Operating System Upgrade Service Release 2000.4.6SR9 (win-OS-Upgrade-K9.2000-4-6-SR9.exe)

Release date: 21-April-2009

Document Revision 1

Microsoft provides monthly releases of security hotfixes on the 2nd Tuesday of each month.  Cisco’s monthly OS Service Release is scheduled to post on the 3rd Tuesday of each month.

Cisco will continue to test and release Microsoft hotfixes that meet our criteria for Critical hotfixes in 1 business day.  Any applicable critical hotfix released by Microsoft will be added to the Cisco IP Telephony Operating System, SQL Server, Security Updates document with and explanation about whether or not it is critical for Cisco IP Telephony servers and when it will be released by Cisco.

Caution:  Do not apply this service release with OS version 2000.4.4a or previous OS release trains.  This service release is only compatible with the OS 2000.4.6 release train.  You should apply this service release to all servers in your cluster.  This installation causes call-processing interruptions and requires a reboot.  Close all programs before proceeding including Internet Explorer to avoid conflicts with the software being installed and/or upgraded.

General Note: If the following messages are displayed during the installation, please click “OK” and continue. These will not affect this upgrade. The causes for these messages are under investigation:
            * The Instruction at "0X0cda00dd8" referenced memory at "0X0cda00dd8". The memory could not be read. Click OK to terminate the program (CSCeb31088)
            * The Instruction at "0X000000000" referenced memory at "0X000000000". The memory could not be read. Click OK to terminate the program (CSCed45218)
            * AddAnonymousWebUserAccess failure during CallManager installations (CSCed27066)

Naming Convention Change

 For operating system, SQL Server, and Cisco IP telephony application software updates, Cisco has replaced the term, support patch, with the term, service release.  Service releases provide the same functionality as support patches; that is, they provide bug fixes, etc.  

 Review the file naming convention before you apply the software update.

 <software_name>-<software version>_<sr(x)>

 <software name> equals the name of the application; <software version> equals the maintenance release; <sr(x)> equals the version of the service release

 For example, review the following file name:

 win-OS-Upgrade-K9.2000-4-2sr2.exe

 win-OS-Upgrade indicates that this file is an operating system upgrade file; K9 indicates that you download the file from the Cisco cryptographic website; 2000-4-2 indicates the operating system maintenance release version, and sr2 indicates that this file is the first version of the operating system upgrade service release.

Contents

This document contains information on the following topics.  Click the hyperlink to go directly to the section.

·         Cisco Notification Tools

This section provides information about how to receive email notifications when new updates post to Cisco Connection Online.

·         Information about This Service Release

This section provides general information and specifies the affected Cisco IP telephony applications, supported servers, and hotfixes that are automatically installed with this software update.

·         Installing the Service Release

This section provides procedures for installing this service release on supported servers.

·         Verifying Hotfixes By Using Microsoft Baseline Security Analyzer

This section provides a list of hotfixes that Microsoft Baseline Security Analyzer and QFEcheck verify.  See this section if you want to verify which hotfixes exist on your server.

·         Uninstalling Hotfixes

This section provides information about how to uninstall the Microsoft hotfixes.

Cisco Notification Tools

Cisco CallManager Notification Tool: Cisco has replaced the current Cisco CallManager notification tool with a new, more robust notification tool that is based on your Cisco.com profiles.  This new tool delivers email notifications for individual Cisco voice products that you select.  Follow the steps below to sign up for the Cisco Voice Technology Group Subscription Tool:

·         Login with your Cisco.com account information at this link: http://www.cisco.com/cgi-bin/Software/Newsbuilder/Builder/VOICE.cgi

·         Select "CallManager Cryptographic Software including OS updates" to receive notification when new operating system updates are posted.

·         Select any other products updates that you wish to receive.

·         Click update at the bottom of the page.

·         Confirm your selections.

You may see this message at the bottom of the page: "Your Profile Currently Indicates that you do not wish to receive email from Cisco.”

To be able to receive information updates, you must update your email preferences.  Click on the link to update your email preferences (located in the Other Information section).  Click submit when you are done.  

