Cisco Umbrella, formerly OpenDNS, What's in it for your business?

Cisco Cloud Security

Cisco Umbrella uses the Internet's most core component of infrastructure to block malicious destinations before a connection is ever established. By delivering security from the cloud, it is both easy and cost efficient to deploy.  The full suite of Cisco Security products have superior threat intelligence features compared to many competing products. Cisco has an advanced threat research department called Talos which is a team of over 250 people who research worldwide cyber threats in real-time. These cyber threat updates are then automatically sent to their suite of customer security products every five minutes.

It's All About Layers!

Security these days is not a single product solution.  We have to employ many layers to catch malicious activity and bad actors attempting to infiltrate our users and our data.  There is the traditional firewall, the Unified Threat Management Firewall, Endpoint Security such as Antivirus or Intrusion Prevention, Behavior based analytics that look for unusual or non standard activity on user workstations or devices.  All of these typically require an agent or piece of software installed on each device.  DNS is something that is inherently used by every internet user so it is a natural place to build in security functionality for users.  Plus, it is extremely simple to deploy at it's most basic level and users are being secured immediately.   It can be deployed in as little as 30 minutes.   

Acquisition of OpenDNS - "Atmospheric Security"

In 2015, Cisco acquired OpenDNS and moved them into their growing Cloud Security product portfolio.   The acquisition was a good one for Cisco.  They acquired another large database of Internet based "gunk" and a solution that is very easy to install and begin protecting organizations and businesses both inside and outside the firewall.   I like to call it "Atmospheric Security."  It can protect users that are mobile, work from home or SOHO workers, mobile devices such as phones and laptops, and it can protect those using WiFi at all those vulnerable cafe's and coffee shops!  Doesn't it sound good to have "Atmospheric Security" surrounding your user base?

Advanced DNS Based Protection

New security threats are being introduced and propagated at a dizzying pace.   Anyone who is online is exponentially being exposed to more and more threats every day.   Your business must secure its users from malicious attacks coming at them faster than ever.  What governs nearly every transaction on the Internet?  DNS...

For reference, DNS is a layer of critical infrastructure for how the internet works. It resolves those complicated IP addresses to standard names like www.yahoo.com instead of remembering each website's IP address.   It’s no surprise that 97% of advanced malware use DNS as part of their attack. Unfortunately, most businesses do not monitor DNS traffic for malicious internet connections, which creates these blind spots – this is one of the reasons why Cisco Cloud Security experts agree that protecting users in this way one of the more valuable methods of implementing a multi-layered security approach.

Reasons to Look at Cisco Umbrella

• Cloud Delivered, Less cost– because of tight budgets, businesses, schools and colleges can get more for their money when it comes to cyber security. Cisco Umbrella’s cloud-based service is a much lower cost than on premises solutions, it also helps with internet compliance and content control.
• Fast deployment and management– Deployment can take less than 30 minutes… which is ideal for schools and universities or large organizations as it means no downtime and valuable study time will not be interrupted. The solution can be centrally managed via the cloud based dashboard, this greatly reduces the time wasted by IT administrators.
• Enhanced Web filtering (for education and non profits this is extremely valuable)- Internet connectivity is required in every office and classroom as it plays a vital part in the modern day environment. Because of this, schools must be able to control what students have access to and business needs to limit liability. Umbrella’s web filtering allows you to block malicious content and risky sites. There is no need to install web filtering software on each machine, Umbrella can protect all devices on the network within minutes.  A deeper deployment only makes it more granular.
• Scalability – Large bandwidth connections are the norm in business and education so that students can research and use online study resources and business can move at the speed of the Internet. While traditional on-premises filtering hardware can be tough-to-scale, Umbrella integrates seamlessly with available bandwidth and provides the capability independent of bandwidth upgrades or ISP changes.
• Reporting - The reporting functionality has only gotten better and better since the acquisition by Cisco.   You can drill into data and turn any current query into a regular report that can be scheduled with a variety of options.   Great to bring metrics back to the business leadership and make IT look like heroes!

Summing it All Up!

