Having a three year old CERT Vulnerability should ease the politics of getting the DNS server upgraded. In my experience it makes a nice friendly implied threat, but you'll know your organization better than I.