Cisco Unified Intelligent Contact Management Hosted

September 17, 2004

Products Affected

Problem Description

On September 14, 2004, Microsoft released the following security updates:

Note: If not otherwise specified, the security bulletin applies to all Service Packs for the noted operating system or application.

MS04-028 Critical

Buffer Overrun in JPEG Processing Could Allow Code Execution (833987)

Affected Software:

Internet Explorer 6 Service Pack 1

MS04-027 Important

Vulnerability in WordPerfect Converter Could Allow Code Execution (884933)

Affected Software:

Microsoft Office 2000 and several office products

For additional information on Microsoft security updates, see Microsoft Security Updates

Background

Cisco evaluates Microsoft security notices and updates for potential impact to Cisco Contact Center products. The qualification process results in one of four categorical ratings being applied to a given update: Impacting, Not Impacting, Deferred, or Not Applicable.

The four ratings are defined in document Cisco Customer Contact Software Policy for use of Third-Party Software and Security Updates.

For the security updates listed in section 2 of this bulletin, Cisco has assigned the updates to the following categories:

Deferred

MS04-028 Critical Buffer Overrun in JPEG Processing Could Allow Code Execution (833987)

Not Applicable

MS04-027 Important Vulnerability in WordPerfect Converter Could Allow Code Execution (884933)

Cisco Contact Center product testing of MS04-028 is deferred until the next Service Release of the ICM software. This security update addresses a vulnerability in Microsoft Internet Explorer 6.0 SP1 that may allow arbitrary code to be executed. The vulnerability requires a user browsing to an unsafe web page. Users visiting a malicious website, viewing a malformed image, or reading an HTML-rendered email message may be affected. Per our Security Best Practices, Cisco Contact Center Servers must not be used for browsing external web sites, therefore mitigating the risk of exposure.

Customers should follow Microsoft's guidelines regarding when and how they should apply these updates. Refer to the Microsoft Security Updates website for full details of the potential exposure from the caveat.

Problem Symptoms

It is important to point out that Cisco Contact Center Support has not had any cases pertaining to this threat recorded from our customer base as of September 16, 2004.

Workaround/Solution

Cisco has assessed, and where deemed appropriate, validated the Microsoft security patches addressed in this bulletin. Cisco recommends that Contact Center customers separately assess all security patches released by Microsoft and install those deemed appropriate for their environments. Cisco will continue to provide a service of separately assessing and where necessary, validating higher severity security patches that may be relevant to the Contact Center Enterprise software products.

Visit the Microsoft website to acquire the fixes. Keep in mind that you should download the appropriate fixes based on the version of the Microsoft operating system deployed in your environment and service pack level.

For More Information

If you require further assistance, or if you have any further questions regarding this field notice, please contact the Cisco Systems Technical Assistance Center (TAC) by one of the following methods:

• Open a service request on Cisco.com
• By email
• By telephone

Receive Email Notification For New Field Notices

Product Alert Tool - Set up a profile to receive email updates about reliability, safety, network security, and end-of-sale issues for the Cisco products you specify.