With more unmanaged devices connecting to the network and more users working from anywhere, security gaps are widening. 

Defending mobile devices, cloud data and user behavior is harder than ever. You need deep visibility to expose not only what files and users are doing on their devices, but where they try to connect to the internet. You need this visibility so you can find the offending machines or users and stop malicious behavior immediately.

Squaw Valley powder 2/17/19

Best Powder runs of my life!  2/17/19.   It was bottomless, light and dry.  This is Broken Arrow which was super epic!

AA19-024A: DNS Infrastructure Hijacking Campaign

 

National Cyber Awareness System:   AA19-024A: DNS Infrastructure Hijacking Campaign 01/24/2019 03:01 PM EST   Original release date: January 24, 2019 Summary The National Cybersecurity and Communications Integration Center (NCCIC), part of the Cybersecurity and Infrastructure Security Agency (CISA), is aware of a global Domain Name System (DNS) infrastructure hijacking campaign. Using compromised credentials, an attacker can modify the location to which an organization’s domain name resources resolve. This enables the attacker to redirect user traffic to attacker-controlled infrastructure and obtain valid encryption certificates for an organization’s domain names, enabling man-in-the-middle attacks. See the following links for downloadable copies of open-source indicators of compromise (IOCs) from the sources listed in the References section below: IOCs (.csv) IOCs (.stix) These files will be updated as information becomes available. Technical Details Using the following techniques, attackers have redirected and intercepted web and mail traffic, and could do so for other networked services. The attacker begins by compromising user credentials, or obtaining them through alternate means, of an account that can make changes to DNS records. Next, the attacker alters DNS records, like Address (A), Mail Exchanger (MX), or Name Server (NS) records, replacing the legitimate address of a service with an address the attacker controls. This enables them to direct user traffic to their own infrastructure for manipulation or inspection before passing it on to the legitimate service, should they choose. This creates a risk that persists beyond the period of traffic redirection. Because the attacker can set DNS record values, they can also obtain valid encryption certificates for an organization’s domain names. This allows the redirected traffic to be decrypted, exposing any user-submitted data. Since the certificate is valid for the domain, end users receive no error warnings. Mitigations NCCIC recommends the following best practices to help safeguard networks against this threat: Update the passwords for all accounts that can change organizations’ DNS records. Implement multifactor authentication on domain registrar accounts, or on other systems used to modify DNS records. Audit public DNS records to verify they are resolving to the intended location. Search for encryption certificates related to domains and revoke any fraudulently requested certificates. References Cisco Talos DNSpionage Campaign Targets Middle East CERT-OPMD [DNSPIONAGE] – Focus on internal actions FireEye Global DNS Hijacking Campaign: DNS Record Manipulation at Scale Revisions January 24, 2019: Initial version This product is provided subject to this Notification and this Privacy & Use policy. A copy of this publication is available at www.us-cert.gov. If you need help or have questions, please send an email to info@us-cert.gov. Do not reply to this message since this email was sent from a notification-only address that is not monitored. To ensure you receive future US-CERT products, please add US-CERT@ncas.us-cert.gov to your address book.   OTHER RESOURCES: Contact Us | Security Publications | Alerts and Tips | Related Resources   STAY CONNECTED: SUBSCRIBER SERVICES: Manage Preferences  |  Unsubscribe  |  Help This email was sent to drenner@summitsol.com using GovDelivery Communications Cloud on behalf of: United States Computer Emergency Readiness Team (US-CERT) · 245 Murray Lane SW Bldg 410 · Washington, DC 20598 · (888) 282-0870

 

IMPORTANT NOTICE
This e-mail, including attachments, is covered by the Electronic Communications Privacy Act, 18 U.S.C. §§ 2510-2521, may include confidential, proprietary, and legally privileged information (including, without limitation, attorney-client privilege), and may be used only by the person or entity to which it is addressed. If the reader of this e-mail is not the intended recipient or his or her authorized agent, the reader is hereby notified that any use, dissemination, distribution, printing, or copying of this e-mail is strictly prohibited. If you have received this e-mail in error, please notify the sender by replying to this message and delete this e-mail immediately.

