DNS Server Cache Snooping Remote Information Disclosure

[FarzanaMustafa]

We require our network to be PCI DSS compliant, and our most recent vulnerability scan showed a "DNS Server Cache Snooping Remote Information Disclosure" vulnerability on our PA-820 data interface (10.32.0.17) (report below)

We are using model 820 in PANOS 8.1.15. All Dynamic contents are up to date.

Threat log showing:

1 15/12/2020 14:21 0002324375 THREAT vulnerability 2049 15/12/2020 14:21 10.32.15.215 10.32.0.17 AzureTemp-IN HR ms-ds-smbv3 vsys1 VPN-RAS Internal tunnel.3 ethernet1/4 15/12/2020 14:21 37955 1 32962 445 0 0 0x2000 tcp alert Windows Local Security Architect LsarQueryInformationPolicy(30858) any informational client-to-server 11164322 0x2000 10.0.0.0-10.255.255.255 10.0.0.0-10.255.255.255 0 0 0 0 0 0 0 0 pa-820 0 0 N/A info-leak AppThreat-8353-6449 0x0 0 4294967295

Could you please advise how to close this vulnerability?

[reaper · Accepted solution]

This is not really a vulnerability but rather a configurtion option that should not be accessible from the outside: this event is typically triggered if a DNS server allows for recursion while it is reachable from the outside

a fix is to either set an access list on the DNS server so only internal hosts are allowed to use recursion, disable recursion completely, or make the DNS server inaccessible from the outside