BIND 9.x Security Technical Implementation Guide

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: [email protected]

Details

Version / Release: V1R4

Published: 2018-04-03

Updated At: 2018-09-23 19:12:25

Compare/View Releases

Select any two versions of this STIG to compare the individual requirements

Select any old version/release of this STIG to view the previous requirements

Actions

Download

Filter


Findings
Severity Open Not Reviewed Not Applicable Not a Finding
Overall 0 0 0 0
Low 0 0 0 0
Medium 0 0 0 0
High 0 0 0 0
Drop CKL or SCAP (XCCDF) results here.

    Vuln Rule Version CCI Severity Title Description Status Finding Details Comments
    SV-86987r1_rule BIND-9X-000001 CCI-001090 LOW A BIND 9.x server implementation must be running in a chroot(ed) directory structure. With any network service, there is the potential that an attacker can exploit a vulnerability within the program that allows the attacker to gain control of the process and even run system commands with that control. One possible defense against this atta
    SV-86989r1_rule BIND-9X-001000 CCI-000366 HIGH A BIND 9.x server implementation must be operating on a Current-Stable version as defined by ISC. The BIND STIG was written to incorporate capabilities and features provided in BIND version 9.9.x. However, it is recognized that security vulnerabilities in BIND are identified and then addressed on a regular, ongoing basis. Therefore it is required that
    SV-86991r1_rule BIND-9X-001002 CCI-000366 MEDIUM The platform on which the name server software is hosted must only run processes and services needed to support the BIND 9.x implementation. Hosts that run the name server software should not provide any other services. Unnecessary services running on the DNS server can introduce additional attack vectors leading to the compromise of an organization’s DNS architecture.
    SV-86993r1_rule BIND-9X-001003 CCI-000366 MEDIUM The BIND 9.x server software must run with restricted privileges. Failure to provide logical access restrictions associated with changes to application configuration may have significant effects on the overall security of the system. When dealing with access restrictions pertaining to change control, it should be noted
    SV-86995r1_rule BIND-9X-001004 CCI-000366 MEDIUM The host running a BIND 9.X implementation must implement a set of firewall rules that restrict traffic on the DNS interface. Configuring hosts that run a BIND 9.X implementation to only accept DNS traffic on a DNS interface allows a system firewall to be configured to limit the allowed incoming ports/protocols to 53/tcp and 53/udp. Sending outgoing DNS messages from a random po
    SV-86997r1_rule BIND-9X-001005 CCI-000366 MEDIUM The host running a BIND 9.x implementation must use a dedicated management interface in order to separate management traffic from DNS specific traffic. Providing Out-Of-Band (OOB) management is the best first step in any management strategy. No production traffic resides on an out-of-band network. The biggest advantage to implementation of an OOB network is providing support and maintenance to the networ
    SV-86999r1_rule BIND-9X-001006 CCI-000366 MEDIUM The host running a BIND 9.x implementation must use an interface that is configured to process only DNS traffic. Configuring hosts that run a BIND 9.X implementation to only accept DNS traffic on a DNS interface allows a system to be configured to segregate DNS traffic from all other host traffic. The TCP/IP stack in DNS hosts (stub resolver, caching/resolving/recu
    SV-87001r1_rule BIND-9X-001010 CCI-000133 LOW A BIND 9.x server implementation must be configured to allow DNS administrators to audit all DNS server components, based on selectable event criteria, and produce audit records within all DNS server components that contain information for failed security verification tests, information to establish the outcome and source of the events, any information necessary to determine cause of failure, and any information necessary to return to operations with least disruption to mission processes. Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one. The actual auditing is performed by the OS/NDM, but the configurati
    SV-87003r1_rule BIND-9X-001017 CCI-001348 LOW The BIND 9.x server implementation must not be configured with a channel to send audit records to null. DNS software administrators require DNS transaction logs for a wide variety of reasons including troubleshooting, intrusion detection, and forensics. Ensuring that the DNS transaction logs are recorded on the local system will provide the capability neede
    SV-87005r1_rule BIND-9X-001020 CCI-000169 LOW The BIND 9.x server logging configuration must be configured to generate audit records for all DoD-defined auditable events to a local file by enabling triggers for all events with a severity of info, notice, warning, error, and critical for all DNS components. Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one. The actual auditing is performed by the OS/NDM, but the configurati
