Secunia CSI7
Advisories
Research
Forums
Create Profile
Our Commitment
PSI
PSI API
CSI
OSI
xSI
Vulnerabilities
Programs
Open Discussions
My Threads
Create Thread
Statistics
About

Forum Thread: Microsoft .NET Framework 2 x and 3.x

You are currently viewing a forum thread in the Secunia Community Forum. Please note that opinions expressed here are not of Secunia but solely reflect those of the user who wrote it.

This thread was submitted in the following forum:
Programs

Relating to this vendor:
Microsoft
And, this specific program:
Microsoft .NET Framework 3.x

This thread has been marked as locked.
Dagobert57 Microsoft .NET Framework 2 x and 3.x
Member 11th Aug, 2010 15:36
Ranking: 0
Posts: 5
User Since: 11th Aug, 2010
System Score: N/A
Location: N/A
Microsoft .NET Framework 2 x and 3.x are listet as a 4 treat on my XP SP3 PC. Why is that?
I've got all the security updates, but I can't get rid of this warnings. Any suggestions?

Thanks,
-Dag

This user no longer exists RE: Microsoft .NET Framework 2 x and 3.x
Member 11th Aug, 2010 15:39
Hi,

Microsoft Updates usually require a reboot before they "kick in". Therefore, I would suggest you try restarting your computer, check Microsoft update again (installing anything available and rebooting if anything was), then rescan with the PSI.

hope this helps.
Was this reply relevant?
+0
-0
Dagobert57 RE: Microsoft .NET Framework 2 x and 3.x
Member 11th Aug, 2010 15:47
Score: 0
Posts: 5
User Since: 11th Aug 2010
System Score: N/A
Location: N/A
on 11th Aug, 2010 15:39, wrote:
Hi,

Microsoft Updates usually require a reboot before they "kick in". Therefore, I would suggest you try restarting your computer, check Microsoft update again (installing anything available and rebooting if anything was), then rescan with the PSI.

hope this helps.


Hi,

I've done this several times. Windows update reports that the update was sucsessful. Rebotting my computer and running Secunia again, but the problems are still listed?

Thanks for your answer :-)
Was this reply relevant?
+0
-0
LiseGA RE: Microsoft .NET Framework 2 x and 3.x
Member 11th Aug, 2010 16:12
Score: 0
Posts: 2
User Since: 31st May 2010
System Score: N/A
Location: N/A
I also have 'installed' these two updates from Microsoft, today for the second time - at the end it seems ok, but when Secunia has finished scanning, it is still a threat category 2. Arghhhh!
Was this reply relevant?
+0
-0
Dagobert57 RE: Microsoft .NET Framework 2 x and 3.x
Member 11th Aug, 2010 16:20
Score: 0
Posts: 5
User Since: 11th Aug 2010
System Score: N/A
Location: N/A
on 11th Aug, 2010 16:12, LiseGA wrote:
I also have 'installed' these two updates from Microsoft, today for the second time - at the end it seems ok, but when Secunia has finished scanning, it is still a threat category 2. Arghhhh!


Okey, so I'm not alone then ;) Secunia shows threat category 4 om my XP PC.
On my oter Vista and Win 7 PC's there's no problem at all.
I wonder if this happened some time ago, after an unsucsessful upgrade of Microsoft .NET Framework 2 x and 3.x.

But why now, when the updates are in place. Driving me nuts that i can't figure this out.

-Dag
Was this reply relevant?
+0
-0
Dagobert57 RE: Microsoft .NET Framework 2 x and 3.x
Member 11th Aug, 2010 17:15
Score: 0
Posts: 5
User Since: 11th Aug 2010
System Score: N/A
Location: N/A
May be due to a bug in the Secunia software? Now I've tried all options but no way. After I update Windows XP SP3, it takes a reset, and when I go to Windows Update again. are the same updates are there ready to download?

Microsoft Windows XP

Security. NET Framework 2.0 SP2 and 3.5 SP1 on Windows Server 2003 and Windows XP x86 (KB983583)
Download Size: 0 KB, 0 minutes (Downloaded and ready for installation)
It found a vulnerability that could allow an intruder to compromise your Windows-based system running the Microsoft. NET Framework and gain complete control over it. You can help protect your computer by installing this update from Microsoft. When you install this item, you may need to restart your computer. Details ...


