CVE

This section contains a concordance between Mitre's CVE database (see http://cve.mitre.org/) and the list of intrusions that Network ICE's products detect. CVE is an attempt to "normalize" the naming of vulnerabilities and exploits in order to make it easier to compare products.

However, CVE is only one small step in product comparison. Even though two vendors support the same CVE item doesn't mean they support it in the same way. For example, Network ICE detects all instances of the rpc.statd overflow (CVE-1999-0018), regardless of IP fragmentation, TCP segmentation, RPC record fragging, or obfuscated program code. Many IDSs simply include a few patterns from well-known exploit scripts and hope that adversaries are not intelligent enough to make the modifications necessary to evade their IDSs.