navigation bar left navigation bar right

Secunia CSI7
navigation left tab Advisories navigation right tab
navigation left tab Research navigation right tab
navigation left tab Forums navigation right tab
navigation left tab Create Profile navigation right tab
navigation left tab Our Commitment navigation right tab
PSI
PSI API
CSI
OSI
xSI
Vulnerabilities
Programs
Open Discussions
My Threads
Create Thread
Statistics
About

Forum Thread: MS .NET Framework 1.1 SP 1

You are currently viewing a forum thread in the Secunia Community Forum. Please note that opinions expressed here are not of Secunia but solely reflect those of the user who wrote it.

This thread was submitted in the following forum:
Programs

Relating to this vendor:
Microsoft
And, this specific program:
Microsoft Windows XP Home Edition

This thread has been marked as locked.
davidb09 MS .NET Framework 1.1 SP 1
Member 10th Mar, 2010 13:54
Ranking: 0
Posts: 9
User Since: 20th Apr, 2008
System Score: N/A
Location: N/A
PSI has just informed me that I am insecure as I have an important download outstanding on the above program. However, this download is shown a having zero content, ie. 0 Kb. The download is therefore totally ineffective! I do not appear to have this framework program installed anyway. Unless there is any other reasonable option I intend to mark this as ignore.

Any comments please?

ddmarshall RE: MS .NET Framework 1.1 SP 1
Dedicated Contributor 10th Mar, 2010 15:12
Score: 1219
Posts: 971
User Since: 8th Nov 2008
System Score: 98%
Location: UK
Which version of Windows are you using?

--
This answer is provided “as-is.” You bear the risk of using it.
Was this reply relevant?
+0
-0
davidb009 RE: MS .NET Framework 1.1 SP 1
Member 10th Mar, 2010 17:38
Score: 6
Posts: 11
User Since: 11th Feb 2010
System Score: N/A
Location: UK
You asked what version of Windows I am using.

Windows XP Home, fully updated.

--
davidb009
Was this reply relevant?
+0
-0
ddmarshall RE: MS .NET Framework 1.1 SP 1
Dedicated Contributor 10th Mar, 2010 19:11
Score: 1219
Posts: 971
User Since: 8th Nov 2008
System Score: 98%
Location: UK
I've not got an XP System available so this is based on memory and looking at Microsoft websites.

.NET Framework 1.1 SP1 is an additional component on XP SP2 and higher. It should show up in Add/Remove Programs. If it isn't there Secunia might be picking up a remnant of something. Does Secunia give you a path for the vulnerability?

Do you have any other versions of .NET Framework installed?

--
This answer is provided “as-is.” You bear the risk of using it.
Was this reply relevant?
+0
-0
Anthony Wells RE: MS .NET Framework 1.1 SP 1
Expert Contributor 10th Mar, 2010 19:49
Score: 2463
Posts: 3,348
User Since: 19th Dec 2007
System Score: N/A
Location: N/A
Last edited on 10th Mar, 2010 20:24
For reference I have XP SP3 Home edition showing as "patched" in PSI ; similarly showing are :-

.NET 1.x = 1.1.4322.2643
.NET 2.x = 2.0.50727.3082
.NET 3.x = 3.0.4506.2152

My last update for 1.1 is KB953297 dated 13/10/2009
My last update (shown by M$/Windows as non-priority) for 2.2 is KB976569 dated 09/03/2010 - this has loaded twice and is still being offered at "microsoftupdate" but is not shown as missing by PSI . It is displayed in "Add/Remove".
My last update for 3.3 is KB976570 dated 09/03/2010.

A download shows as 0 bytes until it is moved from it's initial location on the disk , so I have been told .

Hope this is of some use .

Anthony

PS: Belarc is today showing a missing security fix which may be related to the reoffered KB .



--


It always seems impossible until its done.
Nelson Mandela
Was this reply relevant?
+10
-0
davidb09 RE: MS .NET Framework 1.1 SP 1
Member 11th Mar, 2010 15:47
Score: 0
Posts: 9
User Since: 20th Apr 2008
System Score: N/A
Location: N/A
Thanks for your comments. I have .NET FW 2.0, 2.0 SP2, 3.0 SP2 and 3.5 SP1 installed.