Security Update for Microsoft. NET Framework 3.5 SP1 and. NET Framework 2.0 SP2 for Windows 2000, Windows Server 2003 and Windows XP x86 (KB979909)
Download Size: 0 kb, 0 minutes (Downloaded and ready for installation),
It has identified a vulnerability that could cause an attacker could tamper with digitally signed content without being detected, when this content is used by a program that makes use of Microsoft. NET Framework on a Windows-based system. You can help protect your computer by installing this update from Microsoft. When you install this item, you may need to restart your computer. Details ...


Update for Microsoft. NET Framework 3.5 for Windows Server 2003 and Windows XP x86 (KB982168)
Download Size: 0 KB, 0 minutes (Downloaded and ready for installation)
Install this update to enhance godkjenningslegitimasjonene in specific scenarios. After you install this item, you may need to restart your computer. Details ...

???
-Dag
Was this reply relevant?
+0
-0
Maurice Joyce RE: Microsoft .NET Framework 2 x and 3.x
Handling Contributor 11th Aug, 2010 17:39
Score: 11633
Posts: 8,918
User Since: 4th Jan 2009
System Score: N/A
Location: UK
There are reported problems with XP & PSI version 1.5.0.2. which Secunia are investigating.

U could try an uninstall of version 1.5.0.2 & revert back to 1.5.0.1

Install link is here:
ftp://ftp.secunia.com/PSISetup1501.exe

Do a full rescan & I hope all is in order.

--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+1
-0
Dagobert57 RE: Microsoft .NET Framework 2 x and 3.x
Member 11th Aug, 2010 18:17
Score: 0
Posts: 5
User Since: 11th Aug 2010
System Score: N/A
Location: N/A
Thanks for your answer Maurice.

I did exactly what you told med: uninstall of version 1.5.0.2 & revert back to 1.5.0.1

New scan, but the same problems occours. I don't know how "dangerous" this is, but in the beginning of September, I will upgrade hardware on my PC, and go for Windows 7 64-bit. (Intel Core™ i7 Quad Processor i7-930Quad Core, 2.8Ghz) 16GB RAM

Nothing bad has happened yet, so I trust it will be okey until my PC is upgraded.

Thanx a lot for your response :)

-Dag
Was this reply relevant?
+0
-0
Maurice Joyce RE: Microsoft .NET Framework 2 x and 3.x
Handling Contributor 11th Aug, 2010 18:31
Score: 11633
Posts: 8,918
User Since: 4th Jan 2009
System Score: N/A
Location: UK
I think U will be OK until then. If time allows U can "fiddle while Rome is burning" with these links:

Links are here to reinstall current or try another version:

Version 1.5.0.2 - Current version. I would try a reinstall as a first option.

http://secunia.com/vulnerability_scanning/personal...


Version 1.9.0.2 - Trial version that is working very well. This is worth a try.

http://secunia.com/PSISetupAUTP.exe

Version 1.5.0.1 - This is currently being used as a cure for some having problems with XP - worth a try as a VERY LAST resort.

ftp://ftp.secunia.com/PSISetup1501.exe

Your new PC will be excellent. I use an i7 with 16GB - goes like a rocket.

If U need any help with the new OS on arrival use the Open Discussion section.


If U do not think we can help U any further could U please lock (Accept) the thread. This will prevent U & I getting update emails from "tag on" posts.

--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+2
-0
Anthony Wells RE: Microsoft .NET Framework 2 x and 3.x
Expert Contributor 11th Aug, 2010 19:26
Score: 2434
Posts: 3,318
User Since: 19th Dec 2007
System Score: N/A
Location: N/A
Last edited on 11th Aug, 2010 19:28
Hello Dag and LiseGA ,

If you web search your KB numbers , you will see that 979909 of 22/06/2010 and 982168 of 29/07/2010 each have a history of failing to load correctly and being re-offered by M$ updates .

983583 dates from yesterday and does not have any real history as yet .

If you do not want to wait until you go stellar (Dag:)) , then in similar circumstances (with a build up of non-sticky patches) I deleted my .NET showing in "add/remove" (leaving whatever Windows .NET files behind) and reinstalled ; all patches applied correctly .

