4

I have a question regarding recent PCI DSS scan performed on our network.

On some of the Windows 2008 servers (physical and VM), there is a risk found "Firewall UDP Packet Source Port 53 Ruleset Bypass".

Windows firewall profiles are kept off due to application team requests, hence I am wondering if we create a rule to block inbound UDP 53, will that work?

How can we remediate this risk in such case? Please advise.

Improve this question

2 Answers 2

Reset to default
1

It sounds like any UDP packet is allowed to your servers if the source port is UDP53. You'll need a rule which monitors session state, likely a firewall (hardward or host based), so this traffic is only allowed if your servers already sent an outgoing request to the DNS server on UDP53.

Improve this answer
0

I would ask you:

  • What are the roles of these servers in question?
  • Was this scan performed against the internal network or external network?

If the machines in question are not Domain Controllers or explicit DNS servers, then there is no need for DNS services to be running on these machines.

If they are Domain Controllers or explicit DNS servers, then the finding may not be applicable as they are working as designed.

Improve this answer
1
  • PCI Compliance scans are external in most cases. I think he would have specified otherwise...
    – Alexis Wilke
    Nov 22, 2016 at 4:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .