Secunia CSI7
Advisories
Research
Forums
Create Profile
Our Commitment
PSI
PSI API
CSI
OSI
xSI
Vulnerabilities
Programs
Open Discussions
My Threads
Create Thread
Statistics
About

Forum Thread: Microsoft XML Core Services (MSXML) 3.x (end of life)

You are currently viewing a forum thread in the Secunia Community Forum. Please note that opinions expressed here are not of Secunia but solely reflect those of the user who wrote it.

This thread was submitted in the following forum:
Programs

Relating to this vendor:
Microsoft
And, this specific program:
Microsoft XML Core Services (MSXML) 3.x

This thread has been marked as resolved.
Nikilet Microsoft XML Core Services (MSXML) 3.x (end of life)
Member 18th Aug, 2010 04:16
Ranking: 7
Posts: 287
User Since: 15th Jul, 2008
System Score: N/A
Location: N/A
Last edited on 18th Aug, 2010 04:17

Secunia says this Microsoft XML Core Services (MSXML) 3.x is end of life and I should either upate it or remove it. The option to update is greyed out. I'm hesitant to "remove" this. Can anyone advise?

The path is: C:\Windows\SDOLD\Download\a409e337b733de88d68c80e0 c2243f84\x86_microsoft-windows-msxml30_31bf3856ad3 64e35_6.0.6000.16500_none_8688000e99af9424\msxml3. dll

Post "RE: Microsoft XML Core Services (MSXML) 3.x (end of life)" has been selected as an answer.
thedillpickl RE: Microsoft XML Core Services (MSXML) 3.x (end of life)
Contributor 18th Aug, 2010 08:36
Score: 376
Posts: 872
User Since: 3rd May 2009
System Score: 100%
Location: US
Last edited on 18th Aug, 2010 08:41
Hi Nikilet;

You do not say what OS you're running, I don't believe it matters.

MSXML 3.x is replaced by MSXML 4.0 Service Pack 2 (KB973688) on my HP laptop. http://www.microsoft.com/downloads/details.aspx?Fa... MS Updates shows no update (for me) even though MS site shows later versions.

> Open Microsoft Updates, on the left click on "Restore hidden updates", click on "Custom", select and install all updates.
> A reboot will most likely be required. Shut down Windows (Sleep & Hibernate are not the same thing.) Completely power down the computer and restart.
> Repeat until no more updates are available.
> Run a manual scan in PSI.

> Did installing all updates remove MSXML 3.x ?
> Did MS Updates install a new MSXML that is supported by MS? (If unsure, look in PSI under the "Patched" tab.)

Edit: Here's a link that explains MSXML (it made me dizzy). http://en.wikipedia.org/wiki/MSXML


Regards;

Fred

--
XP Home
Chrome, Firefox, IE8
--
consilio et animis
Was this reply relevant?
+1
-0
This user no longer exists RE: Microsoft XML Core Services (MSXML) 3.x (end of life)
Member 18th Aug, 2010 09:16
Hi,

End-Of-Life applications are those which the Vendor no longer supports. This means that even known security problems in the application will not be fixed, since the vendor focuses on the more recent versions. It is always recommended to update to a more recent version.

The most recent version of MSXML is version 6. This version is free for download, and can be had here: http://www.microsoft.com/downloads/details.aspx?Fa...

If you feel insecure about removing MSXML version 3, I suggest you contact Microsoft Support, so they can help you ensure there will be no complications in updating.

hope this helps.
Was this reply relevant?
+0
-0
Maurice Joyce RE: Microsoft XML Core Services (MSXML) 3.x (end of life)
Handling Contributor 18th Aug, 2010 09:40
Score: 11720
Posts: 8,956
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Last edited on 18th Aug, 2010 10:50
The path to the vulnerability is the key issue. It is in the OLD Software Distribution folder. I personally would delete the folder but there are some that add caution to that action in which case U can rename it OLD or Ignore it.

As far as I am concerned this is the current position regarding XML.

WINDOWS MSXML DETAILS
+++++++++++++++++++++
This gives an overview of MSXML & a fix for MSXML 4 problems.

