Products & Services
Support

Product Categories


Popular Downloads


Manage Software

How to Buy

For Home

Linksys Products Store
Linksys is now part of Belkin
Products for everyone

All Ordering Options

Training & Events Partners
Guest

Cisco Applied Mitigation Bulletin

Cisco Applied Mitigation Bulletin: Microsoft Security Bulletin for November 2010

 
Threat Type:IntelliShield: Applied Mitigation Bulletin
IntelliShield ID:21766
Version:3
First Published:2010 November 09 18:51 GMT
Last Published:2010 November 16 23:16 GMT
Port: Not available
CVE:CVE-2010-2572 , CVE-2010-2573 , CVE-2010-2732 , CVE-2010-2733 , CVE-2010-2734 , CVE-2010-3333 , CVE-2010-3334 , CVE-2010-3335 , CVE-2010-3336 , CVE-2010-3337 , CVE-2010-3936
Urgency:Unlikely Use
Credibility:Confirmed
Severity:Mild Damage
 
Version Summary:

IPS signature event data from Cisco Remote Management Services is available for IPS signatures from November 15, 2010.

 

Contents

Introduction
Device-Specific Mitigation and Identification
Additional Information
Cisco Security Procedures
Related Information

Introduction

Microsoft announced three security bulletins that address 11 vulnerabilities as part of the monthly security bulletin release on November 9, 2010. A summary of these bulletins is on the Microsoft website at http://www.microsoft.com/technet/security/bulletin/ms10-nov.mspx. This document highlights the vulnerabilities that can be effectively identified and/or mitigated using Cisco network devices.

The vulnerabilities that have a client software attack vector, require user interaction, can be exploited using web-based attacks (these include but are not limited to cross-site scripting, phishing, and web-based e-mail threats) or e-mail attachments, and files stored on network shares are in the following list:

Information about affected and unaffected products is available in the respective Microsoft advisories and the Cisco IntelliShield alerts that are referenced in the following table. In addition, multiple Cisco products use Microsoft operating systems as their base operating system. Cisco products that may be affected by the vulnerabilities described in the referenced Microsoft advisories are detailed in the "Associated Products" table in the "Product Sets" section.

Microsoft ID Description CVE ID IntelliShield Alert ID
MS10-087 Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (KB2423930) CVE-2010-3333 21716
CVE-2010-3334 21717
CVE-2010-3335 21718
CVE-2010-3336 21719
CVE-2010-3337 21720
MS10-088 Vulnerabilities in Microsoft Office PowerPoint Could Allow Remote Code Execution (KB2293386) CVE-2010-2572 21710
CVE-2010-2573 21711
MS10-089
Vulnerabilities in Forefront Unified Access Gateway (UAG) Could Cause Cross-Site Scripting Resulting in Elevation of Privilege? (KB2316074)
CVE-2010-2732 21712
CVE-2010-2733 21713
CVE-2010-2734 21714
CVE-2010-3936 21715

Vulnerability Characteristics

MS10-089, Vulnerabilities in Forefront Unified Access Gateway (UAG) Could Cause Cross-Site Scripting Resulting in Elevation of Privilege (KB2316074): These vulnerabilities have been assigned CVE identifiers CVE-2010-2732, CVE-2010-2733, CVE-2010-2734, and CVE-2010-3936. These vulnerabilities can be exploited remotely, without authentication, and require user interaction.

Successful exploitation of the vulnerability that is associated with CVE-2010-2732 can result in web browsing redirection that may allow phishing attacks to occur. The attack vector for exploitation of this vulnerability is through HTTP packets that typically use TCP port 80 but may also use TCP ports 3128, 8000, 8010, 8080, 8888, and 24326.

Successful exploitation of the vulnerabilities that are associated with CVE-2010-2733, CVE-2010-2734, and CVE-2010-3936 may allow cross-site scripting resulting in elevation of privilege or allow information disclosure, which enables an attacker to learn information about the affected device. The attack vector for exploitation of these vulnerabilities is through HTTP packets that typically use TCP port 80 but may also use TCP ports 3128, 8000, 8010, 8080, 8888, and 24326. Due to the nature of cross-site scripting vulnerabilities, no additional information will be presented in this bulletin. For additional information about cross-site scripting attacks and the methods used to exploit these vulnerabilities, refer to the Cisco Applied Mitigation Bulletin Understanding Cross-Site Scripting (XSS) Threat Vectors.

