Impact Assessment of September 2009 Microsoft Security Bulletins on Cisco Contact Center and Self Service Products

September 10, 2009

Affected Products

Product
Version
Cisco Unified Intelligent Contact Management Enterprise (ICME)

6.0 and 7.x(x), all SRs/MRs

Cisco Unified Contact Center Enterprise (CCE)

6.0 and 7.x(x), all SRs/MRs

Cisco Unified Intelligent Contact Management Hosted (ICMH)

7.x(x), all MRs

Cisco Unified Contact Center Hosted (CCH)

7.x(x), all MRs

Cisco Unified Computer Telephony Integration Object Server (CTI OS)

6.0 and 7.x(x), all SRs/MRs

Cisco Agent Desktop (CAD)

6.x(x) and 7.x(x), all SRs

E-Mail Interaction Manager (EIM)

4.2(x), all MRs

Web Interaction Manager (WIM)

4.2(x), all MRs

Cisco Customer Voice Portal (CVP)

3.0, 3.1, 4.x and 7.0, all SRs

Cisco Unified Intelligence Suite (CUIS)

7.x(x) all MRs


Problem Description

On September 8, 2009, Microsoft released the following security bulletins:

MS09-045: Critical
Vulnerability in JScript Scripting Engine Could Allow Remote Code Execution (971961)
Affected Supported Software:

  • Microsoft Windows 2000 Service Pack 4
  • Microsoft Windows Server 2003 Service Pack 2
  • Microsoft Windows XP Service Pack 2
  • Microsoft Windows XP Service Pack 3
  • Microsoft Windows Vista Enterprise Service Pack 1

MS09-046: Critical
Vulnerability in DHTML Editing Component ActiveX Control Could Allow Remote Code Execution (956844)
Affected Supported Software:

  • Microsoft Windows 2000 Service Pack 4
  • Microsoft Windows Server 2003 Service Pack 2
  • Microsoft Windows XP Service Pack 2
  • Microsoft Windows XP Service Pack 3

MS09-047: Critical
Vulnerabilities in Windows Media Format Could Allow Remote Code Execution (973812)
Affected Supported Software:

  • Microsoft Windows 2000 Service Pack 4
  • Microsoft Windows Server 2003 Service Pack 2
  • Microsoft Windows XP Service Pack 2
  • Microsoft Windows XP Service Pack 3
  • Microsoft Windows Vista Enterprise Service Pack 1

MS09-048: Critical
Vulnerabilities in Windows TCP/IP Could Allow Remote Code Execution (967723)
Affected Supported Software:

  • Microsoft Windows 2000 Service Pack 4
  • Microsoft Windows Server 2003 Service Pack 2
  • Microsoft Windows Vista Enterprise Service Pack 1

MS09-049: Critical
Vulnerability in Wireless LAN AutoConfig Service Could Allow Remote Code Execution (970710)
Affected Supported Software:

  • Microsoft Windows Vista Enterprise Service Pack 1

Background

Cisco evaluates Microsoft security notices and updates for potential impact to Cisco Contact Center products. The qualification process results in the application of one of three categorical ratings to an update: Impacting, Deferred, or Not Applicable. These ratings are defined in the Cisco Customer Contact software policy for using Microsoft security updates on products deployed on a retail installation of Windows operating system bulletin. The cumulative set of security patches available from Microsoft—including those marked here as Deferred—are applied to Microsoft Windows Server 2003 (current supported Service Pack) and/or the appropriate component prior to Cisco's testing of every release of the Customer Contact Business Unit (CCBU) products (major, minor, and maintenance).

For the security updates listed in the Problem Description section of this bulletin, Cisco has assigned them to the three categories as follows:

Impacting

  • MS09-048: Vulnerabilities in Windows TCP/IP Could Allow Remote Code Execution (967723)
  • MS09-049: Vulnerability in Wireless LAN AutoConfig Service Could Allow Remote Code Execution (970710)

Deferred

  • MS09-045: Vulnerability in JScript Scripting Engine Could Allow Remote Code Execution (971961)
  • MS09-046: Vulnerability in DHTML Editing Component ActiveX Control Could Allow Remote Code Execution (956844)
  • MS09-047: Vulnerabilities in Windows Media Format Could Allow Remote Code Execution (973812)

Not Applicable

  • None

Care should be taken in deciding which updates to apply to your systems. For additional information on the security measures to be considered in an ICM environment, refer to the Security Best Practices for Cisco Intelligent Contact Management Software Guide.

For the Security Updates categorized as Impacting, Cisco continues to test its products to determine if there are further potential conflicts.

Product
Version
Tested
(Y/I*)
Components Tested
(All or Specific)
ICM / CCE / CCH

7.0(0) SR4
7.2(7)
7.5(6)

Y

All ICM/CCE/CCH 7.0 components tested on Windows Server 2003 SP2. All ICM/CCE/CCH 7.2 & 7.5 components tested on Windows Server 2003 R2 SP2.

CTI OS

7.2(7)
7.5(6)

Y

CTI OS 7.x components tested on Windows Server 2003 R2 SP2; Agent Desktop 7.5 tested on Windows Vista Enterprise SP1.

CAD

7.5(6)

Y

CAD server components tested on Windows Server 2003 R2 SP2; Agent, Supervisor and Admin Desktops on Windows Vista Business SP1, Internet Explorer 8.0.

EIM / WIM

EIM 4.2(5)
WIM 4.2(5)

Y

EIM / WIM server components tested on Windows 2003 Server SP2.

CVP

3.1(0) SR2
4.1(1)
7.0(2)

Y

CVP 4.x and 7.0 components tested on Windows Server 2003 SP2.

CUIS

7.5(3)

Y

CUIS 7.x components tested on Windows Server 2003 SP2.

* Testing Disposition

  • I: In Progress (indicating that testing is in progress and will be updated when complete)
  • Y: Yes (tested)
  • NA: Not Applicable (none of the security updates are being tested because of a Not Applicable or Deferred assessment)

Customers should follow Microsoft's guidelines regarding when and how they should apply these updates. Refer to the Microsoft website for full details of the potential exposure from the caveat, which is referenced on the Microsoft Security page.


Problem Symptoms

It is important to point out that Cisco Contact Center Support has not had any cases pertaining to these vulnerabilities recorded from our customer base as of September 10, 2009.


Workaround/Solution

Cisco has assessed and, where deemed appropriate, validated the Microsoft security patches addressed in this bulletin along with any workarounds for the problems found.

Cisco recommends that Contact Center customers separately assess all security patches released by Microsoft and install those deemed appropriate for their environments. Cisco will continue to provide a service of separately assessing and, where necessary, validating higher severity security patches that may be relevant to the Cisco Contact Center and Self Service products. Visit the Microsoft website to acquire the fixes. Keep in mind that you should download the appropriate fixes based on the version of the Microsoft operating system deployed in your environment and service pack level.


Additional Information

If you require further assistance, or if you have questions regarding this Impact Assessment, please contact the Cisco Systems Technical Assistance Center (TAC) by one of the following methods:


This document is provided on an "as is" basis and does not imply any kind of guarantee or warranty, including the warranties of merchantability or fitness for a particular use. Your use of the information on the document or materials linked from the document is at your own risk. Cisco reserves the right to change or update this document at any time.

Back to Top

Cisco Security Center