 

Thought you'd agree

545 vs. 330,000,000 People- by Charlie Reese

Politicians are the only people in the world who create problems and then campaign against them. Have you ever wondered, if both the Democrats and the Republicans are against deficits, WHY do we have deficits? Have you ever wondered, if all the politicians are against inflation and high taxes, WHY do we have inflation and high taxes? You and I don't propose a federal budget. The President does. You and I don't have the Constitutional authority to vote on appropriations. The House of Representatives does. You and I don't write the tax code, Congress does. You and I don't set fiscal policy, Congress does. You and I don't control monetary policy, the Federal Reserve Bank does.

One hundred senators, 435 congressmen, one President, and nine Supreme Court justices equates to 545 human beings out of the 300 million are directly, legally, morally, and individually responsible for the domestic problems that plague this country. I excluded the members of the Federal Reserve Board because that problem was created by the Congress. In 1913, Congress delegated its Constitutional duty to provide a sound currency to a federally chartered, but private, central bank. I excluded all the special interests and lobbyists for a sound reason. They have no legal authority.  They have no ability to coerce a senator, a congressman, or a President to do one cotton-picking thing. I don't care if they offer a politician $1 million dollars in cash. The politician has the power to accept or reject it. No matter what the lobbyist promises, it is the legislator's responsibility to determine how he votes. Those 545 human beings spend much of their energy convincing you that what they did is not their fault. They cooperate in this common con regardless of party. What separates a politician from a normal human being is an excessive amount of gall. No normal human being would have the gall of a Speaker, who stood up and criticized the President for creating deficits. The President can only propose a budget. He cannot force the Congress to accept it. The Constitution, which is the supreme law of the land, gives sole responsibility to the House of Representatives for originating and approving appropriations and taxes. Who is the speaker of the House now? He is the leader of the majority party. He and fellow House members, not the President, can approve any budget they want. If the President vetoes it, they can pass it over his veto if they agree to. It seems inconceivable to me that a nation of 300 million cannot replace 545 people who stand convicted -- by present facts -- of incompetence and irresponsibility. I can't think of a single domestic problem that is not traceable directly to those 545 people.  When you fully grasp the plain truth that 545 people exercise the power of the federal government, then it must follow that what exists is what they want to exist. If the tax code is unfair, it's because they want it unfair. If the budget is in the red, it's because they want it in the red. If the Army & Marines are in Iraq and Afghanistan it's because they want them in Iraq and Afghanistan ... If they do not receive social security but are on an elite retirement plan not available to the people, it's because they want it that way. There are no insoluble government problems. Do not let these 545 people shift the blame to bureaucrats, whom they hire and whose jobs they can abolish; to lobbyists, whose gifts and advice they can reject; to regulators, to whom they give the power to regulate and from whom they can take this power. Above all, do not let them con you into the belief that there exists disembodied mystical forces like "the economy," "inflation," or "politics" that prevent them from doing what they take an oath to do.

Those 545 people, and they alone, are responsible. They, and they alone, have the power. They, and they alone, should be held accountable by the people who are their bosses, provided the voters have the gumption to manage their own employees...

We should vote all of them out of office and clean up their mess!

How to Upgrade Cisco MeetingPlace from version 8.4 to 8.6

How to Upgrade Cisco MeetingPlace

Now that MeetingPlace from Cisco is in a state of confusion due to its pending demise, it appears to be extremely hard to find information on how to upgrade it.  Conflicting information prevails and Cisco SE's can't even find information or even the Product Manager!

Well, we did a successful upgrade today from 8.4 through multiple steps (so as to be careful since there is no clear information) and are finally at the current 8.6.2 SR1 version.  We were already virtualized and started with 8.2 initially so we are fortunate for that.  If you are upgrading from a physical version, you have a lot of reading to do...!  This may not help too much.

Here are the several steps used to get there.  It isn't totally detailed as to all the exact steps for each different version increment but I think you'll get the picture.