MS Update keeps trying to install 1.1 SP1 as above (I downloaded this manually, 10 Mb approx., but it refuses to install and hangs). This then appears to affect PSI, which also stops responding. Following this, I cannot close down or restart machine, and have to force closure with the power button.

This is an extremely confusing picture for non-expert users such as myself. The functions and need for these different Framework programs are left unclear and MS do not seem to have the update processes under proper control.
Was this reply relevant?
+0
-0
davidb09 RE: MS .NET Framework 1.1 SP 1
Member 11th Mar, 2010 16:03
Score: 0
Posts: 9
User Since: 20th Apr 2008
System Score: N/A
Location: N/A
Thanks for second comment, Regarding state of .Net components, I have similar patch state for .Net 2.x and 3.x, but my patch state for .Net 1.x is 1.1.4322.2407, not....2643.
Was this reply relevant?
+0
-0
Maurice Joyce RE: MS .NET Framework 1.1 SP 1
Handling Contributor 11th Mar, 2010 16:38
Score: 11865
Posts: 9,101
User Since: 4th Jan 2009
System Score: N/A
Location: UK
David,
Have U any idea which programme U have installed calling on .Net 1 or 1.1?

I removed it from my XP test machine 18 months ago with no ill effects. I have included my bog standard reply to .Net problems. Once read U may wish to try removing .Net 1/1.1 - that will remove the problem & a bit of bloatware if it is not required.

.NET FRAMEWORK PROBLEMS
=======================

A bit of background information worth knowing before trying to fix .NET issues with Windows XP,Vista & Windows 7

1. .NET Framework 1.0, 1.1 and 2.0 are all side-by-side versions that can be installed and uninstalled without affecting the others. This means that if you are running into an issue in .NET Framework 2.0, for example, you do not necessarily need to remove .NET Framework 1.0 and 1.1 in addition to removing 2.0.

2. .NET Framework 3.0 is an add-on that requires .NET Framework 2.0 to be present as a prerequisite. If you have .NET Framework 3.0 installed, you will not be allowed to uninstall .NET Framework 2.0 until you first uninstall .NET Framework 3.0.

3. .NET Framework 3.5 is an add-on that requires .NET Framework 2.0 SP1 and .NET Framework 3.0 SP1 to be present as prerequisites. If you have .NET Framework 3.5 installed, you will not be allowed to uninstall .NET Framework 3.0 SP1 or 2.0 SP1 until you first uninstall .NET Framework 3.5.

4. .NET Framework 3.5 SP1 is an add-on that requires .NET Framework 2.0 SP2 and .NET Framework 3.0 SP2 to be present as prerequisites. If you have .NET Framework 3.5 SP1 installed, you will not be allowed to uninstall .NET Framework 3.0 SP2 or 2.0 SP2 until you first uninstall .NET Framework 3.5 SP1.

.NET 1 & 1.1 are very old & it is highly unlikely U will have a programme that "calls" on it to work. It can be safely uninstalled in the knowledge that if it is later required they can be re installed as Standalone items.

++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++

If you are having trouble installing .NET Framework 2.0, 3.0 or 3.5, I recommend trying to install .NET Framework 3.5 SP1. It will install .NET Framework 2.0 SP2 and 3.0 SP2 behind the scenes, and these versions contain additional fixes not in the original 2.0, 3.0 or 3.5 releases. Plus, 3.5 SP1 will automatically uninstall any older versions of 2.0, 3.0 or 3.5 that are on your system, so you can save some time by not trying to install a version of .NET Framework that 3.5 SP1 is going to uninstall during its install process.

Link is here:

http://www.microsoft.com/downloads/details.aspx?fa...

++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++
The latest version of .NET framework 3 is different among the various versions of Windows.

Windows XP: V3.0.4506.2152
Windows Vista: V3.0.4506.4037
Windows 7: V3.0.4506.4926
++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++
There is a last resort but read the details before embarking on the action described.