MSXML 6.0.
+++++++++
MSXML6 is the latest MSXML product from Microsoft, and along with MSXML3 is shipped with Microsoft SQL Server 2005, Visual Studio 2005, .NET Framework 3.0, Windows Vista, Windows 7 and Windows XP Service Pack 3. It also has support for native 64-bit environments. It is an upgrade but not replacement for versions 3 and 4 as they still provide legacy features not supported in version 6. Version 6, 4, and 3 may all be installed and running concurrently. MSXML 6 is not supported on Windows 9x. Windows XP SP3 includes MSXML 6.0 SP2.

MSXML 5.0
+++++++++
MSXML5 is a binary developed specifically for Microsoft Office. It originally shipped with Office 2003 and also ships with Office 2007. Microsoft has not released documentation for this version as they consider it an internal/integrated component.

MSXML 4.0
+++++++++
MSXML4 was shipped as an independent, downloadable SDK targeted at Independent Software Vendors and third parties. It is an upgrade for but not a replacement to MSXML3 as version 3 still provides legacy features. Versions 4 and 3 may be run concurrently.

MSXML 4.0 SP3 is the most recent version released in March 2009, SP2 support expired in April 2010.

The release notes for MSXML 4.0 SP3 are here:

http://download.microsoft.com/download/A/2/D/A2D85...

The download link is here:
http://www.microsoft.com/downloads/details.aspx?fa...

If U do require to update your current MSXML4 Secunia picks it up as secure with version 4.30.2107.0 provided U have downloaded the additional patch via MS Update.

MSXML 3.0
+++++++++
MSXML3 is a current MSXML product, represented by msxml3.dll. MSXML 3.0 SP2 first shipped with Windows XP, Internet Explorer 6.0 and MDAC 2.7. Windows XP SP2 includes MSXML 3.0 SP5 as part of MDAC 2.81. Windows 2000 SP4 also ships with MSXML 3.0. By default, Internet Explorer version 6.0, 7.0 and 8.0 use MSXML 3 to parse XML documents loaded in a window. MSXML 3.0 SP7 is the last supported version for Windows 9x. Windows XP SP3 includes MSXML 3.0 SP9. Windows Vista also includes MSXML 3.0 (SP10).


Revision 3.

I await the brickbats from those who suggest XML 3 is somehow obsolete!! The current version in Windows 7 is MSXML 3 SP11 file version 8.110.7600.16605

--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+5
-0
thedillpickl RE: Microsoft XML Core Services (MSXML) 3.x (end of life)
Contributor 18th Aug, 2010 18:22
Score: 376
Posts: 872
User Since: 3rd May 2009
System Score: 100%
Location: US
@Maurice;

Thanks for catching the 'SDOLD' in installation path.

Thanks also for MSXML explanation. More concise than Wikipedia.


Fred

--
XP Home
Chrome, Firefox, IE8
--
consilio et animis
Was this reply relevant?
+0
-0
Nikilet RE: Microsoft XML Core Services (MSXML) 3.x (end of life)
Member 18th Aug, 2010 18:30
Score: 7
Posts: 287
User Since: 15th Jul 2008
System Score: N/A
Location: N/A
First, I thank everyone for the very thorough answers, the thought and time put into them, but it's still kind of beyond me.

Maurice: When I look in my Patched tab in PSI, it shows the following: Microsoft XML Core Services (MSXML) 4x 4.20.9876.0 and Microsoft XML Core Services (MSXML) 6x 6.20.5002.0.

I have five listings under Add/Remove programs with regard to MSXML 4.0 SP2 and all have different KB numbers so I assume everything is up to date as it should be.

Ages ago I was having some kind of problem and you instructed me to add SDOLD to two files which fixed the problem. I think those two files are the ones now showing up in PSI as end of life. If that is the case then I would think they'd be safe to remove ... so do I just follow the path and delete these items? Following are the two items showing in PSI as end of life.

