Secunia CSI7
Advisories
Research
Forums
Create Profile
Our Commitment
PSI
PSI API
CSI
OSI
xSI
Vulnerabilities
Programs
Open Discussions
My Threads
Create Thread
Statistics
About

Forum Thread: Microsoft NET.Framework

You are currently viewing a forum thread in the Secunia Community Forum. Please note that opinions expressed here are not of Secunia but solely reflect those of the user who wrote it.

This thread was submitted in the following forum:
PSI

This thread has been marked as resolved.
mickymik Microsoft NET.Framework
Member 3rd Oct, 2010 11:50
Ranking: 1
Posts: 9
User Since: 3rd Oct, 2010
System Score: N/A
Location: UK
Hello all, over the last couple of days, Secunia reports an insecure program.It is Microsoft NET.Framework version 1.1.4322.\aspnet_wp.exe
I am using version PSI.1.5.0.2. XP SP3.
If i go to C:\WINDOWS\Microsoft.NET.Framework, I see

v.1.0.3705 (133 kb )
v.1.1.4322 ( 45.9 mb )
v.2.0.50727 ( 3.22 mb )

The strange thing is I did have notification of a windows update 2 days ago relating to NET.Framework, when i clicked install, the yellow shield disappeared, and has not returned.
I also had a windows update relating to the UK time difference, I removed it today,rebooted, and was notified of this update again, no mention of NET.Framework.
Can anyone advise,
Thank you for your time

One last thing to add to the confusion, several months ago, I downloaded the software for my HP printer and was told to update the NET.Framework,I did this, however, i seem to remember, in doing this , it created another user account, Aspnet_wp.account Which I deleted.
I have just read this article http://www.mvps.org/marksxp/WindowsXP/aspdot.php, which says " It is possible to recreate the user by issuing the following command from the run dialog (changing the framework version number as appropriate)
%systemroot%\Microsoft.NET\Framework\v1.1.4322\asp net_regiis.exe /i "
Once again thank you

Post "RE: Microsoft NET.Framework" has been selected as an answer.
pilk00 RE: Microsoft NET.Framework
Member 3rd Oct, 2010 15:46
Score: 0
Posts: 2
User Since: 3rd Oct 2010
System Score: N/A
Location: US
I don't have an answer for you, but I have a related problem I'm working on.

My scan is showing 3 insecure programs:
Microsoft.NET Framework 2.x
Microsoft.NET Framework 3.x
Microsoft.NET Framework 4.x

Yesterday I was also showing the same program with 1.x. I took a chance and removed that one through "add and remove programs".

When I go to the Microsoft update page, the only critical update I'm missing is one for ...NET Framework 4.x. I run it, but it doesn't register with Secunia as being updated.

I tried removing ...NET Framwork 2.x from my system, but I got an error saying installed programs depended on it.

My Secunia security system score has risen from 91% yesterday to 96% today, but it's the wonderful world of Microsoft that's blocking me from what I'm assuming would be long-anticipated true systems security.

Any ideas would be appreciated.

Was this reply relevant?
+0
-0
pilk00 RE: Microsoft NET.Framework
Member 3rd Oct, 2010 16:51
Score: 0
Posts: 2
User Since: 3rd Oct 2010
System Score: N/A
Location: US
Following the instructions below from the forum, net.framework, I determined the update for all three problems: 2.x, 3.x and 4.x was KB2416472.

I ran the update, rebooted, and reran Secunia PSI. The 3 problems remain.

Conclusion: Something in Secunia needs fixed. BTW, I'm running XP.

From the DASHBOARD page click on SCAN RESULTS.