    SV-87007r1_rule BIND-9X-001021 CCI-000172 LOW In the event of an error when validating the binding of other DNS servers identity to the BIND 9.x information, when anomalies in the operation of the signed zone transfers are discovered, for the success and failure of start and stop of the name server service or daemon, and for the success and failure of all name server events, a BIND 9.x server implementation must generate a log entry. Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is being performed on the system, where an event occurred, when an event occurred, and by whom the event was triggered, in order to c
    SV-87009r1_rule BIND-9X-001030 CCI-000130 LOW The print-severity variable for the configuration of BIND 9.x server logs must be configured to produce audit records containing information to establish what type of events occurred. Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is being performed on the system, where an event occurred, when an event occurred, and by whom the event was triggered, in order to c
    SV-87011r1_rule BIND-9X-001031 CCI-000131 LOW The print-time variable for the configuration of BIND 9.x server logs must be configured to establish when (date and time) the events occurred. Without establishing when events occurred, it is impossible to establish, correlate, and investigate the events relating to an incident. Associating event types with detected events in the application and audit logs provides a means of investigating an
    SV-87013r1_rule BIND-9X-001032 CCI-000132 LOW The print-category variable for the configuration of BIND 9.x server logs must be configured to record information indicating which process generated the events. Without establishing where events occurred, it is impossible to establish, correlate, and investigate the events relating to an incident. Associating information about where the event occurred within the application provides a means of investigating an at
    SV-87015r1_rule BIND-9X-001040 CCI-001348 LOW The BIND 9.x server implementation must be configured with a channel to send audit records to a remote syslog. Protection of log data includes assuring log data is not accidentally lost or deleted. Backing up audit records to a different system or onto separate media than the system being audited on a defined frequency helps to assure, in the event of a catastroph
    SV-87017r1_rule BIND-9X-001041 CCI-001348 LOW The BIND 9.x server implementation must be configured with a channel to send audit records to a local file. DNS software administrators require DNS transaction logs for a wide variety of reasons including troubleshooting, intrusion detection, and forensics. Ensuring that the DNS transaction logs are recorded on the local system will provide the capability neede
    SV-87019r1_rule BIND-9X-001042 CCI-001348 LOW The BIND 9.x server implementation must maintain at least 3 file versions of the local log file. DNS software administrators require DNS transaction logs for a wide variety of reasons including troubleshooting, intrusion detection, and forensics. Ensuring that the DNS transaction logs are recorded on the local system will provide the capability neede
    SV-87021r1_rule BIND-9X-001050 CCI-000054 MEDIUM The BIND 9.x secondary name server must limit the number of zones requested from a single master name server. Limiting the number of concurrent sessions reduces the risk of Denial of Service (DoS) to the DNS implementation. Name servers do not have direct user connections but accept client connections for queries. Original restriction on client connections shoul
    SV-87023r1_rule BIND-9X-001051 CCI-000054 MEDIUM The BIND 9.x secondary name server must limit the total number of zones the name server can request at any one time. Limiting the number of concurrent sessions reduces the risk of Denial of Service (DoS) to the DNS implementation. Name servers do not have direct user connections but accept client connections for queries. Original restriction on client connections shoul
    SV-87025r1_rule BIND-9X-001052 CCI-000054 MEDIUM The BIND 9.x server implementation must limit the number of concurrent session client connections to the number of allowed dynamic update clients. Limiting the number of concurrent sessions reduces the risk of Denial of Service (DoS) to the DNS implementation. Name servers do not have direct user connections but accept client connections for queries. Original restriction on client connections shou
    SV-87027r1_rule BIND-9X-001053 CCI-000382 MEDIUM The BIND 9.x server implementation must be configured to use only approved ports and protocols. In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary physical and logical po
    SV-87029r1_rule BIND-9X-001054 CCI-001095 MEDIUM A BIND 9.x server implementation must manage excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of Denial of Service (DoS) attacks. A DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. A denial of service (DoS) attack against the DNS infrastructure has
    SV-87031r2_rule BIND-9X-001055 CCI-000366 MEDIUM A BIND 9.x server implementation must prohibit recursion on authoritative name servers. A potential vulnerability of DNS is that an attacker can poison a name server's cache by sending queries that will cause the server to obtain host-to-IP address mappings from bogus name servers that respond with incorrect information. Once a name server h
