Impact Assessment of April 2011 Microsoft Security Bulletins on Cisco Contact Center and Self Service Products

Apr 13, 2011

Affected Products

Product
Version
Cisco Unified Intelligent Contact Management Enterprise (ICME)

7.x(x) and 8.x(x), all SRs/MRs

Cisco Unified Contact Center Enterprise (CCE)

7.x(x) and 8.x(x), all SRs/MRs

Cisco Unified Intelligent Contact Management Hosted (ICMH)

7.x(x) and 8.x(x), all MRs

Cisco Unified Contact Center Hosted (CCH)

7.x(x) and 8.x(x), all MRs

Cisco Unified Computer Telephony Integration Object Server (CTI OS)

6.0, 7.x(x) and 8.x(x), all SRs/MRs

Cisco Agent Desktop (CAD)

6.x(x), 7.x(x) and 8.x(x), all SRs

E-Mail Interaction Manager (EIM)

4.2(x) and 4.3(x), all MRs

Web Interaction Manager (WIM)

4.2(x) and 4.3(x), all MRs

Cisco Customer Voice Portal (CVP)

3.0, 3.1, 4.x, 7.0(x) and 8.x(x), all SRs

Cisco Unified Intelligence Suite (CUIS)

7.x(x) all MRs


Problem Description

On April 13, 2011, Microsoft released the following security bulletins:

MS11-018: Critical
Cumulative Security Update for Internet Explorer (2497640)
Affected Supported Software:

  • Microsoft Windows Server 2003 Service Pack 2 - IE6, IE7, IE8
  • Windows XP Service Pack 3 - IE6, IE7, IE8
  • Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1 - IE8

MS11-019: Critical
Vulnerabilities in SMB Client Could Allow Remote Code Execution (2511455)
Affected Supported Software:

  • Microsoft Windows Server 2003 Service Pack 2
  • Windows XP Service Pack 3
  • Windows 7 for 32-bit Systems
  • Windows 7 for x64-based Systems

MS11-020: Critical
Vulnerability in SMB Server Could Allow Remote Code Execution (2508429)
Affected Supported Software:

  • Microsoft Windows Server 2003 Service Pack 2
  • Windows XP Service Pack 3
  • Windows 7 for 32-bit Systems
  • Windows 7 for x64-based Systems

MS11-027: Critical
Cumulative Security Update of ActiveX Kill Bits (2508272)
Affected Supported Software:

  • Microsoft Windows Server 2003 Service Pack 2
  • Windows XP Service Pack 3
  • Windows 7 for 32-bit Systems
  • Windows 7 for x64-based Systems

MS11-028: Critical
Vulnerability in .NET Framework Could Allow Remote Code Execution (2484015)
Affected Supported Software:

  • Microsoft Windows Server 2003 Service Pack 2
  • Windows XP Service Pack 3
  • Windows 7 for 32-bit Systems
  • Windows 7 for x64-based Systems

MS11-029: Critical
Vulnerability in GDI+ Could Allow Remote Code Execution (2489979)
Affected Supported Software:

  • Microsoft Windows Server 2003 Service Pack 2
  • Windows XP Service Pack 3

MS11-030: Critical
Vulnerability in DNS Resolution Could Allow Remote Code Execution (2509553)
Affected Supported Software:

  • Windows XP Service Pack 3
  • Windows XP Professional x64 Edition Service Pack 2
  • Windows Server 2003 Service Pack 2
  • Windows Server 2003 x64 Edition Service Pack 2
  • Windows Server 2003 with SP2 for Itanium-based Systems
  • Windows Vista Service Pack 1 and Windows Vista Service Pack 2
  • Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2
  • Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1
  • Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1

MS11-031: Critical
Vulnerability in JScript and VBScript Scripting Engines Could Allow Remote Code Execution (2514666)
Affected Supported Software:

  • None

MS11-032: Critical
Vulnerability in the OpenType Compact Font Format (CFF) Driver Could Allow Remote Code Execution (2507618)
Affected Supported Software:

