Detections
Analytics
BIND-9X-002470 - The host running a BIND 9.x implementation must have DNS cookies enabled.
Information
DNS cookies can help prevent spoofing and cache poisoning attacks by verifying the identity of both the client and server. They do this by including a cryptographic identifier (the cookie) in DNS messages, which can be verified in future messages. This makes it difficult for an attacker to learn the cookie values and thus spoof them.Solution
Edit the named.conf file:options {
answer-cookie yes;
};
After making changes, save the named.conf file and restart the BIND service to apply the changes.
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_BIND_9-x_V3R3_STIG.zip
Item Details
Audit Name: DISA BIND 9.x STIG v3r3
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-275938r1156959_rule, STIG-ID|BIND-9X-002470, Vuln-ID|V-275938
Plugin: Unix
Control ID: a226ead4cd9b4812f13c9a8e4f1bf6c409ca5eaed0f6756192c96e7330c1240d