If you have questions or comments, please post them and I'll try to clear anything ambiguous up.

First of all, here are some links to the high level documentation;

MeetingPlace documentation Home

http://www.cisco.com/c/en/us/support/conferencing/unified-meetingplace/tsd-products-support-series-home.html

To Search all MeetingPlace documentation use this link;

https://cse.google.com/cse/home?cx=010241283619130371030:iqtuq7sdnhq

Here are the TAC Recommended Upgrade Steps:

*You will need to first get a backup as a precaution.

*Upgrade the system to 8.5.5 . (Please follow the instructions according to your deployment if is multinode or failover)

http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/meetingplace/8_5/english/books/install_guide/85mpinst/upgrading_software_to_852.html#wp1572609

*Then upgrade to 8.6.1 (Please follow the instructions according to your deployment if is multinode or failover)

http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/meetingplace/8_6/english/install_guide/86mpinst/upgrading_software_to_852.html#pgfId-1572609

*After this upgrade to 8.6.2. (Follow the same instructions)

Snapshot Saturday evening

Procedure:

From <http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/meetingplace/8_6/english/install_guide/86mpinst/upgrading_software_to_852.html#pgfId-1583684>

About Upgrading the Application Server Software

• An upgrade keeps the database that holds the Hardware Media Server configuration information.
• We support using Integrated Lights-Out (iLO) to install/upgrade the Application Server software. This standard only applies to the Cisco MCS 7845-H2. For information about installing, configuring, and using iLO, see http://h18000.www1.hp.com/products/servers/management/ilo/.
• The upgrade program retains the same deployment that you currently have on your existing Cisco Unified MeetingPlace system.

Preparing to Upgrade the Application Server Software

Caution  Do not run any other processes or tasks on your systems during an upgrade.

Note Be sure the Application Server node is in maintenance mode. Sign in to the Administration Center. Select Maintenance > Maintenance Configuration, then Start Maintenance Mode Now.

• Do not uninstall the Application Server software before the upgrade.
• The Cisco Unified MeetingPlace system must be running when you perform an upgrade. Do not turn off the Cisco Unified MeetingPlace services.
• If you have automatic backups/archives enabled, then turn this off when you upgrade the Application Server software.
• Make sure your system is functional before starting the upgrade (the Operational Status of each node is green)

Determining Which Procedure to Follow

Depending on the configuration of your Application Server, follow one of these steps:

• If your Application Server is in a failover deployment and you want to continue MeetingPlace scheduling—follow the procedure in Upgrading a Failover Deployment in an Audio System or a System with MeetingPlace Scheduling (Cisco Unified MeetingPlace 8.5.5) or Upgrading a Failover Deployment in an Audio-Only System or a System with MeetingPlace Scheduling (Cisco Unified MeetingPlace 8.5.4 and Earlier). After the upgrade, reconfigure the system for database replication.
• Otherwise, follow the procedure in either the Upgrading the Application Server by Using the Console or the Upgrading the Application Server Remotely.

Upgrading the Application Server by Using the Console

Before You Begin

• Complete Determining Which Procedure to Follow.
• Take the Audio Blade offline.

Note Be sure the Application Server node is in maintenance mode, or the upgrade program will terminate.

Procedure

Step 1 Go to Cisco.com and find the upgrade binary: http://www.cisco.com/cisco/software/navigator.html and select Products > Voice and Unified Communications > Unified Communications Applications > Conferencing > Cisco Unified MeetingPlace > Cisco Unified MeetingPlace 8.6 > Unified MeetingPlace Application Server. The naming convention will be similar to CUMP_AppServerUpgrade_< version >.bin, where < version> is the version number to which you are upgrading.

Step 2 Save the file to a convenient location.

Step 3 Enter md5sum CUMP_AppServerUpgrade_< version >.bin to determine the checksum of the file that you downloaded. Compare this value to the checksum value of the file that is posted on the download page on Cisco.com.

Step 4 Sign in to the Application Server command-line interface as the root user.

Step 5 Transfer the CUMP_AppServerUpgrade_< version >.bin file to the Application Server to the /tmp folder.

