The Cisco Intrusion Undetection System
Apply Service Pack now
Cisco has issued an alert for its Intrusion Detection System (IDS), one day after launching an enhanced security portfolio.
IDS inspects network traffic and raises alerts for suspect traffic, such as that generated by the Code Red worm. However, it can be fooled by hackers who encode packets using " %u", a non-standard form for coding similar to Unicode. Suspect packets made using this method of coding are flagged straight through by Cisco's IDS.
A patch for the Intrusion Detection System Module on Catalyst 6000 LAN switches is in the works.
Paul Rogers, network security analyst at MIS Corporate Defence, said the flaw is not particularly serious as it is very rare for a Web server to be protected soleley by an IDS system.
In any case, companies should update their Web server software to protect themselves against Code Red; this tackles the problem at source.
The IDS alert was published the day afterCisco trumpeted improvements to its security products including a firewall for small business and, you've guessed it, enhancements to Cisco IDS. ®