Code problems in S138 Signature for IDS Version 4.1?

[bgorrell]

S138 Signature update was originally announced 1/19/05. We upgraded three sensors with this update and have been experiencing performance problems with two of them. On 1/27/05, S138 Signature (still dated 1/19/05) was announced again! There appears to be no difference in the announcement or the size of the two updates; however, I wonder is there was a problem with the code dated 1/19/05 and this is the reason it was reannounced. Has anyone else experienced similar problems? One of my sensors is currently at the Maintenance partition (again!).

[a.arndt]

I believe that it was actually S139 that was announced on "1/27/05"...

Cisco IPS Active Update Bulletin - 01/27/05

cisco.com/go/ids

January 27, 2005

1. Announcing the S139 Signature Update for Cisco IDS Version 4.1

I must point out that I actually received two bulletins; the first for S138, and the second (about an hour later) for S139.

I suspect a typo in the original release is to blame for the confusion and the second one was the corrected copy. To fix your problem, I'd download the S139 update and apply it to your affected sensors. This will (hopefully) fix them for you...

I hope this helps,

Alex Arndt

[craiwill]

You are correct. You can always find the latest Active Update bulletin from the IPS Alert Center page.

Active Update Bulletin archives:

http://www.cisco.com/cgi-bin/front.x/ipsalerts/arcBulletin.pl

[scothrel]

You are correct, the S138 bulletin was mistakenly resent.