We recommend saving the file to the /partB directory, as it has a lot of free space. (You can do this by using the mv command: mv /tmp/CUMP_AppServerUpgrade_.bin /partB.)

Step 6 Enter sh./ CUMP_AppServerUpgrade_< version >.bin to execute the file.

Q. How to become 'root'?

• A. Login to SSH as mpxadmin, then change to 'root' user:

$ su -

NOTE: Enter 'root' password when prompted

Q. How to change file permissions?

• A. Use 'chmod' command. For the use with MP hotfixes '755' permissions are used:

To change permissions of file.bin to '755', run: $ chmod 755 file.bin

Q. How to move or copy a file?

• A. Use 'mv' or 'cp' command:

To move file.bin to mpx-record: $ mv file.bin /mpx-record

From <http://docwiki.cisco.com/wiki/Cisco_Unified_MeetingPlace_-_Application_Server_hotfix_installation_FAQ#Q._How_to_become_.27root.27.3F>

• Backup MP File 8.5.2.8 which was the main upgrade at installation.  First installation was a 7.x version and then was upgraded to this version.

The upgrade program checks to see if there are any previous versions of the Application Server software installed. If there is at least one previous version, the upgrade program displays a message listing the previous version found on the system.

Note If the upgrade program does not find any previous versions of the Application Server software, the upgrade program displays an error message and you must quit the upgrade.

Step 7 Select Enter after reading the Introduction.

Step 8 Select Enter to confirm your existing system.

Step 9 Select Enter to confirm the pre-installation summary.

Values include the product name and the amount of disk space required and available for the installation target.

Step 10 Select Enter to start the upgrade.

The upgrade program upgrades all the required components associated with the Application Server software.

The upgrade program displays a message stating that the upgrade is complete.

Step 11 Select 1 to restart the system.

Step 12 As required, upgrade the other Application Server nodes in your multinode system.

Step 13 Synchronize the Hardware Media Server and meeting types.

Step 14 Put the Audio Blade back online.

From <http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/meetingplace/8_6/english/install_guide/86mpinst/upgrading_software_to_852.html#pgfId-1583684>

====================================================================================

 Upgrade Cisco MeetingPlace from 8.5.4.22 to 8.6MR2

----------------------------------------------

Pre-upgrade task:

1) MP back up of db and server                                 7/12 - morning before upgrade

2) snapshot                                                                        7/11 Saturday night

3) WebEx Cloud server integration details            7/10 - screenshot details

4) turn off automatic backups/archive                    7/12 - morning, before upgrade

5) check if the MP server is active, no alerts          

Upgrade Tasks:  7/12 @ 9:00 am

-------------

Step I:

a) upgrade MP from 8.5.4.22 to 8.5.5   --- done

b) Apply latest path for 8.5.5 (8.5.5 SR10) (MP85MR3_PA9_Security_8552.bin.gz)

c) WebEx cloud integration

d) CUCM integration

e)  MP config check (region etc)

f)Testing

==================================================================

http://www.cisco.com/web/software/282579354/126546/readme85MR3patch9Security.txt

Dependencies
============

Initial 8.5.5.2 (8.5MR3FCS) installation required.

Installation instructions
=========================

These are general installation instructions. For details about each step, please see http://docwiki.cisco.com/wiki/Cisco_Unified_MeetingPlace_-_Application_Server_hotfix_installation_FAQ

All CLI commands should be executed as root.

For multi-node deployments, apply the patch on all nodes in the following order:
    a. Leaf nodes first
    b. Secondary MBD
    c. Primary MBD
      
1.  Copy the patch file to the MP Application server
2.  Put the patch in /mpx-record and gunzip it.

Q. How to gunzip the file?

• A. Use 'gunzip' command:

To gunzip file.bin.gz, run: $ gunzip file.bin.gz

Extracted file will be 'file.bin'

From <http://docwiki.cisco.com/wiki/Cisco_Unified_MeetingPlace_-_Application_Server_hotfix_installation_FAQ#Q._How_to_become_.27root.27.3F>

3.  Check cksum of gunzipped patch:
    If the the checksum value matches values above, you can proceed with running the patch
    If the checksum value doesn't match, the file is corrupted, please, contact Cisco TAC to get the file republished.
4.  Set the appropriate (755) permissions on the extracted .bin file and run it.
5.  Answer the confirm/continue prompts if any.
6.  The patch installer will install the files.
7.  Repeat the steps for the standby server (failover deployment), or other nodes (multi-node deployment).

