A BIND 9.x implementation operating in a split DNS configuration must be approved by the organizations Authorizing Official.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-207588 | BIND-9X-001405 | SV-207588r879887_rule | CCI-000366 | high |
| Description | ||||
| BIND 9.x has implemented an option to use "view" statements to allow for split DNS architecture to be configured on a single name server. If the split DNS architecture is improperly configured there is a risk that internal IP addresses and host names could leak into the external view of the DNS server. Allowing private IP space to leak into the public DNS system may provide a person with malicious intent the ability to footprint your network and identify potential attack targets residing on your private network. | ||||
| STIG | Date | |||
| BIND 9.x Security Technical Implementation Guide | 2024-02-15 | |||
Related Frameworks
4 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
CM-6
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1712 mappings
3.4.1
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.4.2
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000366
1.00
- DISA · 2 · disa_xccdf · related
Details
Check Text (C-207588r879887_chk)
If the BIND 9.x name server is not configured for split DNS, this is Not Applicable.
Verify that the split DNS implementation has been approved by the organizations Authorizing Official.
With the assistance of the DNS administrator, obtain the Authorizing Official’s letter of approval for the split DNS implementation.
If the split DNS implementation has not been approved by the organizations Authorizing Official, this is a finding.
Fix Text (F-7843r283819_fix)
Obtain approval for the split DNS implementation from the Authorizing Official.