C:\Windows\SDOLD\Download\a409e337b733de88d68c80e0 c2243f84\x86_microsoft-windows-msxml30_31bf3856ad3 64e35_6.0.6000.20613_none_8709cdcbb2d29be4\msxml3. dll

C:\Windows\SDOLD\Download\a409e337b733de88d68c80e0 c2243f84\x86_microsoft-windows-msxml30_31bf3856ad3 64e35_6.0.6000.16500_none_8688000e99af9424\msxml3. dll
Was this reply relevant?
+0
-0
Maurice Joyce RE: Microsoft XML Core Services (MSXML) 3.x (end of life)
Handling Contributor 18th Aug, 2010 18:39
Score: 11720
Posts: 8,956
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Try this first.

Navigate back to here: C:\Windows\SDOLD\Download

Renane that folder: C:\Windows\SDOLD\Download_OLD

Do a full rescan. Has that fixed the issue with your 2 files?

--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+0
-0
Nikilet RE: Microsoft XML Core Services (MSXML) 3.x (end of life)
Member 18th Aug, 2010 19:05
Score: 7
Posts: 287
User Since: 15th Jul 2008
System Score: N/A
Location: N/A
I followed the path you gave. When I got to the folder "Download" I right clicked on it, selected rename and then renamed it to Download_OLD. If that process was correct, it didn't work. I rescanned and those two items still show up in end of life.
Was this reply relevant?
+0
-0
Maurice Joyce RE: Microsoft XML Core Services (MSXML) 3.x (end of life)
Handling Contributor 18th Aug, 2010 20:16
Score: 11720
Posts: 8,956
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Last edited on 18th Aug, 2010 20:20
Ok - navigate to each item (PSI should point it to U if U select Open Folder in the toolbox) - right click & select delete.
Now rescan.

--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+2
-0
Nikilet RE: Microsoft XML Core Services (MSXML) 3.x (end of life)
Member 18th Aug, 2010 22:48
Score: 7
Posts: 287
User Since: 15th Jul 2008
System Score: N/A
Location: N/A
Thank you much Maurice. That worked. Now I just have that Adobe SVG Viewer 3.x located at C:\Program Files\Common Files\Adobe\SVG Viewer 3.0\SVGCore.dll and listed as end of life.

The update button is active but there is no update for this. On this forum, at the time this came through there was one gal that reported after she removed it her computer wouldn't boot and I think she said she had to reinstall OS altho I don't remember for sure now. Because of that I left it alone. I wrote to several forums about this and didn't even get a response.
Was this reply relevant?
+0
-0
Maurice Joyce RE: Microsoft XML Core Services (MSXML) 3.x (end of life)
Handling Contributor 18th Aug, 2010 23:46
Score: 11720
Posts: 8,956
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Last edited on 18th Aug, 2010 23:48
Navigate there And rename it OLD.

Like this:
C:\Program Files\Common Files\Adobe\SVG Viewer 3.0\SVGCore.dll_OLD

Rescan - Is that OK?


--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+0
-0
Maurice Joyce RE: Microsoft XML Core Services (MSXML) 3.x (end of life)
Handling Contributor 19th Aug, 2010 23:02
Score: 11720
Posts: 8,956
User Since: 4th Jan 2009
System Score: N/A
Location: UK
@Nikilet
Are U 100% secure now?

--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+0
-0
Nikilet RE: Microsoft XML Core Services (MSXML) 3.x (end of life)
Member 20th Aug, 2010 00:15
Score: 7
Posts: 287
User Since: 15th Jul 2008
System Score: N/A
Location: N/A
No, it didn't change anything, but maybe I have to restart. I did another search and found something I hadn't run across before where the poster said he's just ignoring it so guess that's what I'll do.
Was this reply relevant?
+0
-0
Maurice Joyce RE: Microsoft XML Core Services (MSXML) 3.x (end of life)
Handling Contributor 20th Aug, 2010 00:23
Score: 11720
Posts: 8,956
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Reboot at some stage & see what happens.

Do U use this feature? If not just right click & delete it.

Let me know how U get on - no hurry.