Hope that helps

Antony

--


It always seems impossible until its done.
Nelson Mandela
Was this reply relevant?
+0
-0
bigtrucks RE: Microsoft .NET Framework 2 x and 3.x
Member 11th Aug, 2010 23:01
Score: 0
Posts: 6
User Since: 16th Jul 2010
System Score: N/A
Location: US
OK this is not just effecting XP. I have a Vista SP2 and have the same issues with Microsoft.NET Framework 2x&3x Plus Microsoft Internet Explorer 7.x & Microsoft Windows Vista. All have be updated and as mentioned before every time I tick the solution it comes back No New Updates. Also having issues with Macromedia Flash Player 7x and Adobe Flash player 9x .

--
A Question Is One Step To Learning And I Am Learning One Step At A Time.
Was this reply relevant?
+0
-0
Maurice Joyce RE: Microsoft .NET Framework 2 x and 3.x
Handling Contributor 11th Aug, 2010 23:14
Score: 11633
Posts: 8,918
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Last edited on 11th Aug, 2010 23:14
@bigtrucks
If U are talking about standalone Flash on your C drive they are way out of date.

This should fix that issue.
UPDATING STANDALONE ADOBE FLASH
===============================
Works with Windows XP,Vista & Windows 7 - 32 & 64 Bit systems.

If U have PSI version 1.9.0.2 installed have U tried the auto update feature?

OR

To successfully install Adobe Flash go here:
http://www.filehippo.com/download_flashplayer_ie/

& then here if U have any Gecko based (Firefox etc) browsers.

http://www.filehippo.com/download_flashplayer_fire...

The latest version is:10.1.82.76

1. Download & SAVE it to desktop.
2. The installer will appear on the desk top. Before agreeing to install check these programmes are closed:
a. All Browsers.
b. PSI.
c. Windows Messenger.
d. Incredimail.
e. Adobe Free Reader.

3. The new install will then remove all old files during the update process.
4. Complete a PSI rescan & all should be in order.
5. Delete the Flash installer from the desktop.

POSSIBLE PROBLEMS.
++++++++++++++++++

If U failed to complete 2. above U may well find PSI still shows a vulnerability on the rescan.

SOLUTION

1. Double check all items listed in 2. above are closed.
2. Navigate to:
32 Bit Systems - C:\Windows\system32\Macromedia\Flash
64 Bit Systems - C:\Windows\sysWOW64\Macromedia\Flash

In these locations U may well find these entries:
FLASH10D or E or H.OCX - Right click & delete it/them.
FLASH10i.OCX - The latest version which should be retained.


SOLUTION 2

1. Check the path to the vulnerability.

If PSI has found elements of Flash in the C:\i386 folder or on any drive other than C that is an OEM reinstallation partition (normally D drive) or a drive U use solely to backup your work U can safely create an ignore rule. It may also be in the Recycle Bin.

OPTIONAL EXTRA'S
++++++++++++++++

Security. (Fairly important if U care to check what Adobe attempt to store on a PC)
Adobe also have a very bad habit of changing your Flash settings each time they plug vulnerabilities. To change the security settings to your liking & regain control of your PC click here:

http://www.macromedia.com/support/documentation/en...

Click each tab U see & change the settings to your security requirements.

Bloat ware.(Very important if U dislike totally useless programmes installed on your PC)
If you used the Adobe site, rather than FileHippo to update you will also find they try or have installed an unnecessary Download Manager.

It is bloat ware by a third party Company called NOS. If found I would uninstall it via Add/Remove.


Update 13 17:11 11/08/2010





--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+2
-0
bigtrucks RE: Microsoft .NET Framework 2 x and 3.x
Member 11th Aug, 2010 23:32
Score: 0
Posts: 6
User Since: 16th Jul 2010
System Score: N/A
Location: US
Thanks for the reply.
I did that and the only thing it updated was the 10 and the MAC is still there as well as the 9. I also tried to locate the MAC in the c: files and there is nothing. I looked in my Programs and features aka add/remove programs and did not find any Macromedia anything.
What about the new Threats.
Thanks
BT

--
A Question Is One Step To Learning And I Am Learning One Step At A Time.
Was this reply relevant?
+0
-0
This user no longer exists RE: Microsoft .NET Framework 2 x and 3.x
Member 12th Aug, 2010 09:01
Hi,

As mentioned, updates for Microsoft sometimes take some time to "kick in". Me and my colleques have tested this, and found that all of our systems were "patchable". It is not safe to ignore this issue. As Secure Browsing will probably have let you know, .NET usually integrates in the browser.

