connection, other machines on the Internet... |
| V-4479 | Medium | An integrity checking tool is not installed or not monitoring for modifications to the root.hints and named.conf files.
| An integrity checking tool compares file and directory integrity to the baseline. It can alert the system administrator to unauthorized changes in files or directories. Unauthorized changes in... |
| V-14768 | Medium | The IPv6 protocol is installed and the server is only configured to respond to IPv4 A records. | To prevent the possibility of a denial of service in relation to an IPv4 DNS server trying to respond to IPv6 requests, the server should be configured not to listen on any of its IPv6 interfaces... |
| V-4473 | Medium | DNS software does not run on dedicated (running only those services required for DNS) hardware. The only currently accepted exception of this requirement is Windows 2000/2003 DNS, which must run on a domain controller that is integrated with Active Directory services.
| Even a securely configured operating system is vulnerable to the flaws of the programs that run on it. To prevent DNS software from being subjected to the vulnerabilities of other programs and... |
| V-4475 | Medium | Permissions on files containing DNS encryption keys are inadequate. | Weak permissions could allow an intruder to view or modify DNS encryption key files. These keys should never be readable by Other or Everyone. |
| V-4476 | Medium | Users and/or processes other than the DNS software Process ID (PID) and/or the DNS database administrator have edit/write access to the zone database files. | Weak permissions on key files could allow an intruder to view or modify DNS zone files. Permissions on these files will be 640 or more restrictive. |
| V-4477 | Medium | Users or processes other than the DNS software administrator and the DNS software PID have write access to these files. | Weak permissions on key DNS configuration files could allow an intruder to view or modify DNS name server configuration files. |
| V-12479 | Medium | Computer accounts for DHCP servers are members of the DNSUpdateProxy group. | A built-in security group, DNSUpdateProxy, is provided as of Windows 2000. This group can update DNS records for clients without becoming the owner of the records. When DHCP servers are added as... |
| V-14757 | Low | AAAA addresses are configured on a host that is not IPv6 aware. | DNS is only responsible for resolving a domain name to an ip address. Applications and operating systems are responsible for processing the IPv6 or IPv4 record that may be returned. With this in... |
| V-14756 | Low | The DNS administrator will ensure non-routeable IPv6 link-local scope addresses are not configured in any zone. Such addresses begin with the prefixes of “FE8”, “FE9”, “FEA”, or “FEB”. | IPv6 link local scope addresses are not globally routable and must not be configured in any DNS zone. Similar to RFC1918, addresses, if a link-local scope address is inserted into a zone provided... |
| V-4492 | Low | The DNS software administrator has not removed the root hints file on an authoritative name server in order for it to resolve only those records for which it is authoritative, and ensure that all other queries are refused. | A potential vulnerability of DNS is that an attacker can poison a name servers cache by sending queries that will cause the server to obtain host-to-IP address mappings from bogus name servers... |
| V-4490 | Low | Entries in the name server logs do not contain timestamps and severity information. | Forensic analysis of security incidents and day-to-day monitoring are substantially more difficult if there are no timestamps on log entries. |
| V-4467 | Low | Record owners will validate their zones no less than annually. The DNS database administrator will remove all zone records that have not been validated in over a year. | If zone information has not been validated in over a year, then there is no assurance that it is still valid. If invalid records are in a zone, then an adversary could potentially use their... |
| V-4469 | Low | Zone-spanning CNAME records, that point to a zone with lesser security, are active for more than six months. | The use of CNAME records for exercises, tests or zone-spanning aliases should be temporary (e.g., to facilitate a migration). When a host name is an alias for a record in another zone, an... |
| V-4468 | Low | Resource records for a host in a zone file are included and their fully qualified domain name resides in another zone. The exception is a glue record or CNAME record supporting a system migration. | If a name server were able to claim authority for a resource record in a domain for which it was not authoritative, this would pose a security risk. In this environment, an adversary could use... |
