Forum Thread: problem with MSMXL Core Services 4.x update

You are currently viewing a forum thread in the Secunia Community Forum. Please note that opinions expressed here are not of Secunia but solely reflect those of the user who wrote it.

This thread was submitted in the following forum:
Programs

Relating to this vendor:
Microsoft
And, this specific program:
Microsoft XML Core Services (MSXML) 4.x

This thread has been marked as resolved.
taffy078 problem with MSMXL Core Services 4.x update
Contributor 24th Aug, 2012 10:27
Ranking: 408
Posts: 1,463
User Since: 26th Feb, 2009
System Score: 100%
Location: UK
Hello.

There are three current threads already on this problem. As I'm unsure if my problem is exactly the same, I'm starting this new thread rather than tag on to the larger one -

http://secunia.com/community/forum/thread/show/131...

Yesterday, I searched and found several MS updates on my desktop (XP SP3), including MSXML. They all updated with no problem.
Today I checked my laptop - Win7. PSI (v2.0.0.4003) auto-scanned and reported that MSXML version 4.20.9876.0 is insecure. It directed me to a manual update link.

I have MS automatic updates in place - using this manual link showed that my PC is up to date.

drobinson reports below that Microsoft's server was down all day on the 22nd and got the update on the 23rd. Could this be the cause of my problem i.e. should I just wait a day or two (and not use my laptop)?

http://secunia.com/community/forum/thread/show/131...


PS I've just had a bizarre moment. I have the "All forums" menu open as I type this - I switched to it to check something and OMG it showed threads in no apparent order (not by author, forum, alpha, date) and some were posted four years ago. Perhaps my laptop is haunted!

--
taffy078, West Yorkshire, UK

HP Envy Win10 PC and Compaq Presario screwed up by forced upgrade to Win10 from WIn7

Post "RE: problem with MSMXL Core Services 4.x update" has been selected as an answer.
Maurice Joyce RE: problem with MSMXL Core Services 4.x update
Handling Contributor 24th Aug, 2012 10:53
Score: 12073
Posts: 9,344
User Since: 4th Jan 2009
System Score: N/A
Location: UK
The reason that it is a manual update is that MSXML4 SP3 was never part of Windows Update as explained in the Release Notes.

As my solution suggests once MSXML 3 SP3 is installed Windows Update will start to pick up any updates which explains the differences in the solution.

With version 2 installed U need to do this:

UPDATING MSXML 4.0

The download link (clearly marked MSXML.MSI - 2.3 MB) is here:
http://www.microsoft.com/downloads/en/details.aspx...

Please note this SP was released before Windows 7 was produced therefore there is no mention of compatibility - it works flawlessly with Windows 7 on both 32 & 64 Bit systems

Now run Windows Update - there are some additional patches for SP3.

Once installed run a full PSI scan & PSI will pick it up as secure with version 4.30.2114.0

Update 1 09:47 24/08/2012

--
Maurice

Microsoft Surface 4 Intel i7 64Bit
Windows 10 Pro
16 GB RAM
IE & Edge Only
Was this reply relevant?
+10
-0
ManFromOz RE: problem with MSMXL Core Services 4.x update
Member 24th Aug, 2012 11:35
Score: 17
Posts: 104
User Since: 6th Jun 2012
System Score: 100%
Location: AU
Maurice,

Can i ask, (If you know) if this update was released way back in 2009, why has it taken until now to be noticed as insecure?

TIA,
ManFromOz
Was this reply relevant?
+0
-0
altonius RE: problem with MSMXL Core Services 4.x update
Member 24th Aug, 2012 23:20
Score: 4
Posts: 2
User Since: 24th Aug 2012
System Score: N/A
Location: AU
Because I reported the misconfiguration this week after some research into MS12-043.

I've identified that a lot of Vulnerability Management systems are not correctly identifying the old unsupported versions as being vulnerable.

The Nessus team is also working on a plugin to detect the unsupported versions.

altonius
Was this reply relevant?
+3
-0
taffy078 RE: problem with MSMXL Core Services 4.x update
Contributor 25th Aug, 2012 10:08
Score: 408
Posts: 1,463
User Since: 26th Feb 2009
System Score: 100%
Location: UK
@Maurice:

I followed your link (http://www.microsoft.com/downloads/en/details.aspx...) and installed MSMXL SP3. But there were no WIndows Updates when I checked. So I restarted my laptop (Win7).