  • None

MS11-021: Important
Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (2489279)
Affected Supported Software:

  • None

MS11-022: Important
Vulnerabilities in Microsoft PowerPoint Could Allow Remote Code Execution (2489283)
Affected Supported Software:

  • None

MS11-023: Important
Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (2489293)
Affected Supported Software:

  • None

MS11-024: Important
Vulnerability in Windows Fax Cover Page Editor Could Allow Remote Code Execution (2527308)
Affected Supported Software:

  • Microsoft Windows Server 2003 Service Pack 2
  • Windows XP Service Pack 3
  • Windows 7 for 32-bit Systems
  • Windows 7 for x64-based Systems

MS11-025: Important
Vulnerability in Microsoft Foundation Class (MFC) Library Could Allow Remote Code Execution (2500212)
Affected Supported Software:

  • Microsoft Visual Studio .NET 2003 Service Pack 1
  • Microsoft Visual Studio 2005 Service Pack 1
  • Microsoft Visual Studio 2008 Service Pack 1
  • Microsoft Visual Studio 2010
  • Microsoft Visual C++ 2005 Service Pack 1 Redistributable
  • Microsoft Visual C++ 2008 Service Pack 1 Redistributable
  • Microsoft Visual C++ 2010 Redistributable Package

MS11-026: Important
Vulnerability in MHTML Could Allow Information Disclosure (2503658)
Affected Supported Software:

  • Microsoft Windows Server 2003 Service Pack 2
  • Windows XP Service Pack 3
  • Windows 7 for 32-bit Systems
  • Windows 7 for x64-based Systems

MS11-033: Important
Vulnerability in WordPad Text Converters Could Allow Remote Code Execution (2485663)
Affected Supported Software:

  • Microsoft Windows Server 2003 Service Pack 2
  • Windows XP Service Pack 3

MS11-034: Important
Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (2506223)
Affected Supported Software:

  • Microsoft Windows Server 2003 Service Pack 2
  • Windows XP Service Pack 3
  • Windows 7 for 32-bit Systems
  • Windows 7 for x64-based Systems

Background

Cisco evaluates Microsoft security notices and updates for potential impact to Cisco Contact Center products. The qualification process results in the application of one of three categorical ratings to an update: Impacting, Deferred, or Not Applicable. These ratings are defined in the Cisco Customer Contact software policy for using Microsoft security updates on products deployed on a retail installation of Windows operating system bulletin. The cumulative set of security patches available from Microsoft—including those marked here as Deferred—are applied to Microsoft Windows Server 2003 (current supported Service Pack) and/or the appropriate component prior to Cisco's testing of every release of the Customer Contact Business Unit (CCBU) products (major, minor, and maintenance).

For the security updates listed in the Problem Description section of this bulletin, Cisco has assigned them to the three categories as follows:

Impacting

  • MS11-018: Cumulative Security Update for Internet Explorer (2497640)
  • MS11-020: Vulnerability in SMB Server Could Allow Remote Code Execution (2508429)

Deferred

  • MS11-019: Vulnerabilities in SMB Client Could Allow Remote Code Execution (2511455)
  • MS11-027: Cumulative Security Update of ActiveX Kill Bits (2508272)
  • MS11-028: Vulnerability in .NET Framework Could Allow Remote Code Execution (2484015)
  • MS11-029: Vulnerability in GDI+ Could Allow Remote Code Execution (2489979)
  • MS11-030: Vulnerability in DNS Resolution Could Allow Remote Code Execution (2509553)
  • MS11-034: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (2506223)