The patch can not be rolled back.

From <http://www.cisco.com/web/software/282579354/126546/readme85MR3patch9Security.txt>

===============================================================================

Upgrade Cisco MeetingPlace from 8.5.5 to 8.6.1

Step II:

a) upgrade MP from 8.5.5 to 8.6MR1

b) Apply latest patch for 8.6.1 SR8 patch 9 (MP86_PA3_Security_8612.bin.gz)

c) WebEx cloud integration

d) CUCM integration

e)  MP config check (region etc)

f)Testing

First Step:  upgrade MP from 8.5.5 to 8.6MR1

Preparing to Upgrade the Application Server Software

Caution  Do not run any other processes or tasks on your systems during an upgrade.

Note Be sure the Application Server node is in maintenance mode. Sign in to the Administration Center. Select Maintenance > Maintenance Configuration, then Start Maintenance Mode Now.

• Do not uninstall the Application Server software before the upgrade.
• The Cisco Unified MeetingPlace system must be running when you perform an upgrade. Do not turn off the Cisco Unified MeetingPlace services.
• If you have automatic backups/archives enabled, then turn this off when you upgrade the Application Server software.
• Make sure your system is functional before starting the upgrade (the Operational Status of each node is green)

Determining Which Procedure to Follow

Depending on the configuration of your Application Server, follow one of these steps:

• If your Application Server is in a failover deployment and you want to continue MeetingPlace scheduling—follow the procedure in Upgrading a Failover Deployment in an Audio System or a System with MeetingPlace Scheduling (Cisco Unified MeetingPlace 8.5.5) or Upgrading a Failover Deployment in an Audio-Only System or a System with MeetingPlace Scheduling (Cisco Unified MeetingPlace 8.5.4 and Earlier). After the upgrade, reconfigure the system for database replication.
• Otherwise, follow the procedure in either the Upgrading the Application Server by Using the Console or the Upgrading the Application Server Remotely.

Upgrading the Application Server by Using the Console

Before You Begin

• Complete Determining Which Procedure to Follow.
• Take the Audio Blade offline.

Note Be sure the Application Server node is in maintenance mode, or the upgrade program will terminate.

Procedure

Step 1 Go to Cisco.com and find the upgrade binary: http://www.cisco.com/cisco/software/navigator.html and select Products > Voice and Unified Communications > Unified Communications Applications > Conferencing > Cisco Unified MeetingPlace > Cisco Unified MeetingPlace 8.6 > Unified MeetingPlace Application Server. The naming convention will be similar to CUMP_AppServerUpgrade_< version >.bin, where < version> is the version number to which you are upgrading.

Step 2 Save the file to a convenient location.

Step 3 Enter md5sum CUMP_AppServerUpgrade_< version >.bin to determine the checksum of the file that you downloaded. Compare this value to the checksum value of the file that is posted on the download page on Cisco.com.

Step 4 Sign in to the Application Server command-line interface as the root user.

Step 5 Transfer the CUMP_AppServerUpgrade_< version >.bin file to the Application Server to the /tmp folder.

We recommend saving the file to the /partB directory, as it has a lot of free space. (You can do this by using the mv command: mv /tmp/CUMP_AppServerUpgrade_.bin /partB.)

Step 6 Enter sh./ CUMP_AppServerUpgrade_< version >.bin to execute the file.

The upgrade program checks to see if there are any previous versions of the Application Server software installed. If there is at least one previous version, the upgrade program displays a message listing the previous version found on the system.