Information about vulnerable, unaffected, and fixed software is available in the Microsoft Security Bulletin Summary for November 2010, which is available at the following link: http://www.microsoft.com/technet/security/bulletin/ms10-nov.mspx

Mitigation Technique Overview

The vulnerabilities that have a client software attack vector, require user interaction, can be exploited using web-based attacks (these include but are not limited to cross-site scripting, phishing, and web-based e-mail threats) or e-mail attachments, and files stored on network shares are in the following list:

These vulnerabilities are mitigated most successfully at the endpoint through software updates, user education, desktop administration best practices, and endpoint protection software such as Cisco Security Agent Host Intrusion Prevention System (HIPS) or antivirus products.

Effective use of Cisco Intrusion Prevention System (IPS) event actions provides visibility into and protection against attacks that attempt to exploit these vulnerabilities as discussed later in this document.

Risk Management

Organizations are advised to follow their standard risk evaluation and mitigation processes to determine the potential impact of these vulnerabilities. Triage refers to sorting projects and prioritizing efforts that are most likely to be successful. Cisco has provided documents that can help organizations develop a risk-based triage capability for their information security teams. Risk Triage for Security Vulnerability Announcements and Risk Triage and Prototyping can help organizations develop repeatable security evaluation and response processes.

Device-Specific Mitigation and Identification

Caution: The effectiveness of any mitigation technique depends on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. As with any configuration change, evaluate the impact of this configuration prior to applying the change.

Specific information about mitigation and identification is available for these devices:

Cisco Intrusion Prevention System

Mitigation: Cisco IPS Signature Event Actions

Administrators can use the Cisco IPS appliances and services modules to provide threat detection and help prevent attempts to exploit several of the vulnerabilities described in this document. The following table provides an overview of CVE identifiers and the respective Cisco IPS signatures that will trigger events on potential attempts to exploit these vulnerabilities.

CVE ID Signature Release Signature ID Signature Name Enabled Severity Fidelity*
CVE-2010-3333 S529 31239/0 Windows RTF Stack Buffer Overflow Yes High 80
CVE-2010-3334 31420/0 MS Office Embedded Office Art Drawings Memory Corruption Vulnerability Yes High 90
CVE-2010-3336 31179/0 Microsoft Excel Remote Code Execution Vulnerability Yes High 90
CVE-2010-3337 31419/0 Microsoft Office Remote Code Execution Vulnerability Yes High 90
CVE-2010-2572 30959/0 Microsoft Office Remote Code Execution Vulnerability Yes High 85
CVE-2010-2573 31439/0 PowerPoint Integer Underflow Heap Corruption Yes High 90
CVE-2010-2732 31219/0 Microsoft Forefront Unified Access Gateway Redirection Attack Yes Medium 85
CVE-2010-2733 31159/0 Microsoft Forefront Unified Access Gateway Script Injection Vulnerability Yes High 95
CVE-2010-2734 31339/0 Microsoft Forefront Unified Access Gateway Privilege Elevation Vulnerability Yes Medium 85
CVE-2010-3936 31399/0 Microsoft Forefront Unified Access Gateway Vulnerability Yes Medium 85

* Fidelity is also referred to as Signature Fidelity Rating (SFR) and is the relative measure of the accuracy of the signature (predefined). The value ranges from 0 through 100 and is set by Cisco Systems, Inc.

Administrators can configure Cisco IPS sensors to perform an event action when an attack is detected. The configured event action performs preventive or deterrent controls to help protect against an attack that is attempting to exploit the vulnerabilities listed in the preceding table.

Cisco IPS sensors are most effective when deployed in inline protection mode combined with the use of an event action. Automatic Threat Prevention for Cisco IPS 6.x sensors that are deployed in inline protection mode provides threat prevention against an attack that is attempting to exploit the vulnerability that is described in this document. Threat prevention is achieved through a default override that performs an event action for triggered signatures with a riskRatingValue greater than 90.

