IPS high alerts with Cisco sites as the attacker?

[MARK BAKER]

Has anyone else recently been getting Alerts on the below signatures while accessing Cisco sites?

Windows Shell External Handler

Apache mod_proxy Buffer Overflow

3340:0

3883:0

The above two alerts listed ftp-sj.cisco.com as the attacker and my CS-Manager as the victim. I assume this is during IPS signature file downloads.

While searching the Cisco forums about the above issue, I received an alert on sig 3440 with tools.cisco.com as the attacker and my personal PC as the victim.

Thanks for any info.

[MARK BAKER]

It appears the alert that fired on 3440 with tools.cisco.com as the attacker occured while I was looking up the 3440 signature on MySDN. I believe the signature description contains the trigger for this alert "=shell".

[mhellman]

http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Security&topic=Intrusion%20Prevention%20Systems/IDS&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40%40.1ddbe05b