Hi
Well
Yes and no, it all constituets what you think is a vulnerability, and how you define it.
This is one of the things that I consider to be "extra information" ie it is something that should be reported, thought about and then marked as read, understood but acceptable risk.
it is one of those things that you need to have with you in the report or you have not done a thorough job but it is not in anyway a critical information.
In this case I would state that the correct answer for the person recieveing the report in most cases would be
"Good that you found it, Yes we understand the implications and we will do nothing about this. Next point in the list."
Most of these problems occur because of the people reading the reports does not know how to classify the information in regards to the overall picture and thus gives the wrong importance to information like this and thus stealing resources away from the real problems.
It is all fueled on because the makers of the scanning software have to show they find more than any other maker of scanning software reports. Otherwise the buyer of the software will go elsewere. This means that since the buyer does not understand security, the report have replaced the brain of the buyer.
One have to ask oneself, where is the quality in that!
And to the original question, you can not do anything about this if you are using udp (like DNS). its all in a part of the software that is not configurable for you.
so if you read my text above I would guess that the correct answer would apply to this, however this is something that the company you hired to do the scanning should have explained to you.
Good luck
HTH