Cisco IPS 5.x sensors that are deployed in inline protection mode require an event action configured on a per-signature basis. Alternatively, administrators can configure an override that can perform an event action for any signatures that are triggered and are calculated as a high-risk threat. Using an event action on sensors deployed in inline protection mode provides the most effective exploit prevention.

For additional information about the risk rating and threat rating calculation, reference Risk Rating and Threat Rating: Simplify IPS Policy Management.

Cisco IPS Signature Event Data

The following data has been compiled through remote monitoring services provided by the Cisco Remote Management Services team from a sample group of Cisco IPS sensors running Cisco IPS Signature Update version S529 or greater. The purpose of this data is to provide visibility into attempts to exploit the vulnerabilities released as part of the Microsoft November Security Update released on November 9, 2010. This data was gathered from events triggered on November 15, 2010.

CVE ID Signature ID Percentage of Sensors Reporting the Signature Percentage of Sensors Reporting the Signature Among Top Ten Most-Seen Events
CVE-2010-3333 31239/0 0% 0%
CVE-2010-3334 31420/0 0% 0%
CVE-2010-3336 31179/0 0% 0%
CVE-2010-3337 31419/0 0% 0%
CVE-2010-2572 30959/0 0% 0%
CVE-2010-2573 31439/0 0% 0%
CVE-2010-2732 31219/0 0% 0%
CVE-2010-2733 31159/0 0% 0%
CVE-2010-2734 31339/0 0% 0%
CVE-2010-3936 31399/0 0% 0%

Cisco Security Monitoring, Analysis, and Response System

Identification: Cisco Security Monitoring, Analysis, and Response System Incidents

The Cisco Security Monitoring, Analysis, and Response System (Cisco Security MARS) appliance can create incidents on events for the following Microsoft Security Bulletins. After the S529 dynamic signature update has been downloaded, using the following keywords for each of the respective IPS signatures and a query type of All Matching Event Raw Messages on the Cisco Security MARS appliance will provide a report that lists the incidents created by these IPS signatures.

Microsoft ID Signature ID(s) MARS Query Keyword(s)
MS10-087 31239/0 NR-31239
31420/0 NR-31420
31179/0 NR-31179
31419/0 NR-31419
MS10-088 30959/0 NR-30959
31439/0 NR-31439
MS10-089 31219/0 NR-31219
31159/0 NR-31159
31339/0 NR-31339
31399/0 NR-31399

Beginning with the 4.3.1 and 5.3.1 releases of Cisco Security MARS appliances, support for the Cisco IPS dynamic signature updates feature has been added. This feature downloads new signatures from Cisco.com or from a local web server, correctly processes and categorizes received events that match those signatures, and includes them in inspection rules and reports. These updates provide event normalization and event group mapping, and they also enable the MARS appliance to parse new signatures from the IPS devices.

Caution: If dynamic signature updates are not configured, events that match these new signatures appear as unknown event type in queries and reports. Because MARS will not include these events in inspection rules, incidents may not be created for potential threats or attacks that occur within the network.

By default, this feature is enabled but requires configuration. If it is not configured, the following Cisco Security MARS rule will be triggered:

System Rule: CS-MARS IPS Signature Update Failure

When this feature is enabled and configured, administrators can determine the current signature version downloaded by MARS by selecting Help > About and reviewing the IPS Signature Version value.

Additional information about dynamic signature updates and instructions for configuring dynamic signature updates is available for the Cisco Security MARS 4.3.1 and 5.3.1 releases.

Additional Information

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.

Cisco Security Procedures

Complete information about reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco is available on Cisco.com at http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html. This web page includes instructions for press inquiries regarding Cisco Security Advisories. All Cisco Security Advisories are available at http://www.cisco.com/go/psirt.

Related Information

Vulnerability Characteristics

Mitigation Technique Overview

Risk Management

Organizations are advised to follow their standard risk evaluation and mitigation processes to determine the potential impact of <this vulnerability | these vulnerabilities>. Triage refers to sorting projects and prioritizing efforts that are most likely to be successful. Cisco has provided documents that can help organizations develop a risk-based triage capability for their information security teams. Risk Triage for Security Vulnerability Announcements and Risk Triage and Prototyping can help organizations develop repeatable security evaluation and response processes.

