I'm not aware of any documentation/whitepapers that discuss Cisco IDS and polymorphic shellcode, but I do know that it makes little difference to Cisco IDS. Signatures written for Cisco IDS don't target particular exploits, but rather the vulnerabilities that they exploit. Overflows occur because you put too much data into a parameter, CIDS signatures will look for data that is too large being put into a vulnerable parameter. This means that while an exploit that utilizes polymorphic shellcode might change as it propagates, CIDS will still trigger.