    SV-87033r3_rule BIND-9X-001057 CCI-000366 LOW The master servers in a BIND 9.x implementation must notify authorized secondary name servers when zone files are updated. It is important to maintain the integrity of a zone file. The serial number of the SOA record is used to indicate to secondary name server that a change to the zone has occurred and a zone transfer should be performed. The serial number used in the SOA re
    SV-87035r2_rule BIND-9X-001058 CCI-000366 LOW The secondary name servers in a BIND 9.x implementation must be configured to initiate zone update notifications to other authoritative zone name servers. It is important to maintain the integrity of a zone file. The serial number of the SOA record is used to indicate to secondary name server that a change to the zone has occurred and a zone transfer should be performed. The serial number used in the SOA re
    SV-87043r1_rule BIND-9X-001059 CCI-000366 LOW On the BIND 9.x server the platform on which the name server software is hosted must be configured to send outgoing DNS messages from a random port. Hosts that run the name server software should not provide any other services and therefore should be configured to respond to DNS traffic only. Outgoing DNS messages should be sent from a random port to minimize the risk of an attacker's guessing the out
    SV-87045r2_rule BIND-9X-001060 CCI-002754 MEDIUM A BIND 9.x caching name server must implement DNSSEC validation to check all DNS queries for invalid input. A common vulnerability of applications is unpredictable behavior when invalid inputs are received. This requirement guards against adverse or unintended system behavior caused by invalid inputs, where information system responses to the invalid input may
    SV-87047r1_rule BIND-9X-001070 CCI-000054 MEDIUM A BIND 9.x master name server must limit the number of concurrent zone transfers between authorized secondary name servers. Limiting the number of concurrent sessions reduces the risk of Denial of Service (DoS) to the DNS implementation. Name servers do not have direct user connections but accept client connections for queries. Original restriction on client connections shoul
    SV-87049r1_rule BIND-9X-001080 CCI-001094 MEDIUM A BIND 9.x implementation configured as a caching name server must restrict recursive queries to only the IP addresses and IP address ranges of known supported clients. Any host that can query a resolving name server has the potential to poison the servers name cache or take advantage of other vulnerabilities that may be accessed through the query service. The best way to prevent this type of attack is to limit queries t
    SV-87053r1_rule BIND-9X-001100 CCI-000778 HIGH The BIND 9.x server implementation must uniquely identify and authenticate the other DNS server before responding to a server-to-server transaction, zone transfer and/or dynamic update request using cryptographically based bidirectional authentication to protect the integrity of the information in transit. Server-to-server (zone transfer) transactions are provided by TSIG, which enforces mutual server authentication using a key that is unique to each server pair (TSIG), thus uniquely identifying the other server. DNS does perform server authentication when
    SV-87055r1_rule BIND-9X-001106 CCI-000778 MEDIUM The BIND 9.x server implementation must utilize separate TSIG key-pairs when securing server-to-server transactions. Server-to-server (zone transfer) transactions are provided by TSIG, which enforces mutual server authentication using a key that is unique to each server pair (TSIG), thus uniquely identifying the other server. Enforcing separate TSIG key-pairs provides
    SV-87061r1_rule BIND-9X-001110 CCI-000186 MEDIUM The TSIG keys used with the BIND 9.x implementation must be owned by a privileged account. Incorrect ownership of a TSIG key file could allow an adversary to modify the file, thus defeating the security objective.
    SV-87063r1_rule BIND-9X-001111 CCI-000186 MEDIUM The TSIG keys used with the BIND 9.x implementation must be group owned by a privileged account. Incorrect ownership of a TSIG key file could allow an adversary to modify the file, thus defeating the security objective.
    SV-87065r1_rule BIND-9X-001112 CCI-000186 MEDIUM The read and write access to a TSIG key file used by a BIND 9.x server must be restricted to only the account that runs the name server software. Weak permissions of a TSIG key file could allow an adversary to modify the file, thus defeating the security objective.
    SV-87067r2_rule BIND-9X-001113 CCI-000366 MEDIUM The BIND 9.X implementation must not utilize a TSIG or DNSSEC key for more than one year. Cryptographic keys are the backbone of securing DNS information over the wire, maintaining DNS data integrity, and the providing the ability to validate DNS information that is received. When a cryptographic key is utilized by a DNS server for a long per
