TNS Listener Poison Attack using COST

We implemented COST for our 11.2.0.4 Listeners on HP-UX 11.31 and now we are receiving alerts from NessusScan , "The remote Oracle TNS listener allows service registration from a remote host. An attacker can exploit this issue to divert data from a legitimate database server or client to an attacker-specified system. " Per the above thread it would seem that COST should be sufficient, but to eliminate the finding from NessusScan should we also implement VNCR? Is it OK to have both?

Thanks.