Monitor or Span port Vulnerablility

[sagittarius]

Is the CISCO IDS/IPS device connecting to Monitor or SPAN port Vulnerable? Is there a document which I can refer to ?

[mhellman]

It's very unlikely, but not impossible. Snort's had a few and the general concept is applicable to any IDS. If you suck in data off the network and process it, there's the potential for vulnerabilities. If you're worried about it, put the management interface in a management dmz.

http://www.infoworld.com/article/03/03/04/HNsnort_1.html