CTIOS - 4.6.2, 4.7, 5.0, and 5.1, all service releases
Cisco Internet Service Node - Versions 1.0, 2.0 and 2.1
ICM Enterprise - 4.6.2, 5.0, and 6.0,all service releases
ICM Hosted - 4.6.2 and 5.0, all service releases
IPCC Enterprise - 4.6.2, 5.0, and 6.0,all service releases
IPCC Hosted - 4.6.2 and 5.0, all service releases
On October 12, 2004. Microsoft released the following security updates:
Note: If not otherwise specified, security bulletin applies to all Service Packs for noted operating system or application
MS04-038 Critical
Cumulative Security Update for Internet Explorer (834707)
Affected Software:
Internet Explorer 5.01
Internet Explorer 5.01 SP3
Internet Explorer 5.5
Internet Explorer 5.5 SP2
Internet Explorer 6
Internet Explorer 6.0 for Windows Server 2003
Internet Explorer 6.0 for Windows XP Service Pack 2
Internet Explorer 5.01 SP4
Internet Explorer 6 Gold
Internet Explorer 6 SP1
MS04-037 Critical
Vulnerability in Windows Shell Could Allow Remote Code Execution (841356)
Affected Software:
Windows NT Server 4.0
Windows NT Server 4.0, Enterprise Edition
Windows NT Server 4.0, Terminal Server Edition
Windows 2000 Advanced Server
Windows 2000 Datacenter Server
Windows 2000 Server
Windows 2000 Professional
MS04-036 Critical
Vulnerability in NNTP Could Allow Code Execution (883935)
Affected Software:
Windows NT Server 4.0
Windows NT Server 4.0, Enterprise Edition
Windows 2000 Advanced Server
Windows 2000 Datacenter Server
Windows 2000 Server
MS04-035 Critical
Vulnerability in SMTP Could Allow Remote Code Execution (885881)
Affected Software:
Windows Server 2003 systems
MS04-034 Critical
Vulnerability in Compressed (zipped) Folders Could Allow Code Execution (873376)
Affected Software:
Windows XP Home Edition
Windows XP Professional
Windows Server 2003
MS04-033 Critical
Vulnerability in Microsoft Excel Could Allow Code Execution (886836)
Affected Software:
Office 2000
Office XP
MS04-032 Critical
Security Update for Microsoft Windows (840987)
Affected Software:
Windows NT Server 4.0
Windows NT Server 4.0, Enterprise Edition
Windows NT Server 4.0, Terminal Server Edition
Windows 2000 Advanced Server
Windows 2000 Datacenter Server
Windows 2000 Professional
Windows 2000 Server
Windows XP Home Edition
Windows XP Professional
MS04-031 Important
Vulnerability in NetDDE Could Allow Remote Code Execution (841533)
Affected Software:
Windows NT Server 4.0
Windows NT Server 4.0, Enterprise Edition
Windows NT Server 4.0, Terminal Server Edition
Windows 2000 Advanced Server
Windows 2000 Datacenter Server
Windows 2000 Professional
Windows 2000 Server
MS04-030 Critical
Vulnerability in WebDav XML Message Handler Could Lead to a Denial of Service (824151)
Affected Software:
Windows 2000 Advanced Server
Windows 2000 Datacenter Server
Windows 2000 Professional
Windows 2000 Server
Windows XP Home Edition
Windows XP Professional
MS04-029 Important
Affected Software:
Windows NT Server 4.0
Windows NT Server 4.0, Enterprise Edition
Windows NT Server 4.0, Terminal Server Edition
For additional information on Microsoft security updates, see the Microsoft Security page.
Cisco evaluates Microsoft security notices and updates for potential impact to Cisco Contact Center products.
The qualification process results in one of four categorical ratings being applied to a given update: Impacting, Not Impacting, Deferred, or Not Applicable.
The four ratings are defined in the Cisco Customer Contact Software Policy For Use of Third-Party Software and Security Updates document.
For the security updates listed in Problem Description section of this bulletin, Cisco has assigned the updates to the following categories:
Impacting
MS04-032 Security Update for Microsoft Windows (840987)
MS04-031 Vulnerability in NetDDE Could Allow Remote Code Execution (841533)
Deferred
MS04-038 Cumulative Security Update for Internet Explorer (834707)
MS04-037 Vulnerability in Windows Shell Could Allow Remote Code Execution (841356)
MS04-034 Vulnerability in Compressed (zipped) Folders Could Allow Code Execution (873376)
Not Applicable
MS04-036 Vulnerability in NNTP Could Allow Code Execution (883935)
MS04-035 Vulnerability in SMTP Could Allow Remote Code Execution (885881)
MS04-033 Vulnerability in Microsoft Excel Could Allow Code Execution (886836)
MS04-030 Vulnerability in WebDav XML Message Handler Could Lead to a Denial of Service (824151)
For additional information on securing an ICM system, see Security Best Practices for Cisco Intelligent Contact Management Software.
Customers should follow Microsoft's guidelines regarding when and how they should apply these updates. Refer to the Microsoft website for full details of the potential exposure from the caveat is referenced on the Microsoft Security page.
It is important to point out that Cisco Contact Center Support has not had any cases pertaining to this threat recorded from our customer base as of October 12, 2004.
Cisco has assessed, and where deemed appropriate, validated the Microsoft security patches addressed in this bulletin.
Cisco recommends that Contact Center customers separately assess all security patches released by Microsoft and install those deemed appropriate for their environments.
Cisco will continue to provide a service of separately assessing and where necessary, validating higher severity security patches that may be relevant to the Contact Center Enterprise software products.
Visit the Microsoft website to acquire the fixes. Keep in mind that you should download the appropriate fixes based on the version of the Microsoft operating system deployed in your environment and service pack level.
If you require further assistance, or if you have any further questions regarding this field notice, please contact the Cisco Systems Technical Assistance Center (TAC) by one of the following methods:
Product Alert Tool - Set up a profile to receive email updates about reliability, safety, network security, and end-of-sale issues for the Cisco products you specify.