If you have enabled email notification, you may exit now.  If you have not enabled email notification, then you will need to repeat the steps above.

This new software notification tool requires a valid Cisco.com login. If you do not currently have a Cisco.com password, please register with Cisco.com at: http://tools.cisco.com/RPF/register/register.do

Cisco PSIRT Advisory Notification Tool: This email service provides automatic notification of all Cisco Security Advisories that are released by the Cisco Product Security Incident Response Team (PSIRT).  Security Advisories, which describe security issues that directly impact Cisco products, provide a set of required actions to repair these products. To subscribe, click the following URL and perform the tasks as directed on the web page: http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html#SecurityInfo

Information about This Service Release

Review the following information before you install the service release:

 ·         Cumulative Severity:  Critical

 ·         Description: OS Upgrade 2000.4.6 Service Release 9

 ·       Minimum OS requirements: Any OS version upgraded with win-OS-Upgrade-K9.2000-4-6.exe or Fresh install of OS 2000.4.6

 ·       Affected Cisco IP Telephony Applications:  All versions of Cisco CallManager and all compatible versions of Cisco IP Interactive Voice Response (IP IVR), Cisco IP Call Center Express (IPCC Express), Cisco Personal Assistant (PA), Cisco Emergency Responder (CER), Cisco Conference Connection (CCC), Cisco Customer Voice Portal (CVP), Cisco IP Queue Manager and Cisco MeetingPlace.

 ·           Supported Servers:  All of the Cisco Media Convergence Servers (MCS) and Cisco-approved, customer-provided Compaq/HP and IBM server supported by 2000.4.6 fresh install and upgrades.  For further information see the Hardware Compatibility Matrixes at the following location:

http://www.cisco.com/en/US/products/sw/voicesw/ps556/products_device_support_tables_list.html

 ·         Install time: < 15 Minutes per server

 ·         Reboot required: Yes

 ·         Replaces previously posted files: Previous 2000.4.6 Service Releases

 ·         Log File Location: C:\Program Files\Common Files\Cisco\Logs\OS

 ·         Known Caveats: Please refer to the ‘Known Caveats’ section below.

Note:  Apply this service release to all servers in your cluster.

Caution:  This installation causes call-processing interruptions and requires a reboot.  Close all programs before proceeding including Internet Explorer.

This service release includes the following hotfixes: 

Installing the Service Release

Perform the following procedure to install the service release:

1.      Disable all virus scanning software or Intrusion Detect Software prior to running this installation.

2.      Download the file to a location that you will remember.

3.      Double click the executable.

4.      To acknowledge that the server runs OS upgrade version 2000.4.6 and that you are not installing the service release through Terminal Services, click Yes.  If the server does not run OS upgrade version 2000.4.6, install it before you run this service release.

5.      Files automatically extract and install on the server.

6.      After the installation finishes, it will report the number of errors detected and ask if you want to view the logfile.

7.      If there are no errors detected, you can select “No”; otherwise click yes to view the log.  There is an ERRORS section at the very end of the logfile to assist in finding the errors.

8.      Click OK to confirm the reboot

9.      Perform this procedure on all supported servers in the cluster.

10.  If you choose to do so, you can use the Baseline Security Analyzer to verify the hotfixes that are installed on each server.  See the “Verifying HotFixes By Using Baseline Security Analyzer” section.

Verifying HotFixes By Using Microsoft Baseline Security Analyzer

If you want to do so, you can use the Microsoft Baseline Security Analyzer utility (run c:\utils\mbsa_scan.cmd) to verify which hotfixes are installed on the server.

Microsoft Baseline Security Analyzer (MBSA)

Make sure that you review the Reason column of the MBSA report to identify whether the hotfix should be installed.  The following table shows expected results from MBSA on a fully patched system.   

Scanned with MBSA version: 2.1.2104.0

Catalog synchronization date: 2009-04-13T22:28:16Z

Security update catalog: Microsoft Update (offline)

Security Updates Scan Results

Issue: SDK Components Security Updates

Score: Check passed

Result: No security updates are missing.

