Cisco Unified Intelligent Contact Management Enterprise

Revised May 7, 2004

April 16, 2004

Products Affected

Problem Description

On April 13, 2004 Microsoft released the following security updates:

MS04-011 Critical

Security Update for Microsoft Windows (835732)

Affected Software:

• Microsoft Windows NT Server 4.0 Service Pack 6a

• Microsoft Windows 2000 Server Service Pack 2, Service Pack 3, and Service Pack 4

MS04-012 Critical

Cumulative Update for Microsoft RPC/DCOM (828741)

Affected Software:

• Microsoft Windows NT® Server 4.0 Service Pack 6a

• Microsoft Windows 2000 Server Service Pack 2, Service Pack 3, and Service Pack 4

MS04-013 Critical

Cumulative Security Update for Outlook Express (837009)

Affected Software:

• All users of Outlook Express

MS04-014 Important

Vulnerability in the Microsoft Jet Database Engine Could Allow Code Execution (837001)

Affected Software:

• Microsoft Windows NT Server 4.0 Service Pack 6a

• Microsoft Windows 2000 Server Service Pack 2, Service Pack 3, and Service Pack 4

On April 13, 2004 Microsoft re-released the following security updates:

MS00-082 (Not Rated)

Patch Available for 'Malformed MIME Header' Vulnerability

Affected Software:

• Microsoft Exchange Server 5.0

• Microsoft Exchange Server 5.5

MS01-041 (Not Rated)

Malformed RPC Request Can Cause Service Failure

Affected Software:

• Microsoft Exchange Server 5.0

• Microsoft Exchange Server 5.5

MS02-011 Low

Authentication Flaw Could Allow Unauthorized Users To Authenticate To SMTP Service

Affected Software:

• Microsoft Exchange Server 5.0

• Microsoft Windows NT Server 4.0

MS03-046 Critical

Vulnerability in Exchange Server Could Allow Arbitrary Code

Affected Software:

• Microsoft Exchange Server 5.0

• Microsoft Exchange Server 5.5

• Microsoft Windows 2000, Service Pack 3

For additional information on Microsoft security updates, see Microsoft TechNet Security

Background

Cisco evaluates Microsoft security updates for potential impact to Cisco Contact Center products. The qualification process results in one of four categorical ratings being applied to a given update: Impacting, Not Impacting, Deferred, or Not Applicable. The four ratings are defined in the Cisco Customer Contact Software Policy for Use of Third Party Software and Security Updates document. For the security updates listed in the Problem Description section, Cisco has assigned the updates to the following categories:

Impacting

• MS04-011 Security Update for Microsoft Windows (835732)

• MS04-012 Cumulative Update for Microsoft RPC/DCOM (828741)

• MS04-014 Vulnerability in the Microsoft Jet Database Engine Could Allow Code Execution (837001)Impacting on AW only

Not Applicable

• MS02-011 Authentication Flaw Could Allow Unauthorized Users To Authenticate To SMTP Service

• MS00-082 Patch Available for 'Malformed MIME Header' Vulnerability

• MS01-041 Malformed RPC Request Can Cause Service Failure

• MS03-046 Vulnerability in Exchange Server Could Allow Arbitrary Code

• MS04-013 Cumulative Security Update for Outlook Express (837009)

Customers should follow Microsoft's guidelines regarding when and how they should apply these updates. Refer to the Microsoft Security page for full details of the potential exposure from the caveats referenced.

Problem Symptoms

It is important to point out that Cisco Contact Center Support has not had any cases pertaining to this threat recorded from our customer base as of April 22, 2004.

Workaround/Solution

Cisco has assessed, and where deemed appropriate, validated the Microsoft security patches addressed in this bulletin. Cisco recommends that Contact Center customers separately assess all security patches released by Microsoft and install those deemed appropriate for their environments. Cisco will continue to provide a service of separately assessing and where necessary, validating higher severity security patches that may be relevant to the Contact Center Enterprise software products. Visit the Microsoft website to acquire the fixes. Keep in mind that you should download the appropriate fixes based on the version of the Microsoft operating system deployed in your environment and service pack level.

For More Information

If you require further assistance, or if you have any further questions regarding this field notice, please contact the Cisco Systems Technical Assistance Center (TAC) by one of the following methods:

• Open a service request on Cisco.com
• By email
• By telephone

Receive Email Notification For New Field Notices

Product Alert Tool - Set up a profile to receive email updates about reliability, safety, network security, and end-of-sale issues for the Cisco products you specify.