PCI Fail - ISC Bind Version No Longer Supported

meljc

• January 27, 2016 16:58

Hello, I am running the lastest version of WHM on a dedicated server and received a PCI Compliance failure as following: after running a PCI Compliance scan the following is flagged: Title: ISC BIND Unsupported Version Detection Synopsis: The remote host is running an unsupported version of ISC BIND. Impact: According to its self-reported version number, the installation of ISC BIND running on the remote name server is 9.8.x or earlier. It is, therefore, no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities. Resolution: Upgrade to a version of ISC BIND that is currently supported. Installed version: 9.8.2rc1-RedHat-9.8.2-0.37.rc1.el6_7.5 Fixed version : 9.9.8 or higher
What is the best way to go about rectifying this issue. Thanks Mel

• 

  quizknows

  • January 27, 2016 23:29

  Since you are on RHEL/CentOS 6 (or so it seems) your OS is supported and should still be receiving updates. Run a "yum update" from a root shell, ensure all packages are up to date. Then run this:
  rpm -q --changelog bind > bind_changelog.txt
  That text file should show that your bind version is up to date and received updates as recent as Dec 2015. Send the file to your PCI vendor and dispute the findings as your version is receiving backported security fixes.

  0
• 

  meljc

  • January 28, 2016 12:41

  Thanks Quizknows. I already did a yum update and the version was still the same. I'll try the other command. I think the issue is that the version I have is no longer supported, so even if there are security fixes, they want the next version 9.9.8 or higher.

  0
• 

  cPanelMichael

  • January 28, 2016 18:25

  Hello :) You should be able to provide them the output of the RPM command to show that security patches have been backported to the existing version of Bind. Thank you.

  0
• 

  quizknows

  • January 29, 2016 00:14

  Thanks Quizknows. I already did a yum update and the version was still the same. I'll try the other command. I think the issue is that the version I have is no longer supported, so even if there are security fixes, they want the next version 9.9.8 or higher.

  
  We deal with this all the time with PCI vendors. They only look at the version number and not whether or not it's actively receiving backports. You just need the changelog to prove it to them. Do not try to change/upgrade the installed version beyond what yum update provides. This is standard with a lot of things on RHEL / CentOS including OpenSSH and OpenSSL, and you may have to do the same for those RPMs in the future.

  0

Please sign in to leave a comment.