Current Update Compliance

| MS07-028 | Installed | Security Update for CAPICOM (KB931906) | Critical |

Issue: SQL Server Security Updates

Score: Check passed

Result: No security updates are missing.

Current Update Compliance

| MS09-004 | Installed | Security Update for SQL Server 2000 Service Pack 4 (KB960082) | Important |

Issue: Windows Security Updates

Score: Check failed (non-critical)

Result: 1 service packs or update rollups are missing.

Update Rollups and Service Packs

| 890830 | Missing | Windows Malicious Software Removal Tool - April 2009 (KB890830) | |

Current Update Compliance

| MS03-008 | Installed | 814078: Security Update (Microsoft Jscript version 5.5, Windows 2000) | |

| MS02-050 | Installed | Q329115: Security Update (Windows 2000) | |

| MS03-011 | Installed | 816093: Security Update Microsoft Virtual Machine (Microsoft VM) | Critical |

| MS04-016 | Installed | Security Update for DirectX 9.0 (KB839643) | Moderate |

| MS04-016 | Installed | Security Update for DirectX 8.0 (KB839643) | Moderate |

| MS04-016 | Installed | Security Update for DirectX 8.1 (KB839643) | Moderate |

| MS04-013 | Installed | Cumulative Security Update for Outlook Express 5.5 Service Pack 2 (KB837009) | Critical |

| MS04-008 | Installed | Security Update for Windows Media Services (KB832359) | Moderate |

| MS05-036 | Installed | Security Update for Windows 2000 (KB901214) | Critical |

| MS05-040 | Installed | Security Update for Windows 2000 (KB893756) | Important |

| MS05-041 | Installed | Security Update for Windows 2000 (KB899591) | Moderate |

| MS05-042 | Installed | Security Update for Windows 2000 (KB899587) | Moderate |

| MS05-043 | Installed | Security Update for Windows 2000 (KB896423) | Critical |

| MS04-016 | Installed | Security Update for DirectX 8.2 (KB839643) | Moderate |

| MS05-045 | Installed | Security Update for Windows 2000 (KB905414) | Moderate |

| MS05-046 | Installed | Security Update for Windows 2000 (KB899589) | Important |

| MS05-048 | Installed | Security Update for Windows 2000 (KB901017) | Important |

| MS05-050 | Installed | Security Update for DirectX 8 for Windows 2000 (KB904706) | Critical |

| MS05-027 | Installed | Security Update for Windows 2000 (KB896422) | Important |

| MS05-026 | Installed | Security Update for Windows 2000 (KB896358) | Important |

| MS05-049 | Installed | Security Update for Windows 2000 (KB900725) | Important |

| MS05-047 | Installed | Security Update for Windows 2000 (KB905749) | Important |

| MS05-044 | Installed | Security Update for Internet Explorer 6 Service Pack 1 for Windows 2000 (KB905495) | Moderate |

| MS05-050 | Installed | Security Update for Windows 2000 (KB904706) | Critical |

| MS06-002 | Installed | Security Update for Windows 2000 (KB908519) | Critical |

| MS06-006 | Installed | Security Update for Windows Media Player Plug-in (KB911564) | Important |

| MS06-005 | Installed | Security Update for Windows Media Player 7.1 for Windows 2000 (KB911565) | Important |

| MS06-015 | Installed | Security Update for Windows 2000 (KB908531) | Critical |

| MS06-022 | Installed | Security Update for Internet Explorer 6 Service Pack 1 (KB918439) | Critical |

| MS06-018 | Installed | Security Update for Windows 2000 (KB913580) | Moderate |

| MS06-025 | Installed | Security Update for Windows 2000 (KB911280) | Critical |

| MS06-036 | Installed | Security Update for Windows 2000 (KB914388) | Critical |

| MS06-044 | Installed | Security Update for Windows 2000 (KB917008) | Critical |

| MS06-050 | Installed | Security Update for Windows 2000 (KB920670) | Important |

| MS06-041 | Installed | Security Update for Windows 2000 (KB920683) | Critical |

