0

I have one server that requires a .NET3.5 patch KB951847 (per MBSA) but vulnerability scan does not report that patch as needed... the details: Server W2003 has .NET4.0 installed but MBSA tells me that I need to install KB 951847 patch that installs .NET 3.5, why? I have ONLY installed .NET2 SP2 and .NET 4 , so .NET 4.0 shouldn't make .NET 3.5 Irrelevant?

-Server W2003 SP2 (x86) -Nessus scan does not show any .NET vulnerabilities

please help me to solve this discrepancy, I am trying to avoid to install an unnecessary software (.NET 3.5).

Thank you :)

Community
  • 1
fl0w3r
  • 3

4 Answers4

1

Scott Hanselman does an excellent job explaining the versioning of .NET in his blog entry:

.NET Versioning and Multi-Targeting - .NET 4.5 is an in-place upgrade to .NET 4.0.

In short, .NET 3.5 is an in-place upgrade to .NET 2 so that's why it needs to be installed. He also has another blog entry that, while IIS centric, has great information explaining the relationship between .NET 2.0 and .NET 3.5.

How to set an IIS Application or AppPool to use ASP.NET 3.5 rather than 2.0

user2320464
  • 799
1

.NET 3.0/3.5/3.5 SP1 were DLL/feature additions/optimizations on top of .NET 2.0.

Internally, all of these versions of .NET use the same core CLR (Common Language Runtime) executable. So, just the presence of .NET 2.0 SP2 on your machine is enough to expose the vulnerability MBSA is flagging.

With .NET 4.0, Microsoft actually re-wrote the CLR, creating a new, separate executable. If you only had 4.0 on the machine, you probably wouldn't be getting flagged for this patch.

This TechNet article explains the relationship between .NET 2.0 and 3.0/3.5/3.5 SP1 somewhat:
.NET Framework 3.5.1 Features Overview

Brian Grogan Jr.
  • 36
0

Vulnerability scans suffer from a couple of problems: false positives and false negatives.

Which is why you always need to check the results, and why there is a thriving industry in proper penetration testing, in addition to vulnerability scanning.

Generally, MBSA is pretty good at sorting out dependencies, so perhaps you have parts of .NET installed as part of one of your applications.

Rory Alsop
  • 1,184
  • Thank you Rory, forgive me if I am very lost here but having installed .NET 4.0 wouldn't make installation of .NET 3.5 irrelevant? – fl0w3r Dec 06 '13 at 01:23
0

Each different major version of .net (2.0, 3.0, 3.5, 4.0) are entirely separate, and require their own set of updates. If you have an app that uses .NET 3.5 you still need 3.5 even if you have 4.0.

You need to install the security updates for ALL versions of .NET that you have installed. IF you are not using .NET 3.5 you can uninstall it

Allan Jude
  • 1,316