Vulnerability Note VU#154883

Cisco IPS MC Malformed Configuration Download Vulnerability

Cisco IOS IPS (Intrusion Prevention System) is a feature for Cisco IOS devices that provides in-line intrusion prevention services. Cisco IOS IPS performs packet inspection and can stop malicious traffic based on signatures.

CiscoWorks VPN/Security Management Solution

CiscoWorks VPN/Security Management Solution (VMS) is a collection of network management tools that provides the ability to configure and manage firewalls, IPS devices, VPN routers, and other devices.

Cisco Management Center for IPS Sensors

Cisco Management Center for IPS Sensors (IPS MC) is a component of CiscoWorks VMS. Cisco IPS MC is a web-based application that can be used to manage configurations for Cisco IPS devices. Cisco IPS MC can be used to deploy signatures to such devices.

The Problem

If a Cisco IOS IPS device has been configured by Cisco IPS MC, the configuration file may not contain a default port field for some signatures. Such signatures will be disabled on the Cisco IOS IPS device.

II. Impact

Please refer to the "Software Versions and Fixes" section of the Cisco Security Advisory for more information on upgrading.

Systems Affected

http://www.cisco.com/warp/public/707/cisco-sa-20051101-ipsmc.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20051101-ipsmc.pdf
http://secunia.com/advisories/17397/

Credit

Thanks to Cisco Systems Product Security Incident Response Team for reporting this vulnerability.

This document was written by Will Dormann.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.