| MS06-045 | Installed | Security Update for Windows 2000 (KB921398) | Moderate |

| MS06-034 | Installed | Security Update for Windows 2000 (KB917537) | Important |

| MS06-053 | Installed | Security Update for Windows 2000 (KB920685) | Moderate |

| MS06-057 | Installed | Security Update for Windows 2000 (KB923191) | Critical |

| MS06-066 | Installed | Security Update for Windows 2000 (KB923980) | Important |

| MS06-070 | Installed | Security Update for Windows 2000 (KB924270) | Critical |

| MS06-074 | Installed | Security Update for Windows 2000 (KB926247) | Important |

| MS07-008 | Installed | Security Update for Windows 2000 (KB928843) | Critical |

| MS07-012 | Installed | Security Update for Windows 2000 (KB924667) | Important |

| MS07-013 | Installed | Security Update for Windows 2000 (KB918118) | Important |

| MS07-011 | Installed | Security Update for Windows 2000 (KB926436) | Important |

| MS07-017 | Installed | Security Update for Windows 2000 (KB925902) | Critical |

| MS07-021 | Installed | Security Update for Windows 2000 (KB930178) | Critical |

| MS06-068 | Installed | Security Update for Windows 2000 (KB920213) | Critical |

| MS07-009 | Installed | Security Update for Microsoft Data Access Components 2.8 Service Pack 1 (KB927779) | Critical |

| MS07-035 | Installed | Security Update for Windows 2000 (KB935839) | Critical |

| MS07-022 | Installed | Security Update for Windows 2000 (KB931784) | Important |

| MS06-078 | Installed | Security Update for Windows Media Player 6.4 (KB925398) | Critical |

| MS07-039 | Installed | Security Update for Windows 2000 (KB926122) | Critical |

| MS07-047 | Installed | Security Update for Windows Media Player 9 (KB936782) | Important |

| MS07-051 | Installed | Security Update for Windows 2000 (KB938827) | Critical |

| 891861 | Installed | Update Rollup 1 for Windows 2000 Service Pack 4 (KB891861) | |

| MS07-058 | Installed | Security Update for Windows 2000 (KB933729) | Low |

| MS07-055 | Installed | Security Update for Windows 2000 (KB923810) | Critical |

| MS07-068 | Installed | Security Update for Windows 2000 (KB941569) | Critical |

| MS07-065 | Installed | Security Update for Windows 2000 (KB937894) | Important |

| MS08-002 | Installed | Security Update for Windows 2000 (KB943485) | Important |

| MS08-005 | Installed | Security Update for Windows 2000 (KB942831) | Important |

| MS08-008 | Installed | Security Update for Windows 2000 (KB943055) | Critical |

| MS08-020 | Installed | Security Update for Windows 2000 (KB945553) | Important |

| MS08-022 | Installed | Security Update for Windows 2000 (KB944338) | Critical |

| MS08-028 | Installed | Security Update for Windows 2000 (KB950749) | Critical |

| MS08-032 | Installed | Cumulative Security Update for ActiveX Killbits for Windows 2000 (KB950760) | Moderate |

| MS08-037 | Installed | Security Update for Windows 2000 (KB951748) | Important |

| MS08-048 | Installed | Security Update for Outlook Express 6 Service Pack 1 (KB951066) | Important |

| MS08-049 | Installed | Security Update for Windows 2000 (KB950974) | Important |

| MS08-046 | Installed | Security Update for Windows 2000 (KB952954) | Critical |

| MS08-052 | Installed | Security Update for Internet Explorer 6 for Windows 2000 (KB938464) | Critical |

| MS08-062 | Installed | Security Update for Windows 2000 (KB953155) | Important |

| MS08-067 | Installed | Security Update for Windows 2000 (KB958644) | Critical |

| MS08-069 | Installed | Security Update for Windows 2000 (KB955069) | Critical |

| MS08-069 | Installed | Security Update for Microsoft XML Core Services 4.0 Service Pack 2 (KB954430) | Important |

