AWSTATS, Bind Versions and DNS Server Cache?

[dingbat]

I'm resolving 'issues' with my ecommerce solution to comply with PCI for Card Processing. I've resolved one but stuck on the following:

- Bind Version

Title: vulnerable BIND version: 9.8.2rc1

Impact: This document covers several BIND vulnerabilities that malicious users can exploit to gain unauthorized, privileged access to target machines, disrupt service on target machines, or launch DNS spoofing attacks.

Data Received: version.bind.??0?CH?TXT?"9.8.2rc1-RedHat-9.8.2-0.17.rc1.el6_4.4"

Resolution: Check for package updates from the vendor.

Upgrade BIND to 9.7.6-P4, 9.6-ESV-R7-P4 or higher.

Looks to me as if my Bind version is already later than the ones being requested, no? Is this relevant to my host?

AWSTATS -

Description: AWStats 'awstats.pl' Path Disclosure

Synopsis: The remote web server contains an application which is affected by a path disclosure issue.

Impact: AWStats is installed on the remote system. AWStats could be installed as a standalone package or could be bundled or shipped with a third- party software such as WebGUI Runtime Environment. The installed version is affected by a path disclosure vulnerability. By specifying a nonexistent config file to the 'config' parameter in awstats.pl, it may be possible for an attacker to view install path information. See also :

http://www.plainblack.com/bugs/tracker/8964

Data Received: SecurityMetrics was able to exploit the flaw using following URL : https://www.@@@@@@@.com/cgi- bin/awstats.pl?config=SecurityMetrics@@@@@

Resolution: AWStats standalone package - Unknown at this time. WebGUI Runtime Environment (WRE) - Upgrade to WRE 0.9.0.

Risk Factor: Medium/ CVSS2 Base Score: 5.0

DNS Server Cache -

Description: DNS Server Cache Snooping Remote Information Disclosure

Synopsis: The remote DNS server is vulnerable to cache snooping attacks.

Impact: The remote DNS server responds to queries for third-party domains that do not have the recursion bit set.

This may allow a remote attacker to determine which domains have recently been resolved via this name server, and therefore which hosts have been recently visited.

Note: If this is an internal DNS server not accessable to outside networks, attacks would be limited to the internal network. This may include employees, consultants and potentially users on a guest network or WiFi connection if supported.

See also : http://www.rootsecure.net/content/downloads/pdf/dns_cache_snooping.pdf

Data Received: SecurityMetrics sent a non-recursive query for example.com and received 1 answer :

<removed>

Resolution: Contact the vendor of the DNS software for a fix.

Risk Factor: Medium/ CVSS2 Base Score: 5.0

AV:N/AC:L/Au:N/C/I:N/A:N

Any advice folks?

BTW I'm using zencart 1.3.9d on HostGator

 

[astutiumRob]

- Bind Version
Looks to me as if my Bind version is already later than the ones being requested, no?

Yes, although it's failing their "robotic" test due to the version number format being different to n.n.n-v (yours is reporting n.n.nv) just inform them

AWSTATS -

Turn it off

DNS Server Cache -

Is *bad* ...

Any advice folks?

Move to a dedicated server/virtual server with someone who'll help you secure it, update it, and fix the PCI compliance issues etc.

 

[smo]

My advice - stop using security metrics.

We had no end of trouble with them last year because they wouldnt accept that their automatic scanning system got it wrong but they wouldn't/couldn't override it or sort it out!