--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+0
-0
Nikilet RE: Microsoft XML Core Services (MSXML) 3.x (end of life)
Member 20th Aug, 2010 01:03
Score: 7
Posts: 287
User Since: 15th Jul 2008
System Score: N/A
Location: N/A
I don't know if I use it, but the way it sounds, removing it could cause problems with your PC.
Was this reply relevant?
+0
-0
Maurice Joyce RE: Microsoft XML Core Services (MSXML) 3.x (end of life)
Handling Contributor 20th Aug, 2010 09:11
Score: 11720
Posts: 8,956
User Since: 4th Jan 2009
System Score: N/A
Location: UK
See this:
http://www.adobe.com/svg/eol.html
http://www.adobe.com/svg/viewer/install/

Like all things Adobe, Windows works perfectly well without any of their bloatware installed.

Removing it should not cause any problems. If U feel uncomfortable doing that U can ignore it in the hope it does not become vulnerable.



--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+1
-0
Nikilet RE: Microsoft XML Core Services (MSXML) 3.x (end of life)
Member 20th Aug, 2010 09:26
Score: 7
Posts: 287
User Since: 15th Jul 2008
System Score: N/A
Location: N/A
Last edited on 20th Aug, 2010 09:37
First, what do I do if I remove it and my PC won't boot, like has happened to others?

Second, I went back to the path you gave me for this item. However, the folder is labeled Adobe Air rather than just Adobe, which confuses me because I uninstalled Adobe Air a long time ago.

Anyway, I had labeled that file with the _OLD, went back in there and the _OLD had disappeared. So I renamed it again. I will check on it to see if it stays in place this time.

**It stayed in place this time. PSI now shows no end-of-life programs. But now I'm afraid to reboot my computer. I'm going to wait to hear from you before I do that, hoping you can tell me what to do if computer won't reboot.

I don't have my Windows CD.
Was this reply relevant?
+0
-0
Maurice Joyce RE: Microsoft XML Core Services (MSXML) 3.x (end of life)
Handling Contributor 20th Aug, 2010 09:56
Score: 11720
Posts: 8,956
User Since: 4th Jan 2009
System Score: N/A
Location: UK
OK - U have renamed files _OLD before. The result should be the same whereby Windows acts normally.

If U have not got a disk then your PC should have an OEM recovery partition. It is highly unlikely that will be needed.

If it causes U real concern go back & reverse the alteration U have made.

I would certainly leave it as it is & reboot. If your PC is stable there is no reason why it will not boot & U have the satisfaction of knowing it is 100% secure.



--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+2
-0
Nikilet RE: Microsoft XML Core Services (MSXML) 3.x (end of life)
Member 20th Aug, 2010 18:51
Score: 7
Posts: 287
User Since: 15th Jul 2008
System Score: N/A
Location: N/A
I rebooted and everything seems to be fine. I would like to pay you a compliment and state that you are the best tech help I have ever worked with ... and I've worked with a lot. Thanks Maurice. Have a great day.
Was this reply relevant?
+0
-0
Maurice Joyce RE: Microsoft XML Core Services (MSXML) 3.x (end of life)
Handling Contributor 20th Aug, 2010 19:33
Score: 11720
Posts: 8,956
User Since: 4th Jan 2009
System Score: N/A
Location: UK
I assume U are now back to 100% secure which is good news.

If all your problems are now resolved could U please lock (Accept) the thread. This will prevent us both from receiving update emails from "tag on" posts.

Have a nice weekend.



--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+1
-0

This thread has been marked as locked.


 Products Solutions Customers Partner Resources Company
 
 Corporate
Vulnerability Intelligence Manager (VIM)
Corporate Software Inspector (CSI)
Consumer
Personal Software Inspector (PSI)
Online Software Inspector (OSI)
 Industry
Compliance
Technology
Integration
 Customers
Testimonials
 VARS
MSSP
Technology Partners
References
 Reports
Webinars
Events
 About us
Careers
Memberships
Newsroom


 
© 2002-2014 Secunia ApS - Rued Langgaards Vej 8, 4th floor, DK-2300 Copenhagen, Denmark - +45 7020 5144
Terms & Conditions and Copyright - Privacy - Report Vulnerability