Windows Update on CCM

[tboynton]

What do you do about Windows Update? It comes disabled with the OS images. I know your not supposed to install updates unless Cisco tells you to, but the patches are not availible fast enough from CCO.

[Ginger Dillon]

Hello -

Cisco made the MS03-026 hotfix available on CCO July 17th (for CCM 3.3). We applied it within a day or two to our cluster. The Windows 2000 version running on CallManager is not the same as that installed from the Microsoft select CD. So running Windows Update on the CallManager and applying fixes could put the CCM application at risk. We have followed Cisco's direction to apply only those updates that Cisco posts in the Cryptographic section of Software Downloads. Should we have a concern that a patch is not being made soon enough (for our liking), we check the forum to see if anyone else has posted the same question or even open up a TAC case. We've typically found the update available on CCO the next day, if not sooner :-)

Sincerely, Ginger

[tboynton]

I don't agree that has always been the case. We've been running callmanager since it was a Selsius product and at times I have waited for updates for quite awhile. They certainly are available much quicker than they used to be. I just get real nervous when I check online and there are 10 critical updates available for download. This is after all Cisco patches are applied.

[rlotwala]

Hi,

FYI,

Cisco has posted "win-OS-Upgrade-k9.2000-2-4sr5.exe" on August 1st, 2003, and also suggested to download "MS03-011 Q816093" from Microsoft and install it Manually after you did the Cisco's Update.

*** Note *** You can apply above Cisco patch ONLY if you're running "win-OS-Upgrade-K9.2000-2-4.exe".

Please review this document. "http://ftp-sj.cisco.com/cisco/crypto/3DES/voice/cmva/win-OS-Upgrade-K9.2000-2-4sr5-Readme.htm"

Thanks.

Raj

[tboynton]

Yes, I know that and have already applied those.

I guess what really set me off if that I built a subscriber on Monday and less than 24 hours later it had been exploited. I had applied all service patches including 2-4sr5 and mso3-011. I'm still trying to figure out which vulnerability was exploited

[david.lawrence]

What about unity? I'm aware we should not run windows update on CCM, but how about running windows update on unity servers (Dell G1). Is this supported?

Regards

D

[allan.thomas]

Unfortunately, I don't know the answer as to whether Windows update is supported for Unity. However, I built a Unity 4.x server, and after running windows update there were approx. a dozen security updates, excluding the generic iexplorer security updates.

[jdiegmueller]

I don't have a URL to substantiate this, but traditionally anything that uses a Spirian load (CCM, CRS, ER, etc) you have to use Cisco's winos, and for everything else (ie, Unity) you can treat it more like a typical Windows 2000 Server and use Windows Update.