Try following this procedure to get up to date:

1) Check Microsoft Update, install all important and security-related patches
2) Reboot, check Microsoft Update again
3) If anything was found, repeat step 2
4) Rescan with the PSI

This should at the very least eliminate the vulnerabilities for Internet Explorer and your operating systems. If you are having problems updating your .NET installations, trying a reinstall might remedy the situation.

hope this helps.
Was this reply relevant?
+0
-0
jargaez RE: Microsoft .NET Framework 2 x and 3.x
Member 12th Aug, 2010 13:22
Score: 0
Posts: 1
User Since: 12th Aug 2010
System Score: N/A
Location: N/A
I have the same problem and I think it is because Microsoft .NET Framework 2.x & 3.x are still in the hard drive.
I have the following folders, and inside them many files and executables:

C:\Windows\Microsoft.NET\Framework\v1.0.3705\
C:\Windows\Microsoft.NET\Framework\v1.1.4322\
C:\Windows\Microsoft.NET\Framework\v2.0.50727\
C:\Windows\Microsoft.NET\Framework\v3.0\
C:\Windows\Microsoft.NET\Framework\v3.5\
C:\Windows\Microsoft.NET\Framework\v4.0.30319\

Uninstalling previous versions of 4.0 does not erase previous versions.

Is it safe to erase manually the extra-folders?

Thank you.

Was this reply relevant?
+0
-0
Anthony Wells RE: Microsoft .NET Framework 2 x and 3.x
Expert Contributor 12th Aug, 2010 15:49
Score: 2434
Posts: 3,318
User Since: 19th Dec 2007
System Score: N/A
Location: N/A
Last edited on 12th Aug, 2010 15:53
@jargaez ,

I would suggest tat you read this tread :-

http://secunia.com/community/forum/thread/show/496...


and be sure to follow this link (found in the linked thread) as explained :ie: to the post from Maurice Joyce :-

http://secunia.com/community/forum/thread/show/424...

In the past on XP SP3 with a build up of KB # patches not installing correctly and being re-offered by/at M$updates, I un-installed all the .NET items I could find showing in "Add/Remove" leaving behind a lot of files in the

C:\Windows\Microsoft.NET\Framework\... variuos folders you mention .

I reinstalled and all patches were successfully applied :)))

For a root and branch clean out , then best first check out Aaron Stebner's Clean Up Tool (found in the above links)

Hope that is clear , if not ask again . As it says everywhere , it is at your own risk , .NET is a complex beast .

Anthony

EDIT : second link not working , will try to fix it - it is very important . NOW fixed .


--


It always seems impossible until its done.
Nelson Mandela
Was this reply relevant?
+1
-0
LiseGA RE: Microsoft .NET Framework 2 x and 3.x
Member 13th Aug, 2010 12:59
Score: 0
Posts: 2
User Since: 31st May 2010
System Score: N/A
Location: N/A
With great interest I have follow all your posts - latest I have tried your recipe, Anthony; first installing .NET Framework 3.5 SP1 and then afterwords 2.x (each time I did a reboot)- here 2.x failed, I was told by a Secunia scan.
So I went on to the next step, uninstalling as described 'Aaron Stebner's' - but that site showed an error 404 / was unavailable.
Now I looked into Add/Remove, but it looks like I allready have the .NET Framework 1.1, 2.0 SP2, 3.0 SP2 and 3.5 SP1 - what I intended to do, was to go through a manual cleaning before reinstalling, but I came to wonder: is Secunia scan allways right ?! It still says, that I have a category 4 threat ....
Was this reply relevant?
+0
-0
Anthony Wells RE: Microsoft .NET Framework 2 x and 3.x
Expert Contributor 13th Aug, 2010 13:35
Score: 2434
Posts: 3,318
User Since: 19th Dec 2007
System Score: N/A
Location: N/A

Hello LiseGA ,


Secunia is mostly correct and in my experience is so on this .NET problem .