    SV-87069r3_rule BIND-9X-001120 CCI-002450 HIGH A BIND 9.x server must implement NIST FIPS-validated cryptography for provisioning digital signatures and generating cryptographic hashes. The use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The application must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides
    SV-87071r2_rule BIND-9X-001130 CCI-001199 MEDIUM The DNSSEC keys used with the BIND 9.x implementation must be owned by a privileged account. Information at rest refers to the state of information when it is located on a secondary storage device within an organizational information system. Mobile devices, laptops, desktops, and storage devices can be either lost or stolen, and the contents of t
    SV-87073r2_rule BIND-9X-001131 CCI-001199 MEDIUM The DNSSEC keys used with the BIND 9.x implementation must be group owned by a privileged account. Information at rest refers to the state of information when it is located on a secondary storage device within an organizational information system. Mobile devices, laptops, desktops, and storage devices can be either lost or stolen, and the contents of t
    SV-87075r2_rule BIND-9X-001132 CCI-001199 MEDIUM Permissions assigned to the DNSSEC keys used with the BIND 9.x implementation must enforce read-only access to the key owner and deny access to all other users. Information at rest refers to the state of information when it is located on a secondary storage device within an organizational information system. Mobile devices, laptops, desktops, and storage devices can be either lost or stolen, and the contents of t
    SV-87077r2_rule BIND-9X-001133 CCI-000186 HIGH The BIND 9.x server private key corresponding to the ZSK pair must be the only DNSSEC key kept on a name server that supports dynamic updates. The private key in the ZSK key pair must be protected from unauthorized access. If possible, the private key should be stored off-line (with respect to the Internet-facing, DNSSEC-aware name server) in a physically secure, non-network-accessible machine a
    SV-87079r2_rule BIND-9X-001134 CCI-000366 MEDIUM On the BIND 9.x server the private keys corresponding to both the ZSK and the KSK must not be kept on the BIND 9.x DNSSEC-aware primary authoritative name server when the name server does not support dynamic updates. The private keys in the KSK and ZSK key pairs must be protected from unauthorized access. If possible, the private keys should be stored off-line (with respect to the Internet-facing, DNSSEC-aware name server) in a physically secure, non-network-accessibl
    SV-87081r2_rule BIND-9X-001140 CCI-000366 MEDIUM The two files generated by the BIND 9.x server dnssec-keygen program must be owned by the root account, or deleted, after they have been copied to the key file in the name server. To enable zone transfer (requests and responses) through authenticated messages, it is necessary to generate a key for every pair of name servers. The key also can be used for securing other transactions, such as dynamic updates, DNS queries, and response
    SV-87083r2_rule BIND-9X-001141 CCI-000366 MEDIUM The two files generated by the BIND 9.x server dnssec-keygen program must be group owned by the server administrator account, or deleted, after they have been copied to the key file in the name server. To enable zone transfer (requests and responses) through authenticated messages, it is necessary to generate a key for every pair of name servers. The key also can be used for securing other transactions, such as dynamic updates, DNS queries, and response
    SV-87085r2_rule BIND-9X-001142 CCI-000366 MEDIUM Permissions assigned to the dnssec-keygen keys used with the BIND 9.x implementation must enforce read-only access to the key owner and deny access to all other users. To enable zone transfer (requests and responses) through authenticated messages, it is necessary to generate a key for every pair of name servers. The key also can be used for securing other transactions, such as dynamic updates, DNS queries, and response
    SV-87093r2_rule BIND-9X-001150 CCI-000186 HIGH The BIND 9.x server signature generation using the KSK must be done off-line, using the KSK-private key stored off-line. The private key in the KSK key pair must be protected from unauthorized access. The private key should be stored off-line (with respect to the Internet-facing, DNSSEC-aware name server) in a physically secure, non-network-accessible machine along with the
    SV-87095r3_rule BIND-9X-001200 CCI-001178 HIGH A BIND 9.x server implementation must maintain the integrity and confidentiality of DNS information while it is being prepared for transmission, in transmission, and in use and t must perform integrity verification and data origin verification for all DNS information. DNSSEC is required for securing the DNS query/response transaction by providing data origin authentication and data integrity verification through signature verification and the chain of trust Failure to accomplish data origin authentication and data int
    SV-87097r2_rule BIND-9X-001310 CCI-001179 MEDIUM A BIND 9.x server implementation must provide the means to indicate the security status of child zones. If name server replies are invalid or cannot be validated, many networking functions and communication would be adversely affected. With DNS, the presence of Delegation Signer (DS) records associated with child zones informs clients of the security status