1. This will list all your programmes with a + to the left of each one.
2. Click the + sign next to the item that U want help with.
3. This will reveal the path under DETECTED INSTANCES.
4. Highlight it then copy (CTRL+C) then paste (CTRL+V) that path back to the Forum if U do not know what to do next.
KB2416472
Was this reply relevant?
+0
-0
mickymik RE: Microsoft NET.Framework
Member 3rd Oct, 2010 17:17
Score: 1
Posts: 9
User Since: 3rd Oct 2010
System Score: N/A
Location: UK
I just ran Secunia on my other XP machine.The only framework on that one is 1.1.
Secunia reported it insecure.I removed 1.1.Downloaded v2 and installed.Secunia now reports this insecure.I guess it would be the same for v3 and v4.
I am no longer concerned.I think this problem is Secunia related.
Apparently some programs require earlier versions, so having v4 and deleting the others is not an option.
Like I say, I will just ignore this warning
Was this reply relevant?
+0
-0
mogs RE: Microsoft NET.Framework
Expert Contributor 3rd Oct, 2010 20:02
Score: 2265
Posts: 6,266
User Since: 22nd Apr 2009
System Score: 100%
Location: UK
Last edited on 3rd Oct, 2010 20:08
Hello.
If you scroll down to Maurice Joyce's post on the thread with the following link, you'll find some explanation/background to .NET problems :-
http://secunia.com/community/forum/thread/show/424...
Since then there have been further updates; and depending 'pon what OS you're using, here are the current arrangements, when fully patched.


WINDOWS 7
2.0.50727.4955
3.0.4506.4926
4.0.30319.1

VISTA SP2

2.0.50727.4209
3.0.4506.4037
4.0.30319.1

XP SP3

2.0.50727.3618
3.0.4506.2152
4.0.30319.1

When updating Microsoft Applications, it is a good idea to keep in mind that some Microsoft Updates do not "kick in" until after a reboot. Therefore, it is recommended to try following this proceduce when installing Microsoft Updates:

1) Check Microsoft Update, install all security-related patches
2) Reboot
3) Repeat step 1, repeat step 2 if anything was installed at this step
4) Run a full rescan with the PSI

Hope the foregoing is of some help....regards,




--
Was this reply relevant?
+1
-0
Anthony Wells RE: Microsoft NET.Framework
Expert Contributor 3rd Oct, 2010 21:09
Score: 2414
Posts: 3,310
User Since: 19th Dec 2007
System Score: N/A
Location: N/A
Last edited on 3rd Oct, 2010 21:26
KB2416473 is the patch for 3.5 SP1 and nothing else . There are two other patches (for XP ) for 1.1 and 2.0 :-

M2416447 for 1.1

KB2418241for 2.0

EDIT for pilk00 :KB2416472 is for .Net 4.0 only .

You should see these in Add/Remove and in your DLD history @ M$updates ; you can cross-check with Belarc :-

http://belarc.com/free_download.html

Before fiddling with .NET , which can be a recipe for pain and disillusion , follow Mogs' link and read Maurice Joyce's excellent script .

If you are still in the unknown thereafter , come back here and let us review your situations .

Hope that is clear enuff :))

Anthony

PS: ignoring an insecurity displayed by the PSI in any version of .Net when there are patches available is like putting your head in the sand ; you won't see the problem 'till it hits a sensitive part of your exposed bits and pieces :(((

--


It always seems impossible until its done.
Nelson Mandela
Was this reply relevant?
+1
-0
mickymik RE: Microsoft NET.Framework
Member 3rd Oct, 2010 21:55
Score: 1
Posts: 9
User Since: 3rd Oct 2010
System Score: N/A
Location: UK
Dear all, many thanks for your replies and advice. I've had a long day of downloading ( on a very slow pc ) updates framework 2 sp2, framework 3 sp2, framework 3.5 sp1, etc.

I finally decided to install WGA tool and visit the update website ( instead of rebooting and waiting for notifications )

At last, I have installed every update, rebooted, run Secunia, and got 100%. So thank you very much everyone, thank you Secunia.

Once again, cheers for you time and advice, its much appreciated
Was this reply relevant?
+0
-0

This thread has been marked as locked.


 Products Solutions Customers Partner Resources Company
 
 Corporate
Vulnerability Intelligence Manager (VIM)
Corporate Software Inspector (CSI)
Consumer
Personal Software Inspector (PSI)
Online Software Inspector (OSI)
 Industry
Compliance
Technology
Integration
 Customers
Testimonials
 VARS
MSSP
Technology Partners
References
 Reports
Webinars
Events
 About us
Careers
Memberships
Newsroom


 
© 2002-2014 Secunia ApS - Rued Langgaards Vej 8, 4th floor, DK-2300 Copenhagen, Denmark - +45 7020 5144
Terms & Conditions and Copyright - Privacy - Report Vulnerability