I immediately had a problem - an error message that "Windows Explorer has stopped working - searching for a solution" then a very short message "reloading (restarting?)Windows Explorer".

By now, the PSI tray icon had disappeared. I checked Windows Update - nothing - and then ran a PSI scan.

I now have three problems: the original one (4x 4.30.2100.0 at risk) and two new ones, one for 64-bit. Both relate to MSMXL 6x where 6.30.7601.17857 is shown at risk and the soloution shown is Microsoft Update (manual). But there are none.

What should I do now, please, Maurice? (Throwing my laptop out of the window seems attractive!!)

--
taffy078, West Yorkshire, UK

HP Envy Win10 PC and Compaq Presario screwed up by forced upgrade to Win10 from WIn7
Was this reply relevant?
+0
-0
taffy078 RE: problem with MSMXL Core Services 4.x update
Contributor 25th Aug, 2012 10:22
Score: 408
Posts: 1,463
User Since: 26th Feb 2009
System Score: 100%
Location: UK
PS I see from searching "MSMXL6" that there are many threads on the problem e.g. http://secunia.com/community/forum/thread/show/745...

But when I was searching the Products list I found both MSMXL Core Services 6x and MSMXL Parser 6x.

I've just checked Control Panel/Programs. This shows 3 items for MSMXL 4:
SP2 (KB954430), SP2 (KB973688) and the new one SP3 Parser.

I'll now go check the PSI results to see where MSMXL 6x and 6x - 64bit are located.

--
taffy078, West Yorkshire, UK

HP Envy Win10 PC and Compaq Presario screwed up by forced upgrade to Win10 from WIn7
Was this reply relevant?
+0
-0
taffy078 RE: problem with MSMXL Core Services 4.x update
Contributor 25th Aug, 2012 10:30
Score: 408
Posts: 1,463
User Since: 26th Feb 2009
System Score: 100%
Location: UK
here's what the PSI scan reports on the locations of the three insecure programs:

C:\Windows\SysWOW64\msxml4.dll version 4.30.2100.0 (security patch KB2721691 not installed)

C:\Windows\SysWOW64\msxml6.dll version 6.30.7601.17857 (security patch KB2721691 not installed)

C:\Windows\System32\msxml6.dll version 6.30.7601.17857 (security patch KB2721691 not installed)

So why aren't the v6 ones shown in the Control Panel? Aaaarrrrrrrrrrrrgggggghhhhhhhhhhhhhhhhh.

--
taffy078, West Yorkshire, UK

HP Envy Win10 PC and Compaq Presario screwed up by forced upgrade to Win10 from WIn7
Was this reply relevant?
+0
-0
Maurice Joyce RE: problem with MSMXL Core Services 4.x update
Handling Contributor 25th Aug, 2012 10:44
Score: 12073
Posts: 9,344
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Last edited on 26th Aug, 2012 11:35
This is what U should have in the Scan Results page.
https://akkkug.bay.livefilestore.com/y1px4eH0ycyd8...

Have U got 2 MSXML 6 entries? The version U give is up to date.

MSXML 4 is not up to date as can be seen but should be available via Windows Update.

Have U run the Windows Update troubleshooter?

Right click the Action Centre in the tasktray>Troubleshoot a problem>System & Security>Fix problems with Windows Update>Activate it.

Now check your update settings - they are a personal choice but the one I have highlighted in green should be ticked to get a full read out. See Screen shot.
https://akkkug.bay.livefilestore.com/y1pj8i_CELEn_...


Check you do not have any updates hidden that affect MSXML. See Screen shot.
https://akkkug.bay.livefilestore.com/y1pQJRDCp4gIY...

Hope this helps.

EDIT: 10:32 26/08/2012

Please note I have cleaned up my Skydrive therefore the links to the Screen Shots are no-longer available. If you still require them I can create new ones.



--
Maurice

Microsoft Surface 4 Intel i7 64Bit
Windows 10 Pro
16 GB RAM
IE & Edge Only
Was this reply relevant?
+1
-0
muffin RE: problem with MSMXL Core Services 4.x update
Member 26th Aug, 2012 17:54
Score: 3
Posts: 33
User Since: 30th Oct 2008
System Score: 98%
Location: US
maurice: thank you so much. this morning my PSI said i needed to do a manual update for microsoft MSXML. i had no idea what it was talking about. i am not a compter expert. i have my computer set to auto update so i did not understand why i needed to do a manual update. i came over to this forum and saw your aug 24 response to taffy. i followed your instructions. they worked perfectly. my secunia psi logo is now green again and i am good to go. thank you!

