Main Area and Open Discussion > General Software Discussion

XP SP3 blocks .NET security patches

(1/3) > >>

40hz:
This just in from the Windows Secrets (free Issue 177) newsletter:

XP Service Pack 3 blocks .NET security patches

Susan Bradley    By Susan Bradley

Installing SP3 on Windows XP eliminates the operating system's ability to install important security patches for Microsoft's .NET technology and possibly other software.

This problem forces XP SP3 users to apply patches manually to complete vital updates.

The new error is the latest in a long series of glitches relating to XP's SP3, which Scott Dunn described in his Sept. 11 Top Story. The issues include spontaneous rebooting of systems based on AMD chipsets, as documented by Jesper Johansson in a blog post from last May.

To determine whether your XP SP3 system has a version — or multiple versions — of the .NET Framework installed, open Control Panel's Add or Remove Programs applet and look for it among the list of currently installed programs. If you don't see any .NET entries, you don't have the framework installed on your system and needn't be concerned about the update problem.

If you do see a listing for Microsoft .NET Framework, you need to use a third-party update service such as Secunia's Software Inspector (described below) to patch the program.

A Sept. 16 post on the Windows Server Update Services (WSUS) blog disclosed that .NET 3.0 would not be offered to XP SP3 users. On Sept. 23, Microsoft Knowledge Base article 894199, which tracks changes in the company's patches, indicated that .NET 3.0 and .NET 3.0 Service Pack 1 should be offered to XP SP3 workstations as optional patches.

However, when I tested this on various Windows XP SP3 configurations, I wasn't offered .NET 3.0 as an optional patch. Things got really dicey on my first attempt to install .NET on a Windows XP SP3 machine. During that test, updates for .NET 1.1 and .NET 2.0 failed midstream. I had to use the Windows Installer CleanUp Utility (which is described in KB article 290301) and Aaron Stebner's .NET Framework cleanup tool (download page) to uninstall the partially installed .NET frameworks.

Ultimately, I had to install .NET 3.5 SP1 in order to get any .NET framework loaded onto the test XP workstation. While the latest version of .NET 3.5 is a cumulative patch and thus could be installed in place of prior versions of .NET, what invariably occurs is that line-of-business applications require and install earlier versions of .NET.

For example, one of the programs I use regularly is QuickBooks, which includes .NET 1.1 in some versions and 2.0 in the 2008 and 2009 releases. I recommend against removing various versions of .NET if the frameworks were installed by your applications.

On my second and third tests of Windows XP SP3 machines, Windows Update did not detect .NET 3.0 as an optional update, but the frameworks were installed without error just the same. However, to manually update the XP systems, I first had to install Microsoft's Windows Genuine Advantage tool, which is described in KB article 892130.

Next, I had to upgrade the installer program, as described in KB article 898461. After installing these two programs and returning to the Windows Update service, the XP SP3 machine was offered .NET 1.1 and .NET 2.0 as optional updates but not .NET 3.0 as a patchable item.
--- End quote ---

zridling:
Yikes. Microsoft's whole re-proach of XP since Vista arrived could not have been handled worse.

Damned if you don't upgrade, damned to use Vista if you do. Oy.

cranioscopical:
This just in from the Windows Secrets (free Issue 177) newsletter:
-40hz (December 04, 2008, 10:00 AM)
--- End quote ---
I took a look at my set up after reading the newsletter.  Mine's fallen prey to this.
I had the same kind of nonsense to deal with on my previous machine, with SP2.
The issue isn't one that I'm pleased to have to revisit!

CWuestefeld:
I think the headline of this article is a tad sensationalist. It implies that all .Net updates are blocked. In fact, it only affect .Net 3.0. That's bad, but it's really not the end of the world.

You can always upgrade to .Net 3.5, the current version. And I *think* that 3.0 was a relatively short-lived version, just a transitional thing to the current 3.5.

cranioscopical:
For some reason 'Wupdates' thinks I need an update to 2.0 (to 2.1, I think)
on my XP SP3 box.  Of course, it cannot install it.
I know how to fix this but had to participate in the same song and dance
on my XP SP2 machine.

I think the headline of this article is a tad sensationalist.-CWuestefeld
--- End quote ---
I'm with you on that but I find much of WS to be the same way; sensationalism sells, perhaps.

Navigation

[0] Message Index

[#] Next page