Not Applicable

  • MS11-031: Vulnerability in JScript and VBScript Scripting Engines Could Allow Remote Code Execution (2514666)
  • MS11-032: Vulnerability in the OpenType Compact Font Format (CFF) Driver Could Allow Remote Code Execution (2507618)
  • MS11-021: Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (2489279)
  • MS11-022: Vulnerabilities in Microsoft PowerPoint Could Allow Remote Code Execution (2489283)
  • MS11-023: Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (2489293)
  • MS11-024: Vulnerability in Windows Fax Cover Page Editor Could Allow Remote Code Execution (2527308)
  • MS11-025: Vulnerability in Microsoft Foundation Class (MFC) Library Could Allow Remote Code Execution (2500212)
  • MS11-026: Vulnerability in MHTML Could Allow Information Disclosure (2503658)
  • MS11-033: Vulnerability in WordPad Text Converters Could Allow Remote Code Execution (2485663)

Care should be taken in deciding which updates to apply to your systems. For additional information on the security measures to be considered in an ICM environment, refer to the Security Best Practices for Cisco Intelligent Contact Management Software Guide.

For the Security Updates categorized as Impacting, Cisco continues to test its products to determine if there are further potential conflicts.

Product
Version
Tested
(Y/I*)
Components Tested
(All or Specific)
ICM / CCE / CCH

7.0(0) SR4
7.2(7)
7.5(9)
8.0(3)
8.5(1)

Y

All ICM/CCE/CCH 7.0 components tested on Windows Server 2003 SP2. All ICM/CCE/CCH 7.2, 7.5 and 8.0 components tested on Windows Server 2003 R2 SP2.

CTI OS

7.2(7)
7.5(9)
8.0(3)
8.5(1)

Y

CTI OS 7.x components tested on Windows Server 2003 R2 SP2; Agent Desktop 7.2 tested on Windows XP SP3; Agent Desktop 7.5 tested on Windows Vista Enterprise SP2.

CAD

7.5(10)

Y

CAD server components tested on Windows Server 2003 R2 SP2; Agent, Supervisor and Admin Desktops on Windows XP SP3, Windows Vista Business SP2, Internet Explorer 7.0 and 8.0.

EIM / WIM

EIM 4.3(2)
WIM 4.3(2)

Y

EIM / WIM server components tested on Windows 2003 Server SP2.

CVP

3.1(0) SR2
7.0(2)
8.0

NA
Y
Y

CVP 3.x components not tested on Windows 2000 Server SP4 as the patch is not applicable. CVP 4.x and 7.0 components tested on Windows Server 2003 SP2.

CUIS

7.5(4)

Y

CUIS 7.x components tested on Windows Server 2003 SP2.

* Testing Disposition

  • I: In Progress (indicating that testing is in progress and will be updated when complete)
  • Y: Yes (tested)
  • NA: Not Applicable (none of the security updates are being tested because of a Not Applicable or Deferred assessment)

Customers should follow Microsoft's guidelines regarding when and how they should apply these updates. Refer to the Microsoft website for full details of the potential exposure from the caveat, which is referenced on the Microsoft Security page.


Problem Symptoms

It is important to point out that Cisco Contact Center Support has not had any cases pertaining to these vulnerabilities recorded from our customer base as of April 13, 2011.


Workaround/Solution

Cisco has assessed and, where deemed appropriate, validated the Microsoft security patches addressed in this bulletin along with any workarounds for the problems found.

Cisco recommends that Contact Center customers separately assess all security patches released by Microsoft and install those deemed appropriate for their environments. Cisco will continue to provide a service of separately assessing and, where necessary, validating higher severity security patches that may be relevant to the Cisco Contact Center and Self Service products. Visit the Microsoft website to acquire the fixes. Keep in mind that you should download the appropriate fixes based on the version of the Microsoft operating system deployed in your environment and service pack level.


Additional Information

If you require further assistance, or if you have questions regarding this Impact Assessment, please contact the Cisco Systems Technical Assistance Center (TAC) by one of the following methods:


This document is provided on an "as is" basis and does not imply any kind of guarantee or warranty, including the warranties of merchantability or fitness for a particular use. Your use of the information on the document or materials linked from the document is at your own risk. Cisco reserves the right to change or update this document at any time.

Back to Top

Cisco Security Center