Belarc Advisor gives a (free) crosscheck on M$ security patches , if that helps :-

http://www.belarc.com/free_download.html

Here's an active link to Aaron's blog/website :-

http://blogs.msdn.com/b/astebner/archive/2005/08/2...

and an active link to the Clean Up Tool :-

http://blogs.msdn.com/b/astebner/archive/2008/08/2...

also , here's a link to @Pockets thread who has just fixed a KB979906 problem :-

http://secunia.com/community/forum/thread/show/508...

For me , eihter the "Add/Remove" "repair" option or the "remove" all versions option (and leave some of the C:\WINDOWS\icrosoft.NET\... folders/files as are) and reinstall have shown best reported/least risk solutions so far . Nothing is guaranteed in the case of the .NET beast .

You are doing well and seem to have a grip on the subject , so try to do what you feel confident in doing ; ask again , if you need to .

Let us know your progress .

Anthony

--


It always seems impossible until its done.
Nelson Mandela
Was this reply relevant?
+1
-0
streek53 RE: Microsoft .NET Framework 2 x and 3.x
Member 13th Aug, 2010 15:03
Score: 0
Posts: 2
User Since: 2nd Nov 2008
System Score: N/A
Location: N/A
PSI reports that I have problems with Microsoft .NET Framework 2.x AND 3.X, as well as Microsoft Windows XP SP3 Home Edition, along with 7 other items which patched successfully the first time around.

Download Solution throws pulls up IE, where I generally use Foxfire, for the Windows Update site, which prompts me and I select Custom.

(I generally don't have a problem with the yellow shield; I click on it, and updates are d/Led and installed, which takes forever, but what can ya do? I've seen some installs - and an "Updates being installed" notice comes up - after hitting reboot, but they do their thing, then the reboot continues without incident.)

Then it scans for updates... and finds 15 of 'em, none of which are the ones listed on the Insecure page.

Okay, having d/Led and installed all of this, the .NET and SP3 insecure items are still on the Insecure page. (Yes, I started an infinite loop of going back and forth between Secunia and WU, but didn't keep doing the same thing repeatedly expecting different outcomes. WU consistently doesn't find the insecure items.)

Any thoughts? If the solution is WU, it's a dead end. The yellow shield has come and gone, while the insecure items remain on the Insecurities page.


Was this reply relevant?
+0
-0
Anthony Wells RE: Microsoft .NET Framework 2 x and 3.x
Expert Contributor 14th Aug, 2010 14:59
Score: 2434
Posts: 3,318
User Since: 19th Dec 2007
System Score: N/A
Location: N/A

Hi @streek53 ,

So what exactly ("installation paths") and in which "tabs" is the PSI (in "advanced" mode) indicating that you still have a problem ??

AFAIK , the PSI "solution" for things M$ will always pick IE to get the downloads (whatever you select as your default browser) as it is essential for contacting M$updates . Even your "shield" from auto updates will use embedded IE to provide you with it's info . Same applies to you to get to M$updates .

Firefox/M$ will only allow you manually select specific KB's from the M$ download site , so your comment that you use Ff and select 'Custom" at "Windows updates" surprises me .

You need a reboot (better cold start) and run a full scan for MS updates/patches to register correctly , have you done this after the WU roundabout has shown no updates available ??

Anthony

--


It always seems impossible until its done.
Nelson Mandela
Was this reply relevant?
+0
-0

This thread has been marked as locked.


 Products Solutions Customers Partner Resources Company
 
 Corporate
Vulnerability Intelligence Manager (VIM)
Corporate Software Inspector (CSI)
Consumer
Personal Software Inspector (PSI)
Online Software Inspector (OSI)
 Industry
Compliance
Technology
Integration
 Customers
Testimonials
 VARS
MSSP
Technology Partners
References
 Reports
Webinars
Events
 About us
Careers
Memberships
Newsroom


 
© 2002-2014 Secunia ApS - Rued Langgaards Vej 8, 4th floor, DK-2300 Copenhagen, Denmark - +45 7020 5144
Terms & Conditions and Copyright - Privacy - Report Vulnerability