| Each newer version of the name server software, especially the BIND software, generally is devoid of vulnerabilities found in earlier versions because it has design changes incorporated to take care of those vulnerabilities. Of course, these vulnerabilities have been exploited (i.e., some form of attack was launched), and sufficient information has been generated with respect to the nature of those exploits. Thus, it makes good business sense to run the latest version of name server software because theoretically it is the safest version. Even if the software is the latest version, it is not safe to run it in default mode. The security administrator should always configure the software to run in the recommended secure mode of operation after becoming familiar with the new security settings for the latest version.
In some installations, it may not be possible to switch over to the latest version of name server software immediately. In these situations, the administrator should keep pace with vulnerabilities identified in the operational version and associated security patches
To prevent information about which version of name server software is running on a system and so as to not provide attackers the knowledge of which exploits the name server is vulnerable to, the name server should refuse queries for its DNS software version. |
