The CISCO CSS DNS Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: [email protected]


Version / Release: V4R1

Published: 2015-12-29

Updated At: 2018-09-23 02:04:37




Severity Open Not Reviewed Not Applicable Not a Finding
Overall 0 0 0 0
Low 0 0 0 0
Medium 0 0 0 0
High 0 0 0 0
Drop CKL or SCAP (XCCDF) results here.

    Vuln Rule Version CCI Severity Title Description Status Finding Details Comments
    SV-4467r2_rule DNS0225 LOW Record owners will validate their zones no less than annually. The DNS database administrator will remove all zone records that have not been validated in over a year. If zone information has not been validated in over a year, then there is no assurance that it is still valid. If invalid records are in a zone, then an adversary could potentially use their existence for improper purposes. An SOP detailing this process c
    SV-4469r3_rule DNS0235 LOW Zone-spanning CNAME records, that point to a zone with lesser security, are active for more than six months. The use of CNAME records for exercises, tests or zone-spanning aliases should be temporary (e.g., to facilitate a migration). When a host name is an alias for a record in another zone, an adversary has two points of attack the zone in which the alias is
    SV-4506r1_rule DNS0900 LOW The shared secret in the APP session(s) was not a randomly generated 32 character text string. The core requirements related to zone transfers are that an authoritative name server transfers zone information only to designated zone partners and that name servers only accept zone data when it is cryptographically authenticated. CSS APP provides mea
    SV-4507r1_rule DNS0905 MEDIUM The Cisco CSS DNS is utilized to host the organizations authoritative records and DISA Computing Services does not support that host in its domain and associated high-availability server infrastructure. The primary security concern with regard to the type of delegation discussed is that to implement this approach, an organization would have to migrate its authoritative records from a well-known DNS implementation with proven, tested security controls to
    SV-4508r1_rule DNS0910 LOW Zones are delegated with the CSS DNS. Although it is technically possible to delegate zones within CSS DNS, there is almost never a rationale to do so because such delegation could be achieved as easily with BIND, which offers security features not present in CSS DNS. Moreover, the performan
    SV-4509r1_rule DNS0920 LOW The CSS DNS does not transmit APP session data over an out-of-band network if one is available. One can also limit APP communication to an out of band network, which would make it considerably more difficult for adversaries to spoof the addresses of peers or hijack APP sessions.System AdministratorECSC-1
    SV-4510r1_rule DNS0925 MEDIUM Forwarders are not disabled on the CSS DNS. CSS DNS is not vulnerable to attacks associated with recursion because it does not support recursion, but does offer a forwarder feature that sends un-resolvable or unsupported requests to another name server. This feature poses a risk because the forwar
    SV-4512r1_rule DNS0915 HIGH CSS DNS does not cryptographically authenticate APP sessions. The risk to the CSS DNS in this situation is the CSS DNS peers do not authenticate each other, the sending and receiving of APP session data and peer communication may be with an adversary rather than the intended peer, thereby sending sensitive network a
    SV-15513r1_rule DNS4600 LOW The DNS administrator will ensure non-routeable IPv6 link-local scope addresses are not configured in any zone. Such addresses begin with the prefixes of “FE8”, “FE9”, “FEA”, or “FEB”. IPv6 link local scope addresses are not globally routable and must not be configured in any DNS zone. Similar to RFC1918, addresses, if a link-local scope address is inserted into a zone provided to clients, most routers will not forward this traffic bey
    SV-15514r1_rule DNS4610 LOW AAAA addresses are configured on a host that is not IPv6 aware. DNS is only responsible for resolving a domain name to an ip address. Applications and operating systems are responsible for processing the IPv6 or IPv4 record that may be returned. With this in mind, a denial of service could easily be implemented for