NET FRAMEWORK CLEANUP TOOL FOR XP & VISTA

The link to a .Net Framework Clean Up Tool is here:

http://www.raymond.cc/blog/archives/2008/12/02/uni...

Revised by MJJ March 2010




--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+0
-0
Anthony Wells RE: MS .NET Framework 1.1 SP 1
Expert Contributor 11th Mar, 2010 16:52
Score: 2463
Posts: 3,348
User Since: 19th Dec 2007
System Score: N/A
Location: N/A
Last edited on 11th Mar, 2010 16:58
Hello @davidb09 .

Belarc and my Control Panel "Add/Remove" identify .NET 1.1 , 2.0 SP2 , 3.0 SP2 and 3.5 SP1 as loaded and up to date on my PC . Note that PSI is not recording (for me) .NET 3.5 . ; I also understand there is a later version of my .NET 2.x than that shown by PSI .

Since my problem with KB976569 (noted above) then Belarc has started advising me of a missing critical security fix referenced here :-

http://support.microsoft.com/default.aspx?scid=kb;...

By chance or circumstance the original date of this bulletin is the same date as that of the latest KB installed in my .NET 1.1

To date the only help for my KB976569 is the suggestion to hide it at M$ updates (it is non-priority) but leaves the Belarc warning .

What is your bulletin or KB reference for your 1.1 download ??

Anthony

PS: a typo in my 1.1 version showing in PSI ; it is version .2443 and not .2643 ; still not the same as yours .

--


It always seems impossible until its done.
Nelson Mandela
Was this reply relevant?
+1
-0
ddmarshall RE: MS .NET Framework 1.1 SP 1
Dedicated Contributor 11th Mar, 2010 17:01
Score: 1219
Posts: 971
User Since: 8th Nov 2008
System Score: 98%
Location: UK
.NET Framework problems can be an absolute pig to fix. This site is a good source of advice and the author seems happy to help. He is the author of the cleanup tools.

http://blogs.msdn.com/astebner/archive/2008/03/07/...

--
This answer is provided “as-is.” You bear the risk of using it.
Was this reply relevant?
+1
-0
Anthony Wells RE: MS .NET Framework 1.1 SP 1
Expert Contributor 11th Mar, 2010 19:11
Score: 2463
Posts: 3,348
User Since: 19th Dec 2007
System Score: N/A
Location: N/A

Following the trail from the Belarc link to MS09-061 everything would seem to indicate that I am missing a Critical update KB974417 which would "update" my .NET 2.0 SP2 to version 2.0.50727.3603 (from .3082) .

I have downloaded and run both the English and French versions of KB974417 and each time I am told that the products relating to the software are not found on my PC . PSI is still showing .NET 2.0 as patched and no mention of .NET 3.5.

No help that way for now :((

Anthony




--


It always seems impossible until its done.
Nelson Mandela
Was this reply relevant?
+0
-0
Maurice Joyce RE: MS .NET Framework 1.1 SP 1
Handling Contributor 11th Mar, 2010 22:47
Score: 11865
Posts: 9,101
User Since: 4th Jan 2009
System Score: N/A
Location: UK
@Anthony,
I have just checked my XP machine against your findings. The .exe file PSI is reporting on is 2.0.50727.3082.

That is the latest version and is secure.

Updating by first checking the link http://support.microsoft.com/kb/974417
tells U only these files will be updated:

mscordacwks.dll 2.0.50727.3607 (that is what they should be now)
mscorlib.dll 2.0.50727.3607
mscorwks.dll 2.0.50727.3607

Worth checking these files are indeed updated. If they are U are fully up to date.

If not,were U using this link to install?

http://www.microsoft.com/downloads/details.aspx?fa...

Is it the 10.9MB x86 download that is giving grief?