| MS08-068 | Installed | Security Update for Windows 2000 (KB957097) | Important |

| MS08-076 | Installed | Security Update for Windows 2000 (KB954600) | Important |

| MS08-071 | Installed | Security Update for Windows 2000 (KB956802) | Critical |

| MS08-076 | Installed | Security Update for Windows 2000 (KB952069) | Important |

| MS09-001 | Installed | Security Update for Windows 2000 (KB958687) | Critical |

| 960715 | Installed | Update Rollup for ActiveX Killbits for Windows 2000 (KB960715) | |

| MS09-008 | Installed | Security Update for Windows 2000 (KB961063) | Important |

| MS09-007 | Installed | Security Update for Windows 2000 (KB960225) | Important |

| MS09-006 | Installed | Security Update for Windows 2000 (KB958690) | Critical |

| MS09-010 | Installed | Security Update for Windows 2000 (KB923561) | Important |

| MS09-011 | Installed | Security Update for DirectX 9 for Windows 2000 (KB961373) | Critical |

| MS09-012 | Installed | Security Update for Windows 2000 (KB952004) | Important |

| MS09-013 | Installed | Security Update for Windows 2000 (KB960803) | Critical |

| MS09-015 | Installed | Security Update for Windows 2000 (KB959426) | Low |

| MS09-014 | Installed | Cumulative Security Update for Internet Explorer 6 Service Pack 1 (KB963027) | Critical |

Known Caveats

• CSCsd18255 is only resolved if a product that contains MS SQL Server 2000/MSDE 2000 is already installed.   If this SR is installed prior to installation of the product, it may generate an error in the installation log.  This is normal.  After the product containing SQL is installed, c:\utils\CSCsd18255.exe will need to be executed and the server rebooted.

• CSCsx44463 is is only resolved if a product that contains MS SQL Server 2000/MSDE 2000 is already installed. 

• Several security updates, such as MS07-009, MS08-069 or MS09-004 are only resolved when executing this SR AFTER the application is installed. (ie CallManager or CRS)

Uninstalling Hotfixes

 If you need to uninstall this OS Service Release or one of its hotfixes, follow the uninstall procedures exactly as they appear in this section.  Most hotfixes have an uninstall program provided by Microsoft, but there are caveats associated with uninstalling the hotfixes, This section provides procedures to uninstall a single hotfix and to uninstall the entire OS Service Release.

Perform the following procedure to uninstall a single hotfix:

1.      Verify whether the hotfix can be uninstalled by checking the Uninstall Supported column of the Hotfixes That Are Included in the Service Release table.  If No displays in that column, you cannot use this procedure to uninstall the hotfix.  The only way to return the server to a state without the hotfix, is to fail back to a saved copy of the mirrored drive or rebuild the server, install the IP Telephony application, and restore the database.  If Yes displays in the Uninstall Supported column, continue with Step 2.

2.      Choose Start > Settings > Control Panel > Add/Remove Programs.  Hotfixes appear near the bottom of the Add/Remove Programs window.  Each hotfix begins with Windows 2000 Hotfix and is followed by the Microsoft Knowledge Base (KB or Q) article number.  You can use the Hotfixes That Are Included in the Service Release table to convert the security bulletin number (MS05-053) to a KB or Q number (KB896424).

3.      Select the hotfix you want to uninstall and click Change/Remove.  The Windows 2000 <hotfix number> Removal Wizard displays. 

4.      Click Next.  The steps may differ, depending on the uninstall program provided with the hotfix.  If a window appears with a message asking whether you want to uninstall the hotfix, click Yes.

5.      It’s very likely that the Inspecting Current Configuration step of the Removal Wizard will detect a list of hotfixes or programs that may be affected by removing this hotfix.  Record this list.  All the hotfixes listed will need to be re-installed and any applications listed should be checked to confirm they are still working properly.  Removing this hotfix will replace the system files it backed up with it was originally installed.  Other hotfixes or applications may be dependant on these same files.  The Removal Wizard does not know whether or not the applications or hotfixes will be affected.  It just has detected that they have been installed after the hotfix being removed was installed.  After recording the list, click Yes.

