Cisco Unified Intelligent Contact Management Enterprise

Revised July 5, 2007

October 14, 2004

NOTICE:

THIS FIELD NOTICE HAS BEEN ARCHIVED AND IS NO LONGER MAINTAINED OR UPDATED BY CISCO.

THIS FIELD NOTICE IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE, WARRANTY OR SUPPORT. USE OF THE INFORMATION ON THIS FIELD NOTICE OR MATERIALS LINKED FROM THIS FIELD NOTICE IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS FIELD NOTICE AT ANY TIME.

Products Affected

• CTIOS - 4.6.2, 4.7, 5.0, and 5.1, all service releases

• Cisco Internet Service Node - Versions 1.0, 2.0 and 2.1

• ICM Enterprise - 4.6.2, 5.0, and 6.0,all service releases

• ICM Hosted - 4.6.2 and 5.0, all service releases

• IPCC Enterprise - 4.6.2, 5.0, and 6.0,all service releases

• IPCC Hosted - 4.6.2 and 5.0, all service releases

Problem Description

On October 12, 2004. Microsoft released the following security updates:

Note: If not otherwise specified, security bulletin applies to all Service Packs for noted operating system or application

MS04-038 Critical

Cumulative Security Update for Internet Explorer (834707)

Affected Software:

• Internet Explorer 5.01

• Internet Explorer 5.01 SP3

• Internet Explorer 5.5

• Internet Explorer 5.5 SP2

• Internet Explorer 6

• Internet Explorer 6.0 for Windows Server 2003

• Internet Explorer 6.0 for Windows XP Service Pack 2

• Internet Explorer 5.01 SP4

• Internet Explorer 6 Gold

• Internet Explorer 6 SP1

MS04-037 Critical

Vulnerability in Windows Shell Could Allow Remote Code Execution (841356)

Affected Software:

• Windows NT Server 4.0

• Windows NT Server 4.0, Enterprise Edition

• Windows NT Server 4.0, Terminal Server Edition

• Windows 2000 Advanced Server

• Windows 2000 Datacenter Server

• Windows 2000 Server

• Windows 2000 Professional

MS04-036 Critical

Vulnerability in NNTP Could Allow Code Execution (883935)

Affected Software:

• Windows NT Server 4.0

• Windows NT Server 4.0, Enterprise Edition

• Windows 2000 Advanced Server

• Windows 2000 Datacenter Server

• Windows 2000 Server

MS04-035 Critical

Vulnerability in SMTP Could Allow Remote Code Execution (885881)

Affected Software:

• Windows Server 2003 systems

MS04-034 Critical

Vulnerability in Compressed (zipped) Folders Could Allow Code Execution (873376)

Affected Software:

• Windows XP Home Edition

• Windows XP Professional

• Windows Server 2003

MS04-033 Critical

Vulnerability in Microsoft Excel Could Allow Code Execution (886836)

Affected Software:

• Office 2000

• Office XP

MS04-032 Critical

Security Update for Microsoft Windows (840987)

Affected Software:

• Windows NT Server 4.0

• Windows NT Server 4.0, Enterprise Edition

• Windows NT Server 4.0, Terminal Server Edition

• Windows 2000 Advanced Server

• Windows 2000 Datacenter Server

• Windows 2000 Professional

• Windows 2000 Server

• Windows XP Home Edition

• Windows XP Professional

MS04-031 Important

Vulnerability in NetDDE Could Allow Remote Code Execution (841533)

Affected Software:

• Windows NT Server 4.0

• Windows NT Server 4.0, Enterprise Edition

• Windows NT Server 4.0, Terminal Server Edition

• Windows 2000 Advanced Server

• Windows 2000 Datacenter Server

• Windows 2000 Professional

• Windows 2000 Server

MS04-030 Critical

Vulnerability in WebDav XML Message Handler Could Lead to a Denial of Service (824151)

Affected Software:

• Windows 2000 Advanced Server

• Windows 2000 Datacenter Server

• Windows 2000 Professional

• Windows 2000 Server

• Windows XP Home Edition

• Windows XP Professional

MS04-029 Important

Vulnerability in RPC Runtime Library Could Allow Information Disclosure and Denial of Service (873350)

Affected Software:

• Windows NT Server 4.0

• Windows NT Server 4.0, Enterprise Edition

• Windows NT Server 4.0, Terminal Server Edition

For additional information on Microsoft security updates, see the Microsoft Security page.

Background

Cisco evaluates Microsoft security notices and updates for potential impact to Cisco Contact Center products.

The qualification process results in one of four categorical ratings being applied to a given update: Impacting, Not Impacting, Deferred, or Not Applicable.

The four ratings are defined in the Cisco Customer Contact Software Policy For Use of Third-Party Software and Security Updates document.

For the security updates listed in Problem Description section of this bulletin, Cisco has assigned the updates to the following categories:

Impacting

MS04-032 Security Update for Microsoft Windows (840987)

MS04-031 Vulnerability in NetDDE Could Allow Remote Code Execution (841533)

MS04-029 Vulnerability in RPC Runtime Library Could Allow Information Disclosure and Denial of Service (873350)

Deferred

MS04-038 Cumulative Security Update for Internet Explorer (834707)

MS04-037 Vulnerability in Windows Shell Could Allow Remote Code Execution (841356)

MS04-034 Vulnerability in Compressed (zipped) Folders Could Allow Code Execution (873376)

Not Applicable

MS04-036 Vulnerability in NNTP Could Allow Code Execution (883935)

MS04-035 Vulnerability in SMTP Could Allow Remote Code Execution (885881)

MS04-033 Vulnerability in Microsoft Excel Could Allow Code Execution (886836)

MS04-030 Vulnerability in WebDav XML Message Handler Could Lead to a Denial of Service (824151)

For additional information on securing an ICM system, see Security Best Practices for Cisco Intelligent Contact Management Software.

Customers should follow Microsoft's guidelines regarding when and how they should apply these updates. Refer to the Microsoft website for full details of the potential exposure from the caveat is referenced on the Microsoft Security page.

Problem Symptoms

It is important to point out that Cisco Contact Center Support has not had any cases pertaining to this threat recorded from our customer base as of October 12, 2004.

Workaround/Solution

Cisco has assessed, and where deemed appropriate, validated the Microsoft security patches addressed in this bulletin.

Cisco recommends that Contact Center customers separately assess all security patches released by Microsoft and install those deemed appropriate for their environments.

Cisco will continue to provide a service of separately assessing and where necessary, validating higher severity security patches that may be relevant to the Contact Center Enterprise software products.

Visit the Microsoft website to acquire the fixes. Keep in mind that you should download the appropriate fixes based on the version of the Microsoft operating system deployed in your environment and service pack level.

For More Information

If you require further assistance, or if you have any further questions regarding this field notice, please contact the Cisco Systems Technical Assistance Center (TAC) by one of the following methods:

• Open a service request on Cisco.com
• By email
• By telephone

Receive Email Notification For New Field Notices

Product Alert Tool - Set up a profile to receive email updates about reliability, safety, network security, and end-of-sale issues for the Cisco products you specify.