bugtraq - Re: Cisco IOS Shellcode - McAfee IPS Protection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <200508050821.j758Lts8020359@caligula.anu.edu.au>
Date: Fri, 5 Aug 2005 18:21:55 +1000 (Australia/ACT)
From: Darren Reed <avalon@...igula.anu.edu.au>
To: planz2009@...il.com
Cc: bugtraq@...urityfocus.com, focus-ids@...urityfocus.com
Subject: Re: Cisco IOS Shellcode - McAfee IPS Protection

In some mail from planz 235, sie said:
> 
> Hi,
> 
> McAfee claims to have "Zero-day" protection against the recent
> vulnerability disclosed against Cisco particularly on Shellcodes.
> Their press release says, McAfee IntruShield's existing infrastructure
> protection proactively covers new exploit techniques against Cisco
> IOS, such as those demonstrated at last week's Black Hat conference.

And can someone tell me what value this is or is the compromise of
border routers not important ?

I'm just puzzled at how you get McAfree's product between your Cisco
router, that gets frame/dsl/isdn/whatever from your telco, and the
wallpoint where the attacks are going to come in from.

Admitedly they can protect you internally and against attacks launched
across your LAN, but how does that help an ISPs core routers that have
dozens of inbound lines that aren't ethernet ?

Darren