August 03, 2004
CTI OS - 4.6.2, 4.7, 5.0, 5.1, 6.0, and all service releases
Cisco Internet Service Node - Versions 1.0, 2.0 and 2.1
ICM Enterprise - 4.6.2, 5.0, 6.0, and all service releases
ICM Hosted - 4.6.2, 5.0, and all service releases
IPCC Enterprise - 4.6.2, 5.0, 6.0, and all service releases
IPCC Hosted - 4.6.2 5.0, and all service releases
On July 30, 2004 and updated on August 1, 2004 Microsoft released the following security update:
Note:?If not otherwise specified, the security bulletin applies to all Service Packs for noted operating system or application
Cumulative Security Update for Internet Explorer (867801)
Windows 2000 Server, Windows 2000 Advanced Server, Service Pack 2, Service Pack 3, Service Pack 4
Windows NT Server 4.0, Standard and Enterprise Editions, Service Pack 6a
Windows NT Server 4.0, Terminal Server Edition, Service Pack 6
Windows 2000 Professional
Windows XP Home Edition, Windows XP Professional, Windows XP Service Pack 1
Windows 98, Windows Me
For additional information on Microsoft security updates, see the Microsoft Security Page
Cisco evaluates Microsoft security notices and updates for potential impact to Cisco Contact Center products.
The qualification process results in one of four categorical ratings being applied to a given update:
Impacting, Not Impacting, Deferred, or Not Applicable.
The four ratings are defined in the Cisco Customer Contact Software Policy for Use of Third-Party Software and Security Updates.
For the security updates listed in the Problem Description section of this bulletin, Cisco has assigned the updates to the following categories:
MS04-025 Cumulative Security Update for Internet Explorer (867801)
Cisco Contact Center product testing of this patch is deferred until the next regularly scheduled release of Microsoft security patches, typically on the second Tuesday of a month. This security update addresses a vulnerability in Microsoft Internet Explorer that may allow arbitrary code to be executed. We are deferring the qualification until the regularly scheduled testing for the next release cycle from Microsoft. Exploitation requires a user browsing to an unsafe web page. Users visiting a malicious website, viewing a malformed image, or reading an HTML-rendered email message may be affected. Per our Security Best Practices, Cisco Contact Center Servers must not be used for browsing external web sites therefore mitigating the risk of exposure.
Customers should follow Microsoft's guidelines regarding when and how they should apply these updates. Refer to the Microsoft website for full details of the potential exposure from the caveat is referenced in http://www.microsoft.com/security.
It is important to point out that Cisco Contact Center Support has not had any cases pertaining to this threat recorded from our customer base as of August 2, 2004.
Cisco has assessed, and where deemed appropriate, validated the Microsoft security patches addressed in this bulletin. Cisco recommends that Contact Center customers separately assess all security patches released by Microsoft and install those deemed appropriate for their environments.
Cisco will continue to provide a service of separately assessing and where necessary, validating higher severity security patches that may be relevant to the Contact Center Enterprise software products.
Visit the Microsoft website to acquire the fixes. Keep in mind that you should download the appropriate fixes based on the version of the Microsoft operating system deployed in your environment and service pack level.
For More Information
If you require further assistance, or if you have any further questions regarding this field notice, please contact the Cisco Systems Technical Assistance Center (TAC) by one of the following methods:
Receive Email Notification For New Field Notices
Product Alert Tool - Set up a profile to receive email updates about reliability, safety, network security, and end-of-sale issues for the Cisco products you specify.