Impact Assessment of August 2009 Microsoft Security Bulletins on Cisco Contact Center and Self Service Products

August 13, 2009

Affected Products

Product
Version
ICM Enterprise

6.0 and 7.x(x), all SRs/MRs

IPCC Enterprise

6.0 and 7.x(x), all SRs/MRs

ICM Hosted

7.x(x), all MRs

IPCC Hosted

7.x(x), all MRs

Cisco CTI and CTI OS

6.0 and 7.x(x), all SRs/MRs

Cisco Agent Desktop

6.x(x) and 7.x(x), all SRs

E-Mail Interaction Manager

4.2(x), all MRs

Web Interaction Manager

4.2(x), all MRs

Cisco Customer Voice Portal

3.0, 3.1, 4.x and 7.0, all SRs

Cisco Unified Intelligence Suite

7.x(x) all MRs


Problem Description

On August 11, 2009, Microsoft released the following security bulletins:

MS09-037: Critical
Vulnerabilities in Microsoft Active Template Library (ATL) Could Allow Remote Code Execution (973908)
Affected Supported Software:

  • Microsoft Windows 2000 Service Pack 4
  • Microsoft Windows Server 2003 Service Pack 2
  • Microsoft Windows XP Service Pack 2
  • Microsoft Windows XP Service Pack 3
  • Microsoft Windows Vista Enterprise Service Pack 1

MS09-038: Critical
Vulnerabilities in Windows Media File Processing Could Allow Remote Code Execution (971557)
Affected Supported Software:

  • Microsoft Windows 2000 Service Pack 4
  • Microsoft Windows Server 2003 Service Pack 2
  • Microsoft Windows XP Service Pack 2
  • Microsoft Windows XP Service Pack 3
  • Microsoft Windows Vista Enterprise Service Pack 1

MS09-039: Critical
Vulnerabilities in WINS Could Allow Remote Code Execution (969883)
Affected Supported Software:

  • Microsoft Windows 2000 Service Pack 4
  • Microsoft Windows Server 2003 Service Pack 2

MS09-043: Critical
Vulnerabilities in Microsoft Office Web Components Could Allow Remote Code Execution (957638)
Affected Supported Software:

  • None

MS09-044: Critical
Vulnerabilities in Remote Desktop Connection Could Allow Remote Code Execution (970927)
Affected Supported Software:

  • Microsoft Windows 2000 Service Pack 4
  • Microsoft Windows Server 2003 Service Pack 2
  • Microsoft Windows XP Service Pack 2
  • Microsoft Windows XP Service Pack 3
  • Microsoft Windows Vista Enterprise Service Pack 1

MS09-036: Important
Vulnerability in ASP.NET in Microsoft Windows Could Allow Denial of Service (970957)
Affected Supported Software:

  • None

MS09-040: Important
Vulnerability in Message Queuing Could Allow Elevation of Privilege (971032)
Affected Supported Software:

  • None

MS09-041: Important
Vulnerability in Workstation Service Could Allow Elevation of Privilege (971657)
Affected Supported Software:

  • Microsoft Windows 2000 Service Pack 4
  • Microsoft Windows Server 2003 Service Pack 2
  • Microsoft Windows XP Service Pack 2
  • Microsoft Windows XP Service Pack 3
  • Microsoft Windows Vista Enterprise Service Pack 1

MS09-042: Important
Vulnerability in Telnet Could Allow Remote Code Execution (960859)
Affected Supported Software:

  • Microsoft Windows 2000 Service Pack 4
  • Microsoft Windows Server 2003 Service Pack 2
  • Microsoft Windows XP Service Pack 2
  • Microsoft Windows XP Service Pack 3
  • Microsoft Windows Vista Enterprise Service Pack 1

Background

Cisco evaluates Microsoft security notices and updates for potential impact to Cisco Contact Center products. The qualification process results in the application of one of three categorical ratings to an update: Impacting, Deferred, or Not Applicable. These ratings are defined in the Cisco Customer Contact software policy for using Microsoft security updates on products deployed on a retail installation of Windows operating system bulletin. The cumulative set of security patches available from Microsoft—including those marked here as Deferred—are applied to Microsoft Windows Server 2003 (current supported Service Pack) and/or the appropriate component prior to Cisco's testing of every release of the Customer Contact Business Unit (CCBU) products (major, minor, and maintenance).

