search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Cisco IPS MC Malformed Configuration Download Vulnerability

Vulnerability Note VU#154883

Original Release Date: 2005-11-02 | Last Revised: 2005-11-02


Cisco Management Center for IPS Sensors (IPS MC) contains a vulnerability that may cause some IPS signatures to become unintentionally disabled.



Cisco IOS IPS (Intrusion Prevention System) is a feature for Cisco IOS devices that provides in-line intrusion prevention services. Cisco IOS IPS performs packet inspection and can stop malicious traffic based on signatures.

CiscoWorks VPN/Security Management Solution

CiscoWorks VPN/Security Management Solution (VMS) is a collection of network management tools that provides the ability to configure and manage firewalls, IPS devices, VPN routers, and other devices.

Cisco Management Center for IPS Sensors

Cisco Management Center for IPS Sensors (IPS MC) is a component of CiscoWorks VMS. Cisco IPS MC is a web-based application that can be used to manage configurations for Cisco IPS devices. Cisco IPS MC can be used to deploy signatures to such devices.

The Problem

If a Cisco IOS IPS device has been configured by Cisco IPS MC, the configuration file may not contain a default port field for some signatures. Such signatures will be disabled on the Cisco IOS IPS device.


The Cisco IOS IPS device may not detect or prevent certain types of network attacks.


Apply a patch or upgrade
Please refer to the "Software Versions and Fixes" section of the Cisco Security Advisory for more information on upgrading.

Vendor Information


Cisco Systems, Inc. Affected

Notified:  November 02, 2005 Updated: November 02, 2005



Vendor Statement

Please see

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.


Published 11/01/2005 at


If you have feedback, comments, or additional information about this vulnerability, please send us email.

CVSS Metrics

Group Score Vector



Thanks to Cisco Systems Product Security Incident Response Team for reporting this vulnerability.

This document was written by Will Dormann.

Other Information

CVE IDs: None
Severity Metric: 3.90
Date Public: 2005-11-01
Date First Published: 2005-11-02
Date Last Updated: 2005-11-02 19:36 UTC
Document Revision: 9

Sponsored by CISA.