In this article we'll discuss why a PCI scan could have possibly failed as a false positive, stating an outdated version of BIND (Berkeley Internet Name Domain) which is the service that handles DNS requests. If you have read our previous article on how to pass PCI compliance scans, the BIND service being outdated is a common false positive that we see.

The reason for this is because we run cPanel on our servers, and cPanel utilizes backporting for their software updates instead of simply installing the latest version of the service each time it's updated. So to a PCI vendor it might seem that the version is outdated and subject to a known exploit, but in reality the service is secure because it has been patched against the exploit already.

If you failed a PCI scan and the reason stated was your server was running an old version of BIND that is exploitable, you can follow these steps to report the issue as a false positive back to your PCI vendor.

  1. Login to your server via SSH
  2. Run the following command:

    rpm -q bind && rpm -q --changelog bind | head -10

    You should get back text similar to:

    bind-9.8.2-0.10.rc1.el6_3.5.x86_64
    * Wed Oct 10 2012 Adam Tkac <atkac redhat com> 32:9.8.2-0.10.rc1.5
    - fix CVE-2012-5166

    * Tue Sep 18 2012 Adam Tkac <atkac redhat com> 32:9.8.2-0.10.rc1.4
    - allow forward{,ers} statement in static-stub zones

    * Thu Sep 13 2012 Adam Tkac <atkac redhat com> 32:9.8.2-0.10.rc1.3
    - fix CVE-2012-4244

    * Wed Jul 25 2012 Adam Tkac <atkac redhat com> 32:9.8.2-0.10.rc1.2

    You should notice the latest patch applied to BIND was on Wed Oct 10 2012. So if your PCI scanning vendor has failed your website due to the BIND version, provide them with this information so they can mark it as a false positive.

    In this example we used head -10 to only show 10 lines from the full changelog, you can adjust that number to see updates going further back in time.

You should now understand how to retrieve the changelog of the BIND service on your server, to show a PCI vendor that it should be reported as a false positive.

Did you find this article helpful?

We value your feedback!

Why was this article not helpful? (Check all that apply)
The article is too difficult or too technical to follow.
There is a step or detail missing from the instructions.
The information is incorrect or out-of-date.
It does not resolve the question/problem I have.
How did you find this article?
Please tell us how we can improve this article:
Email Address
Name

new! - Enter your name and email address above and we will post your feedback in the comments on this page!

Like this Article?

Post a Comment

Name:
Email Address:
Phone Number:
Comment:
Submit

Please note: Your name and comment will be displayed, but we will not show your email address.

News / Announcements

WordPress wp-login.php brute force attack
Updated 2014-07-17 06:43 pm EST
Hits: 200993

Related Questions

Here are a few questions related to this article that our customers have asked:
Ooops! It looks like there are no questions about this page.
Would you like to ask a question about this page? If so, click the button below!
Ask a Question

Need more Help?

Search

Ask the Community!

Get help with your questions from our community of like-minded hosting users and InMotion Hosting Staff.

Current Customers

Chat: Click to Chat Now E-mail: support@InMotionHosting.com
Call: 888-321-HOST (4678) Ticket: Submit a Support Ticket

Not a Customer?

Get web hosting from a company that is here to help. Sign up today!