--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+1
-0
Anthony Wells RE: MS .NET Framework 1.1 SP 1
Expert Contributor 11th Mar, 2010 23:22
Score: 2463
Posts: 3,348
User Since: 19th Dec 2007
System Score: N/A
Location: N/A

@Maurice ,

Thank you for the confirmation of your data ; excuse me , I should have specified that the 3 files had not updated , they still show version .3082 .

I used the same download site as per your link and it is the 10.9 MB x86 that is giving the no product on my PC warning ; I have tried to run both the English and French versions as I have the French language pack for 1.1 , 2.0 and 3.0 . and MY XP is basically French .

The/my download history at "microsoftupdates" shows KB974417 as succesfully installed along withKB953297 on 13/10/2009 but that is the only trace I can find , nothing in Add/Remove , no uninstaller in the main Windows folder .

The repeating KB976569 is confirmed everywhere as installed (i have masked it at updates for now) and seems to have been the trigger for Belarc to point out the bulletin MSO9-061 (same as your link) and to specify KB974417 as a missing Critical fix .

This does seem to have been a problem for some people for some time , obviously my turn now .

Thanks for your help.
Anthony

--


It always seems impossible until its done.
Nelson Mandela
Was this reply relevant?
+0
-0
Maurice Joyce RE: MS .NET Framework 1.1 SP 1
Handling Contributor 11th Mar, 2010 23:49
Score: 11865
Posts: 9,101
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Last edited on 12th Mar, 2010 10:39
I agree - @ddmarshall sums it up nicely - can be a pig sometimes.

Provided there are no downloads available from Windows Update U should be OK.

If U do decide to tinker just follows my guidelines from my previous post which are amplified in @ddmarshall's link.

.Net has many facets. Is Silverlight up to date via Windows Update?

What about DirectX? Have U updated that recently? Link is here:

http://www.microsoft.com/downloads/details.aspx?Fa...

If not I would run it - fairly large download but only installs the bits U need.

I note U have KB976569 installed - did this problem start after this recent update?



--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+2
-0
Anthony Wells RE: MS .NET Framework 1.1 SP 1
Expert Contributor 12th Mar, 2010 11:40
Score: 2463
Posts: 3,348
User Since: 19th Dec 2007
System Score: N/A
Location: N/A
@Maurice

Silverlight did it's update recently and is up to date (non Beta) at v3.0.50106.0 .

Can't be sure when I last did DirectX altogether so have used your download link and will run the updater later .

I can confirm that :

Belarc gave a clean bill of health after the February M$/Windows updates .

Last Tuesday (09/03/2010) the KB976569 loaded seemingly successfully and checks out everywhere as installed ; but it is re-offered continuously under "custom , non-priority" at "update" and I have now masked it .

Only my history (at "update") currently shows KB974417 as successfully installed on 13/10/2009 . Belarc (first run since February on Wednesday 10/03/2010) shows it as missing and I cannot find it "recorded" anywhere on my HDD .

I will leave any .NET "fiddling" for a while to see if anything comes out of what is being discussed on the web ; I am not overly concerned at the moment and don't have the time to be honest .

I wonder how David is getting on with his .1.1 update problem and whether that relates at all to KB974417 going AWOL ??.

Thank you for your help .
Anthony

--


It always seems impossible until its done.
Nelson Mandela
Was this reply relevant?
+0
-0
davidb009 RE: MS .NET Framework 1.1 SP 1
Member 12th Mar, 2010 11:54
Score: 6
Posts: 11
User Since: 11th Feb 2010
System Score: N/A
Location: UK
Thank you very much for a most comprehensive reply. I have decided to leave well alone, ie. ignoring advised updates, although I cannot 'ignore' the PSI notification of XP vulnerability, perhaps understandably. I did try manually accessing NDP 1.1 sp1 - KB 8687460 -X86.exe, but it refuses to install.

This whole system of .NET programs badly needs a final comprehensive clean-up before the July 2010 deadline for XP support, judging by the various responses to my original post. Doubt if MS will do it, though.

Finally, I have just read about your initiative for a system for improved security updating. I emphatically agree!!! This series of posts underlines the position of the ordinary user with limited knowlege such as myself. As you rightly say, many will just throw up their hands and give up.



