NET0820 - DNS servers must be defined for client resolver.

Information

The network element must have DNS servers defined if it is configured as a client resolver.

The susceptibility of IP addresses to spoofing translates to DNS host name and IP address mapping vulnerabilities. For example, suppose a source host wishes to establish a connection with a destination host and queries a DNS server for the IP address of the destination host name. If the response to this query is the IP address of a host operated by an attacker, the source host will establish a connection with the attackers host, rather than the intended target. The user on the source host might then provide logon, authentication, and other sensitive data.

Solution

Configure the device to include DNS servers or disable domain lookup.

See Also

https://iasecontent.disa.mil/stigs/zip/U_Network_L2_Switch_V8R27_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|III, Rule-ID|SV-15330r2_rule, STIG-ID|NET0820, Vuln-ID|V-3020

Plugin: Cisco

Control ID: 53e15e81474d3a3fd9f27a9f877373f7fa43d08ffb39c91bf809212e1d827b25