Device-Specific Mitigation and Identification

Caution:The effectiveness of any mitigation technique depends on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. As with any configuration change, evaluate the impact of this configuration prior to applying the change.

Specific information about mitigation and identification is available for these devices:

Additional Information

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.

Cisco Security Procedures

Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt.

Related Information

 
Alert History
 

Version 2, November 15, 2010, 4:33 PM: IPS signature event data from Cisco Remote Management Services is available for IPS signatures from November 11, 2010.

Version 1, November 09, 2010, 1:51 PM: This initial version of the Cisco Applied Mitigation Bulletin addresses the Microsoft Security Bulletin Release for November 2010.



Product Sets
 
The security vulnerability applies to the following combinations of products.

Primary Products:
Microsoft, Inc.Forefront Unified Access Gateway 2010 Base, Update 1, Update 2
Microsoft, Inc.Office XP (2002) Base, SP1, SP2, SP3 | 2003 Base, SP1, SP2, SP3 | 2007 Base, SP1, SP2 | 2010 Base
Microsoft, Inc.Office for Mac 2011 Base
Microsoft, Inc.Open XML File Format Converter for Mac 1.0 .0, .1, .2

Associated Products:
CiscoCisco Broadband Troubleshooter Original Release Base | 3.1 Base | 3.2 Base
CiscoCisco Building Broadband Service Manager (BBSM) Original Release Base | 2.5 .1 | 3.0 Base | 4.0 Base, .1 | 4.2 Base | 4.3 Base | 4.4 Base | 4.5 Base | 5.0 Base | 5.1 Base | 5.2 Base
CiscoCisco CNS Network Registrar 2.5 Base | 3.0 Base | 3.5 Base, .1 | 5.0 Base | 5.5 Base, .13 | 6.0 .5, .5.2, .5.3, .5.4 | 6.1 Base, .1, .1.1, .1.2, .1.3, .1.4
CiscoCisco Collaboration Server Dynamic Content Adapter (DCA) Original Release Base | 1.0 Base | 2.0 Base, (1)_SR2
CiscoCisco Computer Telephony Integration (CTI) Option 4.7 (0)_SR1, (0)_SR2, (0)_SR3, (0)_SR4 | 5.1 (0)_SR1, (0)_SR2, (0)_SR3 | 6.0 (0)_SR1, (0)_SR2, (0)_SR3, (0)_SR4, (0)_SR5 | 7.0 (0)_SR1, (0)_SR2 | 7.1 (2), (3), (4), (5)
CiscoCisco Conference Connection 1.1 (3), (3)spA | 1.2 Base, (1), (2), (2)SR1, (2)SR2
CiscoCisco E-mail Manager Original Release Base | 4.0 Base, .5i, .6 | 5.0 Base, (0)_SR1, (0)_SR3, (0)_SR4, (0)_SR5, (0)_SR6, (0)_SR7
CiscoCisco Emergency Responder 1.1 Base, (3), (4) | 1.2 Base, (1), (1)SR1, (2), (2)sr1, (3)a, (3)SR1, (3a)SR2 | 1.3 Base, (1a), (2)