--
davidb009
Was this reply relevant?
+0
-0
ddmarshall RE: MS .NET Framework 1.1 SP 1
Dedicated Contributor 12th Mar, 2010 17:01
Score: 1219
Posts: 971
User Since: 8th Nov 2008
System Score: 98%
Location: UK
It's only XP with no service packs and XP SP2 32bit which are losing support. XP SP3 and XP SP2 64bit are supported upto April 8, 2014. Don't know about .Net 4.0 on XP.

--
This answer is provided “as-is.” You bear the risk of using it.
Was this reply relevant?
+1
-0
Anthony Wells RE: MS .NET Framework 1.1 SP 1
Expert Contributor 12th Mar, 2010 18:28
Score: 2463
Posts: 3,348
User Since: 19th Dec 2007
System Score: N/A
Location: N/A
Last edited on 12th Mar, 2010 18:29
@Maurice and ddmarshall ,

Had a few minutes to "spare" and after reading a couple of inconclusive web debates on my subject , there seemed to be implied logic , so I did :-

1)deleted KB976569 using "Add/Remove"

2)ran the KB974417 installer (English version) and it installed correctly and shows everywhere with the original date of 13/10/2010 - Belarc shows fix as locked .

3) unmasked KB976569 at "updates" and installed it . Successful install (with today's date) and KB974417 wiped out ; KB 976569 continues to offer itself at updates and Belarc reports the missing Critical security fix :ie: my original problem returned .

Repeated 1) and 2) successfully and have ignored the kind offer of KB976569 .

It would seem that this problem was predicted , but not exactly as it has happened to me .

The three files still show as v.3802and have not updated , but no reboot as yet .

@David , probably not much help to you , but perhaps following the PSI installation path might take you to the problem 1.1 to be cleaned up (if you chose tat ) or , if you have KB976569 and KB976570 installed , deleting them may allow your recalcitrant 1.1 update to install .

Who knows for sure ??

Take care
Anthony



--


It always seems impossible until its done.
Nelson Mandela
Was this reply relevant?
+1
-0
Maurice Joyce RE: MS .NET Framework 1.1 SP 1
Handling Contributor 12th Mar, 2010 19:05
Score: 11865
Posts: 9,101
User Since: 4th Jan 2009
System Score: N/A
Location: UK
@Anthony,
You have nearly got there. You will note I did ask on a previous thread if U had installed KB976569.

I asked that because some would argue that updating .Net, unless requested by a third party programme vendor, is not necessary & can cause trouble.Susan Bradley is one of them!

I disagree in the belief that any update offers something better than before.

What is for sure is this is not a Microsoft glitch. Finding the root cause is the "pig" element! One of your programmes has nobbled .Net.

David could try your solution but I believe his problem is less "serious". Many vendors still use .Net V2. Doubt there are many who use V1. As I explained I removed it from XP 18 months ago as bloatware.

Will be interesting to see how this pans out. Your ongoing investigations could help in the future.





--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+0
-0

This thread has been marked as locked.


 Products Solutions Customers Partner Resources Company
 
 Corporate
Vulnerability Intelligence Manager (VIM)
Corporate Software Inspector (CSI)
Consumer
Personal Software Inspector (PSI)
Online Software Inspector (OSI)
 Industry
Compliance
Technology
Integration
 Customers
Testimonials
 MSSP
Technology Partners
References
 Reports
Webinars
Events
 About us
Careers
Memberships
Newsroom


Secunia is a member of FIRST Secunia is a member of EDUcause Secunia is a member of The Open Group Secunia is a member of FS-ISAC
 
Secunia © 2002-2014 Secunia ApS - Rued Langgaards Vej 8, 4th floor, DK-2300 Copenhagen, Denmark - +45 7020 5144
Terms & Conditions and Copyright - Privacy - Report Vulnerability - Disclaimer
follow Secunia on Facebook follow Secunia on Twitter follow Secunia on LinkedIn follow Secunia on YouTube follow Secunia Xing follow Secunias RSS feed follow Secunia on Google+