Advisory cisco-sa-20111019-cs: Patch for CommonService 3.3.1 (LMS 3.2.1)

[faeza-nagi]

Hi

As described in advisory id: cisco-sa-20111019-cs,

LMS 3.2.1 on Microsoft Windows

3.3.1

is affected products for the discussed command execution. We run the above versions and are about to install the recommended software patch on this advisory.

I wish to know if there are any docs/guides specfifc to patch install (as cisco TAC recommended me one when i upgraded from LMS 3.2 to 3.2.1 for another advisory) -

if not, any recommended precautions/steps to follow. I would think a successful recent backup and patch download/install just be fine?

thanks,

FN

[Martin Ermel · Accepted solution]

you are correct with your steps, recent backup, download , install;

There is always a README in the zip file which gives instructions if special steps are necessary - but in most cases there are none.

I always stop dmgtd manualy (i.e. with net stop crmdmgtd (windows) or /etc/init.d/dmgtd stop (solaris) ) and afterwards control in the task list that there is no LMS process left - just in case of....

Also, I never let the patch install script start LMS at the end of installation - I want to keep control of this step (but I would say that this is a personal flavor... :-) )

upgrading LMS versions is a totally different thing than replacing a couple of files - and that's what a patch typically does.

[faeza-nagi]

thanks Martin, its really helpful

[faeza-nagi]

Hi ,

I thought someone may be find it useful - this patch actually included a readme file so it was handy to know how to run script to apply the patch. however its worth nothing that ciscoworks daemon shoudl still be running - I had first stopped it and then run the script, script failed. while on second attempt i run the script while daemon was still running (apparently patch stops and restart it on its own)

[Martin Ermel]

thank you for your feedback on this !

I checked the installer script and you are correct, this patch tests for a running dmgtd (pdshow must run successfully) just to stop it right after the test...

this step is worth of nothing and I yet discussed this with Cisco; meanwhile they changed the patch installation procedure to make a running dmgtd not a prerequisite for patchinstallation nor to start dmgtd automatically. You should get asked for it...

But this patch is a frowsy mix of the old and the new method...

From time to time there are some patches wich still follow the old method (even if they should not...) but this mixture is really a "nice" one...