    SV-87099r1_rule BIND-9X-001311 CCI-001179 MEDIUM The BIND 9.x server validity period for the RRSIGs covering the DS RR for zones delegated children must be no less than two days and no more than one week. The best way for a zone administrator to minimize the impact of a key compromise is by limiting the validity period of RRSIGs in the zone and in the parent zone. This strategy limits the time during which an attacker can take advantage of a compromised ke
    SV-87101r2_rule BIND-9X-001320 CCI-000366 MEDIUM The core BIND 9.x server files must be owned by the root or BIND 9.x process account. Discretionary Access Control (DAC) is based on the premise that individual users are "owners" of objects and therefore have discretion over who should be authorized to access the object and in which mode (e.g., read or write). Ownership is usually acquire
    SV-87103r1_rule BIND-9X-001321 CCI-000366 MEDIUM The core BIND 9.x server files must be group owned by a group designated for DNS administration only. Discretionary Access Control (DAC) is based on the premise that individual users are "owners" of objects and therefore have discretion over who should be authorized to access the object and in which mode (e.g., read or write). Ownership is usually acquire
    SV-87105r1_rule BIND-9X-001322 CCI-000366 MEDIUM The permissions assigned to the core BIND 9.x server files must be set to utilize the least privilege possible. Discretionary Access Control (DAC) is based on the premise that individual users are "owners" of objects and therefore have discretion over who should be authorized to access the object and in which mode (e.g., read or write). Ownership is usually acquire
    SV-87107r1_rule BIND-9X-001400 CCI-000366 MEDIUM On a BIND 9.x server for zones split between the external and internal sides of a network, the RRs for the external hosts must be separate from the RRs for the internal hosts. Authoritative name servers for an enterprise may be configured to receive requests from both external and internal clients. External clients need to receive RRs that pertain only to public services (public Web server, mail server, etc.) Internal clien
    SV-87109r1_rule BIND-9X-001401 CCI-000366 MEDIUM On a BIND 9.x server in a split DNS configuration, where separate name servers are used between the external and internal networks, the external name server must be configured to not be reachable from inside resolvers. Instead of having the same set of authoritative name servers serve different types of clients, an enterprise could have two different sets of authoritative name servers. One set, called external name servers, can be located within a DMZ; these would be
    SV-87111r1_rule BIND-9X-001402 CCI-000366 MEDIUM On a BIND 9.x server in a split DNS configuration, where separate name servers are used between the external and internal networks, the internal name server must be configured to not be reachable from outside resolvers. Instead of having the same set of authoritative name servers serve different types of clients, an enterprise could have two different sets of authoritative name servers. One set, called external name servers, can be located within a DMZ; these would be
    SV-87113r1_rule BIND-9X-001403 CCI-000366 HIGH A BIND 9.x server implementation must implement internal/external role separation. DNS servers with an internal role only process name/address resolution requests from within the organization (i.e., internal clients). DNS servers with an external role only process name/address resolution information requests from clients external to the
    SV-87115r1_rule BIND-9X-001404 CCI-000366 MEDIUM On the BIND 9.x server the IP address for hidden master authoritative name servers must not appear in the name servers set in the zone database. A hidden master authoritative server is an authoritative DNS server whose IP address does not appear in the name server set for a zone. All of the name servers that do appear in the zone database as designated name servers get their zone data from the hid
    SV-87117r1_rule BIND-9X-001405 CCI-000366 HIGH A BIND 9.x implementation operating in a split DNS configuration must be approved by the organizations Authorizing Official. BIND 9.x has implemented an option to use "view" statements to allow for split DNS architecture to be configured on a single name server. If the split DNS architecture is improperly configured there is a risk that internal IP addresses and host names co
    SV-87119r2_rule BIND-9X-001410 CCI-000366 MEDIUM On the BIND 9.x server the private key corresponding to the ZSK, stored on name servers accepting dynamic updates, must be owned by root. The private ZSK key must be protected from unauthorized access. This strategy is not feasible in situations in which the DNSSEC-aware name server has to support dynamic updates. To support dynamic update transactions, the DNSSEC-aware name server (which