CiscoCisco Intelligent Contact Manager (ICM) Original Release Base | 4.6 (2)_SR1, (2)_SR2, (2)_SR3, (2)_SR4, (2)_SR5, (2)_SR6 | 5.0 (0), (0)_SR2, (0)_SR3, (0)_SR4, (0)_SR5, (0)_SR7, (0)_SR8, (0)_SR9, (0)_SR10, (0)_SR11, (0)_SR12, (0)_SR13 | 6.0 (0)_SR1, (0)_SR2, (0)_SR3, (0)_SR4, (0)_SR5, (0)_SR6, (0)_SR7, (0)_SR8, (0)_SR9, (0)_SR10 | 7.0 (0)_SR1, (0)_SR2, (0)_SR3, (0)_SR4 | 7.1 (2), (3), (4), (5)
CiscoCisco Unified Contact Center Enterprise Edition Base, 4.6.2, 5.0, 6.0, 7.0, 7.1, 7.1.1, 7.1.3 | Express Edition Base, 2.0, 2.0.2, 2.1, 2.1.1a, 2.1.2, 2.1.3, 2.2, 2.2.1, 2.2.2, 2.2.3b, 2.2.3b_spE, 3.0, 3.0.2, 3.0.3a_spA, 3.0.3a_spB, 3.0.3a_spC, 3.0.3a_spD, 3.1, 3.1(1)_SR1, 3.1(1)_SR2, 3.1(2)_SR1, 3.1(2)_SR2, 3.1(2)_SR3, 3.1(2)_SR4, 3.1(3)_SR2, 3.1(3)_SR3, 3.1(3)_SR4, 3.1(3)_SR5, 3.5, 3.5.1, 3.5(1)_SR1, 3.5(2)_SR1, 3.5(3), 3.5(3)_SR1, 3.5(3)_SR2, 3.5(3)_SR3, 3.5(4)_SR1, 3.5(4)_SR2, 4.0, 4.0(1)_SR1, 4.0(4)_SR1, 4.0(5)_SR1, 4.1, 4.1(1)_SR1, 4.5, 4.5(2)_SR1, 4.5(2)_SR2, 5.0(1)_SR1 | Hosted Edition Base, 4.6.2, 5.0, 6.0, 7.0, 7.1, 7.1.1, 7.1.3
CiscoCisco Unified IP IVR 2.0 .2 | 2.1 .1a, .2, .3 | 2.2 (5), .1, .2, .3b, .3b_spE, .5, .4 | 3.0 .1_spB, .2, .3a_spA, .3a_spB, .3a_spC, .3a_spD | 3.1 (1)_SR2, (2)_SR1, (2)_SR2, (2)_SR3, (3)_SR1, (3)_SR2, (3)_SR3, (3)_SR4, (3)_SR5 | 3.5 (1)_SR1, (1)_SR2, (1)_SR3, (2)_SR1, (3)_SR1, (3)_SR2, (3)_SR3, (4)_SR1, (4)_SR2, .1, .3 | 4.0 (1)_SR1, (4)_SR1 | 4.1 (1)_SR1 | 4.5 (2)_SR1, (2)_SR2 | 5.0 (1)_SR1
CiscoCisco IP Interoperability and Collaboration System (IPICS) 1.0 (1.1)
CiscoCisco IP Queue Manager 2.2 Base
CiscoCisco IP/VC 3540 Application Server Module 3.2 .0.1, .138 | 3.5 .0.8
CiscoCisco IP/VC 3540 Rate Matching Module 3.0 .9
CiscoCisco Media Blender Original Release Base | 3.0 Base | 4.0 Base | 5.0 Base, (0)_SR1, (0)_SR2
CiscoCisco Networking Services for Active Directory Original Release Base
CiscoCisco Outbound Option Original Release Base
CiscoCisco Personal Assistant 1.0 Base, (1) | 1.1 Base | 1.3 Base, .1, .2, .3, .4 | 1.4 Base, .2, .3, .4, .5, .6
CiscoCisco Remote Monitoring Suite Option 1.0 Base | 2.0 Base, (0)_SR1
CiscoCisco Secure Access Control Server (ACS) for Windows 2.6 Base | 2.6.3.2 Base | 2.6.4 Base | 2.6.4.4 Base | 3.0 Base | 3.0.1 Base | 3.0.1.40 Base | 3.0.2 Base | 3.0.3 Base | 3.0.3.6 Base | 3.0.4 Base | 3.1.1 Base | 3.1.1.27 Base | 3.1.2 Base | 3.2 Base | 3.2.1 Base | 3.2.3 Base | 3.3.1 Base | 3.3.2.2 Base | 3.3.1.16 Base | 3.3.3.11 Base | 4.0 Base | 4.0.1 Base | 4.0.1.27 Base | 4.1.1.23 Base
CiscoCisco Secure Access Control Server Solution Engine (ACSE) 3.1 Base, .1 | 3.2 Base, .1.20, .2.5, .3 | 3.3 Base, .1, .1.16, .2.2, .3, .4, .4.12 | 4.0 Base, .1, .1.42, .1.44, .1.49 | 4.1 Base, .1.23, .1.23.3, .3, .3.12
CiscoCisco Secure User Registration Tool (URT) Original Release Base | 1.2 Base, .1 | 2.0 Base, .7, .8 | 2.5 Base, .1, .2, .3, .4, .5