For the security updates listed in the Problem Description section of this bulletin, Cisco has assigned them to the three categories as follows:

Impacting

  • MS09-039: Vulnerabilities in WINS Could Allow Remote Code Execution (969883)
  • MS09-041: Vulnerability in Workstation Service Could Allow Elevation of Privilege (971657)
  • MS09-044: Vulnerabilities in Remote Desktop Connection Could Allow Remote Code Execution (970927)

Deferred

  • MS09-037: Vulnerabilities in Microsoft Active Template Library (ATL) Could Allow Remote Code Execution (973908)
  • MS09-038: Vulnerabilities in Windows Media File Processing Could Allow Remote Code Execution (971557)
  • MS09-042: Vulnerability in Telnet Could Allow Remote Code Execution (960859)

Not Applicable

  • MS09-036: Vulnerability in ASP.NET in Microsoft Windows Could Allow Denial of Service (970957)
  • MS09-040: Vulnerability in Message Queuing Could Allow Elevation of Privilege (971032)
  • MS09-043: Vulnerabilities in Microsoft Office Web Components Could Allow Remote Code Execution (957638)

Care should be taken in deciding which updates to apply to your systems. For additional information on the security measures to be considered in an ICM environment, refer to the Security Best Practices for Cisco Intelligent Contact Management Software Guide.

For the Security Updates categorized as Impacting, Cisco continues to test its products to determine if there are further potential conflicts.

Product
Version
Tested
(Y/I*)
Components Tested
(All or Specific)
ICM / IPCC

6.0(0) SR12
7.0(0) SR4
7.2(7)
7.5(6)

Y

All ICM/IPCC 6.0 components tested on Windows 2000 Server SP4. All ICM/IPCC 7.0 components tested on Windows Server 2003 SP2. All ICM/IPCC 7.2 & 7.5 components tested on Windows Server 2003 R2 SP2.

CTI OS

6.0(0) SR5
7.2(7)
7.5(6)

Y

CTI OS 6.0 components tested on Windows 2000 Server SP4, CTI OS 7.x components tested on Windows Server 2003 R2 SP2; Agent Desktop 6.0 tested on Windows 2000 Professional SP4, Agent Desktop 7.x tested on Windows XP SP3, Agent Desktop 7.5 tested on Windows Vista Enterprise SP1 as well as Windows XP SP3.

CAD

7.5(6)

Y

CAD server components tested on Windows Server 2003 R2 SP2; Agent, Supervisor and Admin Desktops on Windows XP SP2, Windows Vista Business SP1, Internet Explorer 7.0.

EIM / WIM

EIM 4.2(5)
WIM 4.2(5)

Y

EIM / WIM server components tested on Windows 2003 Server SP2.

CVP

3.1(0) SR2
7.0(2)

Y

CVP 3.1 components tested on Windows 2000 Server SP4. CVP 7.0 components tested on Windows Server 2003 SP2.

CUIS

7.5(3)

Y

CUIS 7.x components tested on Windows Server 2003 SP2.

* Testing Disposition

  • I: In Progress (indicating that testing is in progress and will be updated when complete)
  • Y: Yes (tested)
  • NA: Not Applicable (none of the security updates are being tested because of a Not Applicable or Deferred assessment)

Customers should follow Microsoft's guidelines regarding when and how they should apply these updates. Refer to the Microsoft website for full details of the potential exposure from the caveat, which is referenced on the Microsoft Security page.


Problem Symptoms

It is important to point out that Cisco Contact Center Support has not had any cases pertaining to these vulnerabilities recorded from our customer base as of August 13, 2009.


Workaround/Solution

Cisco has assessed and, where deemed appropriate, validated the Microsoft security patches addressed in this bulletin along with any workarounds for the problems found.

Cisco recommends that Contact Center customers separately assess all security patches released by Microsoft and install those deemed appropriate for their environments. Cisco will continue to provide a service of separately assessing and, where necessary, validating higher severity security patches that may be relevant to the ICM/IPCC Enterprise and ICM/IPCC Hosted software products. Visit the Microsoft website to acquire the fixes. Keep in mind that you should download the appropriate fixes based on the version of the Microsoft operating system deployed in your environment and service pack level.


Additional Information

If you require further assistance, or if you have questions regarding this Impact Assessment, please contact the Cisco Systems Technical Assistance Center (TAC) by one of the following methods:


This document is provided on an "as is" basis and does not imply any kind of guarantee or warranty, including the warranties of merchantability or fitness for a particular use. Your use of the information on the document or materials linked from the document is at your own risk. Cisco reserves the right to change or update this document at any time.

Back to Top

Cisco Security Center