Note If the upgrade program does not find any previous versions of the Application Server software, the upgrade program displays an error message and you must quit the upgrade.

Step 7 Select Enter after reading the Introduction.

Step 8 Select Enter to confirm your existing system.

Step 9 Select Enter to confirm the pre-installation summary.

Values include the product name and the amount of disk space required and available for the installation target.

Step 10 Select Enter to start the upgrade.

The upgrade program upgrades all the required components associated with the Application Server software.

The upgrade program displays a message stating that the upgrade is complete.

Step 11 Select 1 to restart the system.

Step 12 As required, upgrade the other Application Server nodes in your multinode system.

Step 13 Synchronize the Hardware Media Server and meeting types.

Step 14 Put the Audio Blade back online.

From <http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/meetingplace/8_6/english/install_guide/86mpinst/upgrading_software_to_852.html#pgfId-1583684>

Cisco MeetingPlace Patch to 8.6.1 Patch 9

Dependencies
============

Initial 8.6.1.2 (8.6FCS) installation required.

Installation instructions
=========================

These are general installation instructions. For details about each step, please see http://docwiki.cisco.com/wiki/Cisco_Unified_MeetingPlace_-_Application_Server_hotfix_installation_FAQ

All CLI commands should be executed as root.

For multi-node deployments, apply the patch on all nodes in the following order:
    a. Leaf nodes first
    b. Secondary MBD
    c. Primary MBD

      
1.  Login as mpxadmin.   Escalate to root privilege user and then Copy the patch file to the MP Application server
2.  Put the patch in /mpx-record and gunzip it.
3.  Check cksum of gunzipped patch:
    If the the checksum value matches values above, you can proceed with running the patch
    If the checksum value doesn't match, the file is corrupted, please, contact Cisco TAC to get the file republished.
4.  Set the appropriate (755) permissions on the extracted .bin file and run it.

Sh ./MP86_PA8_Security_8612.bin

5.  Answer the confirm/continue prompts if any.
6.  The patch installer will install the files.
7.  Repeat the steps for the standby server (failover deployment), or other nodes (multi-node deployment).

The patch can not be rolled back.

From <http://www.cisco.com/web/software/282579354/123930/readme86patch8Security.txt>

Upgrade from MeetingPlace 8.6.1 to 8.6.2

http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/meetingplace/8_6/english/releasenotes/mp86rn.html#pgfId-284635

Preparing to Upgrade the Application Server Software

Caution  Do not run any other processes or tasks on your systems during an upgrade.

Note Be sure the Application Server node is in maintenance mode. Sign in to the Administration Center. Select Maintenance > Maintenance Configuration, then Start Maintenance Mode Now.

• Do not uninstall the Application Server software before the upgrade.
• The Cisco Unified MeetingPlace system must be running when you perform an upgrade. Do not turn off the Cisco Unified MeetingPlace services.
• If you have automatic backups/archives enabled, then turn this off when you upgrade the Application Server software.
• Make sure your system is functional before starting the upgrade (the Operational Status of each node is green)

Determining Which Procedure to Follow

Depending on the configuration of your Application Server, follow one of these steps:

• If your Application Server is in a failover deployment and you want to continue MeetingPlace scheduling—follow the procedure in Upgrading a Failover Deployment in an Audio System or a System with MeetingPlace Scheduling (Cisco Unified MeetingPlace 8.5.5) or Upgrading a Failover Deployment in an Audio-Only System or a System with MeetingPlace Scheduling (Cisco Unified MeetingPlace 8.5.4 and Earlier). After the upgrade, reconfigure the system for database replication.
• Otherwise, follow the procedure in either the Upgrading the Application Server by Using the Console or the Upgrading the Application Server Remotely.

Upgrading the Application Server by Using the Console

Before You Begin

• Complete Determining Which Procedure to Follow.
• Take the Audio Blade offline.

Note Be sure the Application Server node is in maintenance mode, or the upgrade program will terminate.