6.      Click Finish.  The server will reboots, if needed.  If you are prompted to reboot, click Yes.

7.      If the Inspecting Current Configuration step of the Removal Wizard listed any other hotfixes, reinstall those hotfixes now.  The last OS Service Release with the individual hotfix installations can be found in c:\Program Files\Cisco\Updates\2000.4.6SR#, where “#” equals the Service Release number (for example, 2000.4.6SR1).  The files will be named by their KB or Q number and should match what you have written down.  Double-click the first hotfix that is on your list of hotfixes that need to be reinstalled, and follow the prompts to install the hotfix.  Repeat this step for each hotfix you need to reinstall.  You do not need to reboot between hotfixes.  Once you have reinstalled all the hotfixes on your list, reboot the server.

8.      If the Inspecting Current Configuration step of the Removal Wizard listed any applications, confirm that they are still working properly.

Perform the following procedure to uninstall this entire OS Service Release:

1.      In order to determine what hotfixes need to be uninstalled, you need to determine what the OS level was before you applied this Service Release.  The minimum OS level for this Service Release is OS Upgrade 2000.4.5a, so that is the starting point.  To determine what Service Releases where applied after OS Upgrade 2000.4.5a, use the History.log file.  Click Start > Cisco Install Logs  (C:\Program Files\Common Files\Cisco\Logs)

2.      Double-click History.log (or just History if known file extensions are hidden)

3.      Find OS Upgrade 2000.4.6 and search down the list for the last 2000.4.6SR# before the one you are trying to uninstall.  Record this Service Release number.

4.      Use the Hotfixes That Are Included in the Service Release table to find all the hotfixes installed after the Service Release recorded in the previous step.

5.      Choose Start > Settings > Control Panel > Add/Remove Programs.  Hotfixes appear near the bottom of the Add/Remove Programs window.  Each hotfix begins with Windows 2000 Hotfix and is followed by the Microsoft Knowledge Base (KB or Q) article number.  You can use the Hotfixes That Are Included in the Service ReleaseHotfixes That Are Included in the Service Release table to convert the security bulletin number (e.g. MS05-053) to a KB or Q number (e.g. KB896424).

6.      Select the hotfix you want to uninstall and click Change/Remove.  The Windows 2000 <hotfix number> Removal Wizard displays. 

7.      Click Next.  The steps may differ, depending on the uninstall program provided with the hotfix.  If a window appears with a message asking whether you want to uninstall the hotfix, click Yes.

8.      It’s very likely that the Inspecting Current Configuration step of the Removal Wizard will detect a list of hotfixes or programs that may be affected by removing this hotfix.  Record this list.  All the hotfixes listed will need to be re-installed and any applications listed should be checked to confirm they are still working properly.  Removing this hotfix will replace the system files it backed up with it was originally installed.  Other hotfixes or applications may be dependant on these same files.  The Removal Wizard does not know whether or not the applications or hotfixes will be affected.  It just has detected that they have been installed after the hotfix being removed was installed.  After recording the list, click Yes.

9.      Click Finish.  The server will reboots, if needed.  If you are prompted to reboot, click Yes.

10.  Follow steps 6 - 9 until all the hotfix you want to uninstall have been removed.

11.  If the Inspecting Current Configuration step of the Removal Wizard listed any other hotfixes, reinstall those hotfixes now.  The last OS Service Release with the individual hotfix installations can be found in c:\Program Files\Cisco\Updates\2000.4.6SR#, where “#” equals the Service Release number (for example, 2000.4.5aSR1).  The files will be named by their KB or Q number and should match what you have written down.  Double-click the first hotfix that is on your list of hotfixes that need to be reinstalled, and follow the prompts to install the hotfix.  Repeat this step for each hotfix you need to reinstall.  You do not need to reboot between hotfixes.  Once you have reinstalled all the hotfixes on your list, reboot the server.

12.  If the Removal Wizard listed any applications in the Inspecting Current Configuration step, confirm that they are still working properly.