Skip to main content
CUI

Vulnerability V-259401

Back

V-259401

CAT II

The Windows DNS Server must be configured to only allow zone information that reflects the environment for which it is authoritative, including IP ranges and IP versions.

Ships Affected
1
Total Findings
1
Open
0
Closed
1

Check Text

Consult with the system administrator to determine the IP ranges for the environment. Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account. If not automatically started, initialize the "Server Manager" window by clicking its icon from the bottom left corner of the screen. Once the "Server Manager" window is initialized, from the left pane, click to select the DNS category. From the right pane, under the "SERVERS" section, right-click the DNS server. From the context menu that appears, click "DNS Manager". On the opened DNS Manager snap-in from the left pane, expand the server name and then expand "Forward Lookup Zones". From the expanded list, click to select and then right-click the zone name. Review the zone information and compare it to the IP ranges for the environment. If any zone information is for a different IP range or domain, this is a finding.

Fix Text

Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account. If not automatically started, initialize the "Server Manager" window by clicking its icon from the bottom left corner of the screen. Once the "Server Manager" window is initialized, from the left pane, click to select the DNS category. From the right pane, under the "SERVERS" section, right-click the DNS server. From the context menu that appears, click "DNS Manager". On the opened DNS Manager snap-in from the left pane, expand the server name and then expand "Forward Lookup Zones". Remove any zone information that is not part of the environment.

STIG Reference

STIG
Microsoft Windows Server Domain Name System (DNS) Security Technical Implementation Guide
Version
2
Release
4
Rule ID
SV-259401r961158_rule

All Occurrences

This vulnerability appears on 1 ship(s)

Ship Hull # Source File Status Assigned To Scan Date Actions
USNS MONTFORD POINT T-ESD-1 _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_WinServerDNS_V2R3_20251023-172313.ckl
Unassigned 2026-01-14T12:57:38.179760 View in Context
CUI