    SV-87121r2_rule BIND-9X-001411 CCI-000366 MEDIUM On the BIND 9.x server the private key corresponding to the ZSK, stored on name servers accepting dynamic updates, must be group owned by root. The private ZSK key must be protected from unauthorized access. This strategy is not feasible in situations in which the DNSSEC-aware name server has to support dynamic updates. To support dynamic update transactions, the DNSSEC-aware name server (which
    SV-87123r1_rule BIND-9X-001510 CCI-000366 MEDIUM A BIND 9.x server implementation must enforce approved authorizations for controlling the flow of information between authoritative name servers and specified secondary name servers based on DNSSEC policies. A mechanism to detect and prevent unauthorized communication flow must be configured or provided as part of the system design. If information flow is not enforced based on approved authorizations, the system may become compromised. Information flow contro
    SV-87125r1_rule BIND-9X-001600 CCI-000366 MEDIUM A BIND 9.x server validity period for the RRSIGs covering a zones DNSKEY RRSet must be no less than two days and no more than one week. The best way for a zone administrator to minimize the impact of a key compromise is by limiting the validity period of RRSIGs in the zone and in the parent zone. This strategy limits the time during which an attacker can take advantage of a compromised ke
    SV-87127r3_rule BIND-9X-001610 CCI-000366 MEDIUM A BIND 9.x server NSEC3 must be used for all internal DNS zones. To ensure that RRs associated with a query are really missing in a zone file and have not been removed in transit, the DNSSEC mechanism provides a means for authenticating the nonexistence of an RR. It generates a special RR called an NSEC (or NSEC3) RR t
    SV-87129r1_rule BIND-9X-001611 CCI-000366 MEDIUM Every NS record in a zone file on a BIND 9.x server must point to an active name server and that name server must be authoritative for the domain specified in that record. Poorly constructed NS records pose a security risk because they create conditions under which an adversary might be able to provide the missing authoritative name services that are improperly specified in the zone file. The adversary could issue bogus res
    SV-87131r1_rule BIND-9X-001612 CCI-000366 MEDIUM On a BIND 9.x server all authoritative name servers for a zone must be located on different network segments. Most enterprises have an authoritative primary server and a host of authoritative secondary name servers. It is essential that these authoritative name servers for an enterprise be located on different network segments. This dispersion ensures the availab
    SV-87133r1_rule BIND-9X-001613 CCI-000366 MEDIUM On a BIND 9.x server all authoritative name servers for a zone must have the same version of zone information. It is important to maintain the integrity of a zone file. The serial number of the SOA record is used to indicate to secondary name server that a change to the zone has occurred and a zone transfer should be performed. The serial number used in the SOA re
    SV-87135r1_rule BIND-9X-001620 CCI-000366 LOW On a BIND 9.x server all root name servers listed in the local root zone file hosted on a BIND 9.x authoritative name server must be valid for that zone. All caching name servers must be authoritative for the root zone because, without this starting point, they would have no knowledge of the DNS infrastructure and thus would be unable to respond to any queries. The security risk is that an adversary could
    SV-87137r1_rule BIND-9X-001621 CCI-000366 LOW On a BIND 9.x server all root name servers listed in the local root zone file hosted on a BIND 9.x authoritative name server must be empty or removed. A potential vulnerability of DNS is that an attacker can poison a name servers cache by sending queries that will cause the server to obtain host-to-IP address mappings from bogus name servers that respond with incorrect information. The DNS architecture
    SV-87139r1_rule BIND-9X-001700 CCI-000366 MEDIUM On the BIND 9.x server a zone file must not include resource records that resolve to a fully qualified domain name residing in another zone. If a name server were able to claim authority for a resource record in a domain for which it was not authoritative, this would pose a security risk. In this environment, an adversary could use illicit control of a name server to impact IP address resoluti
    SV-87141r1_rule BIND-9X-001701 CCI-000366 LOW On the BIND 9.x server CNAME records must not point to a zone with lesser security for more than six months. The use of CNAME records for exercises, tests, or zone-spanning aliases should be temporary (e.g., to facilitate a migration). When a host name is an alias for a record in another zone, an adversary has two points of attack: the zone in which the alias is
    SV-87143r1_rule BIND-9X-001702 CCI-000366 MEDIUM The BIND 9.x server implementation must prohibit the forwarding of queries to servers controlled by organizations outside of the U.S. Government. If remote servers to which DoD DNS servers send queries are controlled by entities outside of the U.S. Government the possibility of a DNS attack is increased. The Enterprise Recursive Service (ERS) provides the ability to apply enterprise-wide policy t