CiscoCisco SN 5420 Storage Router 1.1 Base, .3, .4, .5, .7, .8 | 2.1 .1, .2
CiscoCisco SN 5428-2 Storage Router 3.2 .1, .2 | 3.3 .1, .2 | 3.4 .1 | 3.5 Base, .1, .2, .3, .4
CiscoCisco Trailhead Original Release Base | 4.0 Base
CiscoCisco Unified Communications Manager Original Release Base | 1.0 Base | 2.0 Base | 3.0 Base | 3.0.3(a) Base | 3.1 Base, .1, .2, .3a | 3.1(1) Base | 3.1(2) Base | 3.1(2)SR3 Base | 3.1(3) Base | 3.1(3)SR2 Base | 3.1(3)SR4 Base | 3.2 Base | 3.2(3)SR3 Base | 3.3 Base | 3.3(2)SPc Base | 3.3(3) Base | 3.3(3)ES61 Base | 3.3(3)SR3 Base | 3.3(3)SR4a Base | 3.3(3a) Base | 3.3(4) Base | 3.3(4)ES25 Base | 3.3(4)SR2 Base | 3.3(4c) Base | 3.3(5) Base | 3.3(5)ES24 Base | 3.3(5)SR1 Base | 3.3(5)SR1a Base | 3.3(5)SR2 Base | 3.3(5)SR2a Base | 3.3(5)SR3 Base | 3.3(59) Base | 3.3(61) Base | 3.3(63) Base | 3.3(64) Base | 3.3(65) Base | 3.3(66) Base | 3.3(67.5) Base | 3.3(68.1) Base | 3.3(71.0) Base | 3.3(74.0) Base | 3.3(78) Base | 3.3(76) Base | 4.0 .1, .2 | 4.0(2a)ES40 Base | 4.0(2a)ES56 Base | 4.0(2a)SR2b Base | 4.0(2a)SR2c Base | 4.1 Base | 4.1(2) Base | 4.1(2)ES33 Base | 4.1(2)ES50 Base | 4.1(2)SR1 Base | 4.1(3) Base | 4.1(3)ES Base | 4.1(3)ES07 Base | 4.1(3)ES24 Base | 4.1(3)SR Base | 4.1(3)SR1 Base | 4.1(3)SR2 Base | 4.1(3)SR3 Base | 4.1(3)SR3b Base | 4.1(3)SR3c Base | 4.1(3)SR4 Base | 4.1(3)SR4b Base | 4.1(3)SR4d Base | 4.1(3)SR5 Base | 4.1(4) Base | 4.1(9) Base | 4.1(17) Base | 4.1(19) Base | 4.1(22) Base | 4.1(23) Base | 4.1(25) Base | 4.1(26) Base | 4.1(27.7) Base | 4.1(28.2) Base | 4.1(30.4) Base | 4.1(36) Base | 4.1(39) Base | 4.2(1) Base | 4.2(1)SR1b Base | 4.2(1.02) Base | 4.2(1.05.3) Base | 4.2(1.06) Base | 4.2(1.07) Base | 4.2(3) Base | 4.2(3)SR1 Base | 4.2(3)SR2 Base | 4.2(3.08) Base | 4.2(3.2.3) Base | 4.2(3.3) Base | 4.2(3.13) Base | 4.3(1) Base | 4.3(1)SR Base | 4.3(1.57) Base
CiscoCisco Unified Customer Voice Portal (CVP) 3.0 (0), (0)SR1, (0)SR2 | 3.1 (0), (0)SR1, (0)SR2 | 4.0 (0), (1), (1)SR1, (2)
CiscoCisco Unified MeetingPlace 4.3 Base | 5.3 Base | 5.2 Base | 5.4 Base | 6.0 Base
CiscoCisco Unified MeetingPlace Express 1.1 Base | 1.2 Base | 2.0 Base
CiscoCisco Unity Original Release Base | 2.0 Base | 2.1 Base | 2.2 Base | 2.3 Base | 2.4 Base | 2.46 Base | 3.0 Base, .1 | 3.1 Base, .2, .3, .5, .6 | 3.2 Base | 3.3 Base | 4.0 Base, .1, .2, .3, .3b, .4, .5 | 4.1 Base, .1 | 4.2 Base, .1, .1 ES27 | 5.0 (1) | 7.0 (2)
CiscoCisco Unity Express 1.0.2 Base | 1.1.1 Base | 1.1.2 Base | 2.0.1 Base | 2.0.2 Base | 2.1.1 Base | 2.1.2 Base | 2.1.3 Base | 2.2.0 Base | 2.2.1 Base | 2.2.2 Base | 2.3.0 Base | 2.3.1 Base