--
muffin
Was this reply relevant?
+0
-0
Maurice Joyce RE: problem with MSMXL Core Services 4.x update
Handling Contributor 26th Aug, 2012 20:13
Score: 12073
Posts: 9,344
User Since: 4th Jan 2009
System Score: N/A
Location: UK
@muffin
Pleased to hear U are OK.

--
Maurice

Microsoft Surface 4 Intel i7 64Bit
Windows 10 Pro
16 GB RAM
IE & Edge Only
Was this reply relevant?
+1
-0
rwasser RE: problem with MSMXL Core Services 4.x update
Member 28th Aug, 2012 15:53
Score: 0
Posts: 6
User Since: 16th Aug 2012
System Score: N/A
Location: DE
Was this reply relevant?
+0
-0
wthomson RE: problem with MSMXL Core Services 4.x update
Member 28th Aug, 2012 17:08
Score: 0
Posts: 1
User Since: 3rd Mar 2010
System Score: N/A
Location: N/A
Thanks Maurice, worked perfectly.
Was this reply relevant?
+0
-0
Maurice Joyce RE: problem with MSMXL Core Services 4.x update
Handling Contributor 28th Aug, 2012 17:31
Score: 12073
Posts: 9,344
User Since: 4th Jan 2009
System Score: N/A
Location: UK


--
Maurice

Microsoft Surface 4 Intel i7 64Bit
Windows 10 Pro
16 GB RAM
IE & Edge Only
Was this reply relevant?
+1
-0
rwasser RE: problem with MSMXL Core Services 4.x update
Member 28th Aug, 2012 18:07
Score: 0
Posts: 6
User Since: 16th Aug 2012
System Score: N/A
Location: DE
Thank you, but when I'm open the first link this one opens

http://www.microsoft.com/en-us/download/default.as...

and there I don't see the download link you have mentioned.

I think it's a simple think, but unfortunately I don't get it.
Was this reply relevant?
+0
-0
Maurice Joyce RE: problem with MSMXL Core Services 4.x update
Handling Contributor 28th Aug, 2012 19:10
Score: 12073
Posts: 9,344
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Click here:
http://www.microsoft.com/en-us/download/details.as...

--
Maurice

Microsoft Surface 4 Intel i7 64Bit
Windows 10 Pro
16 GB RAM
IE & Edge Only
Was this reply relevant?
+0
-0
rwasser RE: problem with MSMXL Core Services 4.x update
Member 28th Aug, 2012 20:12
Score: 0
Posts: 6
User Since: 16th Aug 2012
System Score: N/A
Location: DE
Was this reply relevant?
+0
-0
Ificanicant RE: problem with MSMXL Core Services 4.x update
Member 30th Aug, 2012 19:57
Score: 0
Posts: 3
User Since: 30th Aug 2012
System Score: N/A
Location: US
Followed your directions step by step, easy, no troubles ... worked as advertized, solved my problem. What confused me is that I have Wndows XP3 and this is SP3. Thanks. Ificanicant
Was this reply relevant?
+0
-0
mickymik RE: problem with MSMXL Core Services 4.x update
Member 30th Aug, 2012 20:19
Score: 1
Posts: 9
User Since: 3rd Oct 2010
System Score: N/A
Location: UK
Many thanks Maurice, you are top dog : )
Was this reply relevant?
+0
-0
taffy078 RE: problem with MSMXL Core Services 4.x update
Contributor 2nd Sep, 2012 06:55
Score: 408
Posts: 1,463
User Since: 26th Feb 2009
System Score: 100%
Location: UK
just come back after a few days away. On opening PSI, I find that the MSMXL problem on my Win7 laptop has resolved itself!

I hope that the authors of subsequent threads on the subject have the same good fortune,

Thanks for your help, Maurice.

--
taffy078, West Yorkshire, UK

HP Envy Win10 PC and Compaq Presario screwed up by forced upgrade to Win10 from WIn7
Was this reply relevant?
+0
-0

This thread has been marked as locked.