Secunia CSI7
Advisories
Research
Forums
Create Profile
Our Commitment
PSI
PSI API
CSI
OSI
xSI
Vulnerabilities
Programs
Open Discussions
My Threads
Create Thread
Statistics
About

Forum Thread: MSXML 4.0 update

You are currently viewing a forum thread in the Secunia Community Forum. Please note that opinions expressed here are not of Secunia but solely reflect those of the user who wrote it.

This thread was submitted in the following forum:
Programs

Relating to this vendor:
Microsoft
And, this specific program:
Microsoft XML Core Services (MSXML) 4.x

This thread has been marked as locked.
woodyleonhard MSXML 4.0 update
Member 17th May, 2014 23:37
Ranking: 0
Posts: 1
User Since: 17th May, 2014
System Score: N/A
Location: US
I'm reading the Secunia PSI country vulnerability reports and seeing that, every quarter, a vulnerability in MSXML appears at the top of the US list.

The problem, as best I can tell: MSXML 4 is up to Service Pack 3, but Windows Update no longer scans for the presence of MSXML 4, which hit end of life long ago. Secunia has a note about it here:

http://secunia.com/community/forum/thread/show/141...

Multiple versions of MSXML co-exist on many machines. Unfortunately, because of dependencies hard coded into many third-party programs, you can't just delete older versions.

I'm searching for a simple, cookbook recipe for solving the problem. Here's the best I've been able to come up with:

1. Scan the registry for the key

HKEY_CLASSES_ROOT\CLSID\{2933BF90-7B36-11D2-B20E-0 0C04F983E60}\VersionList

2. If "4.0" is listed as a Name under that key, then

3. Manually install MSXML 4.0 SP 3 from http://www.microsoft.com/en-us/download/details.as...

Note how that sweeps a whole lot of details under the rug: Whether you have 4.1/SP1 or 4.2/SP2 installed, for example. The only glitch I can see is if the Windows user has the MSXML 4.0 SP3 beta installed; in that case, they need to manually remove the beta. (Not sure how.)

Does anybody know if the steps here will work, and not clobber anything in the process?

Maurice Joyce RE: MSXML 4.0 update
Handling Contributor 18th May, 2014 10:52
Score: 11629
Posts: 8,916
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Last edited on 18th May, 2014 12:34
If you have MSXML4 SP1 or SP2 installed there is a simple tried & tested method to update to a safer version.

Download and install SP3 from here:

http://www.microsoft.com/en-us/download/details.as...

Select the msxml.msi - 2.3 MB file.

After the install reboot.

Now run a manual Windows Update scan & any updates for SP3 will be revealed that requires installation.

Once complete run a full PSI scan & you should see this:

https://1ncuig.bn1.livefilestore.com/y2p3p3eXiB8XY...

--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+0
-0

This thread has been marked as locked.


 Products Solutions Customers Partner Resources Company
 
 Corporate
Vulnerability Intelligence Manager (VIM)
Corporate Software Inspector (CSI)
Consumer
Personal Software Inspector (PSI)
Online Software Inspector (OSI)
 Industry
Compliance
Technology
Integration
 Customers
Testimonials
 VARS
MSSP
Technology Partners
References
 Reports
Webinars
Events
 About us
Careers
Memberships
Newsroom


 
© 2002-2014 Secunia ApS - Rued Langgaards Vej 8, 4th floor, DK-2300 Copenhagen, Denmark - +45 7020 5144
Terms & Conditions and Copyright - Privacy - Report Vulnerability