CiscoCisco Wireless Control System (WCS) Software 1.0 Base | 2.0 Base, 44.14, 44.24 | 2.2 .0, .111.0 | 3.0 Base, .101.0, .105.0 | 3.1 Base, .20.0, .33.0, .35.0 | 3.2 Base, .23.0, .25.0, .40.0, .51.0, .64.0 | 4.0 Base, .1.0, .43.0, .66.0, .81.0, .87.0, .96.0, .97.0 | 4.1 Base, .83.0
CiscoCiscoWorks IP Telephony Environment Monitor (ITEM) 1.3 Base | 1.4 Base | 2.0 Base
CiscoCiscoWorks LAN Management Solution (LMS) 1.3 Base | 2.2 Base | 2.5 Base | 2.6 Base
CiscoCiscoWorks QoS Policy Manager (QPM) 2.0 Base, .1, .2, .3 | 2.1 .2 | 3.0 Base, .1 | 3.1 Base | 3.2 Base, .1, .2, .3
CiscoCiscoWorks Routed WAN Management Solution (RWAN) 1.0 Base | 1.1 Base | 1.2 Base | 1.3 Base, .1
CiscoCiscoWorks Small Network Management Solution (SNMS) 1.0 Base | 1.5 Base
CiscoCiscoWorks VPN/Security Management Solution (VMS) 1.0 Base | 2.0 Base | 2.1 Base | 2.2 Base | 2.3 Base
CiscoCisco Collaboration Server 3.0 Base | 3.01 Base | 3.02 Base | 4.0 Base | 5.0 Base
CiscoCisco DOCSIS CPE Configurator 1.0 Base | 1.1 Base | 2.0 Base
CiscoCisco Unified IP Interactive Voice Response (IVR) 2.0 Base | 2.1 Base
CiscoCisco Service Control Engine (SCE) 3.0 Base | 3.1 Base
CiscoCisco Transport Manager Original Release Base | 2.0 Base | 2.1 Base | 2.2 Base, .1 | 3.0 Base, .1, .2 | 3.1 Base | 3.2 Base | 4.0 Base | 4.1 Base, .4, .6, .6.6.1 | 4.6 Base | 4.7 Base | 5.0 Base, .0.867.2, .1.873.2, .2, .2.92.1, .2.99.1, .2.105.1, .2.110.1 | 6.0 Base, .0.405.1, .0.407.1, .0.412.1 | 7.0 Base, .0.370.1, .0.372.1, .0.377.1, .0.389.1, .0.400.1, .395.1 | 7.2 Base, .0.199.1




Alerts and bulletins on the Cisco Security Intelligence Operations Portal are highlighted by analysts in the Cisco Threat Operations Center and represent a subset of the comprehensive content that is available through Cisco Security IntelliShield Alert Manager Service. This customizable threat and vulnerability alert service provides security staff with access to timely, accurate, and credible information about threats and vulnerabilities that may affect their environment.


LEGAL DISCLAIMER
The urgency and severity ratings of this alert are not tailored to individual users; users may value alerts differently based upon their network configurations and circumstances. THE ALERT, AND INFORMATION CONTAINED THEREIN, ARE PROVIDED ON AN "AS IS" BASIS AND DO NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE ALERT, AND INFORMATION CONTAINED THEREIN, OR MATERIALS LINKED FROM THE ALERT, IS AT YOUR OWN RISK. INFORMATION IN THIS ALERT AND ANY RELATED COMMUNICATIONS IS BASED ON OUR KNOWLEDGE AT THE TIME OF PUBLICATION AND IS SUBJECT TO CHANGE WITHOUT NOTICE. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE ALERTS AT ANY TIME.
Powered by  IntelliShield