Procedure

Step 1 Go to Cisco.com and find the upgrade binary: http://www.cisco.com/cisco/software/navigator.html and select Products > Voice and Unified Communications > Unified Communications Applications > Conferencing > Cisco Unified MeetingPlace > Cisco Unified MeetingPlace 8.6 > Unified MeetingPlace Application Server. The naming convention will be similar to CUMP_AppServerUpgrade_< version >.bin, where < version> is the version number to which you are upgrading.

Step 2 Save the file to a convenient location.

Step 3 Enter md5sum CUMP_AppServerUpgrade_< version >.bin to determine the checksum of the file that you downloaded. Compare this value to the checksum value of the file that is posted on the download page on Cisco.com.

Step 4 Sign in to the Application Server command-line interface as the root user.

Step 5 Transfer the CUMP_AppServerUpgrade_< version >.bin file to the Application Server to the /tmp folder.

We recommend saving the file to the /partB directory, as it has a lot of free space. (You can do this by using the mv command: mv /tmp/CUMP_AppServerUpgrade_.bin /partB.)

Step 6 Enter sh./ CUMP_AppServerUpgrade_< version >.bin to execute the file.

The upgrade program checks to see if there are any previous versions of the Application Server software installed. If there is at least one previous version, the upgrade program displays a message listing the previous version found on the system.

Note If the upgrade program does not find any previous versions of the Application Server software, the upgrade program displays an error message and you must quit the upgrade.

Step 7 Select Enter after reading the Introduction.

Step 8 Select Enter to confirm your existing system.

Step 9 Select Enter to confirm the pre-installation summary.

Values include the product name and the amount of disk space required and available for the installation target.

Step 10 Select Enter to start the upgrade.

The upgrade program upgrades all the required components associated with the Application Server software.

The upgrade program displays a message stating that the upgrade is complete.

Step 11 Select 1 to restart the system.

Step 12 As required, upgrade the other Application Server nodes in your multinode system.

Step 13 Synchronize the Hardware Media Server and meeting types.

Step 14 Put the Audio Blade back online.

From <http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/meetingplace/8_6/english/install_guide/86mpinst/upgrading_software_to_852.html>

Supported Upgrades and Migrations to Release 8.6.2.10

http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/meetingplace/8_6/english/releasenotes/mp86rn.html#pgfId-366274

=============================================================

http://www.cisco.com/web/software/282579354/127534/readme86mr1patch1Security.txt

Patch to MeetingPlace 8.6.2 SR1

Name
====

MeetingPlace Platform patch
Version: 8.6.2.10 Patch 1
Filename: MP86MR1_PA1_Security_86210.bin.gz
Cksum: 3893645416 1142610 MP86MR1_PA1_Security_86210.bin
Released: Jul 10, 2015

Defects fixed
=============

CSCuu82563 - Evaluation of meetingplace for OpenSSL June 2015

Important notes
=============

Once the installation is finished, verify openssl version:
    [root@server ~]# openssl version
    CiscoSSL 1.0.1p.4.13-fips

Dependencies
============

Initial 8.6.2.10 (8.6MR1) installation required.

Installation instructions
=========================

These are general installation instructions. For details about each step, please see http://docwiki.cisco.com/wiki/Cisco_Unified_MeetingPlace_-_Application_Server_hotfix_installation_FAQ

All CLI commands should be executed as root.

For multi-node deployments, apply the patch on all nodes in the following order:
    a. Leaf nodes first
    b. Secondary MBD
    c. Primary MBD
      
1.  Copy the patch file to the MP Application server
2.  Put the patch in /mpx-record and gunzip it.
3.  Check cksum of gunzipped patch:
    If the the checksum value matches values above, you can proceed with running the patch
    If the checksum value doesn't match, the file is corrupted, please, contact Cisco TAC to get the file republished.
4.  Set the appropriate (755) permissions on the extracted .bin file and run it.
5.  Answer the confirm/continue prompts if any.
6.  The patch installer will install the files.
7.  Repeat the steps for the standby server (failover deployment), or other nodes (multi-node deployment).

The patch can not be rolled back.

From <http://www.cisco.com/web/software/282579354/127534/readme86mr1patch1Security.txt>