XP SP3 blocks .NET security patches

[40hz]

This just in from the Windows Secrets (free Issue 177) newsletter:

XP Service Pack 3 blocks .NET security patches

Susan Bradley    By Susan Bradley

Installing SP3 on Windows XP eliminates the operating system's ability to install important security patches for Microsoft's .NET technology and possibly other software.

This problem forces XP SP3 users to apply patches manually to complete vital updates.

The new error is the latest in a long series of glitches relating to XP's SP3, which Scott Dunn described in his Sept. 11 Top Story. The issues include spontaneous rebooting of systems based on AMD chipsets, as documented by Jesper Johansson in a blog post from last May.

To determine whether your XP SP3 system has a version — or multiple versions — of the .NET Framework installed, open Control Panel's Add or Remove Programs applet and look for it among the list of currently installed programs. If you don't see any .NET entries, you don't have the framework installed on your system and needn't be concerned about the update problem.

If you do see a listing for Microsoft .NET Framework, you need to use a third-party update service such as Secunia's Software Inspector (described below) to patch the program.

A Sept. 16 post on the Windows Server Update Services (WSUS) blog disclosed that .NET 3.0 would not be offered to XP SP3 users. On Sept. 23, Microsoft Knowledge Base article 894199, which tracks changes in the company's patches, indicated that .NET 3.0 and .NET 3.0 Service Pack 1 should be offered to XP SP3 workstations as optional patches.

However, when I tested this on various Windows XP SP3 configurations, I wasn't offered .NET 3.0 as an optional patch. Things got really dicey on my first attempt to install .NET on a Windows XP SP3 machine. During that test, updates for .NET 1.1 and .NET 2.0 failed midstream. I had to use the Windows Installer CleanUp Utility (which is described in KB article 290301) and Aaron Stebner's .NET Framework cleanup tool (download page) to uninstall the partially installed .NET frameworks.

Ultimately, I had to install .NET 3.5 SP1 in order to get any .NET framework loaded onto the test XP workstation. While the latest version of .NET 3.5 is a cumulative patch and thus could be installed in place of prior versions of .NET, what invariably occurs is that line-of-business applications require and install earlier versions of .NET.

For example, one of the programs I use regularly is QuickBooks, which includes .NET 1.1 in some versions and 2.0 in the 2008 and 2009 releases. I recommend against removing various versions of .NET if the frameworks were installed by your applications.

On my second and third tests of Windows XP SP3 machines, Windows Update did not detect .NET 3.0 as an optional update, but the frameworks were installed without error just the same. However, to manually update the XP systems, I first had to install Microsoft's Windows Genuine Advantage tool, which is described in KB article 892130.

Next, I had to upgrade the installer program, as described in KB article 898461. After installing these two programs and returning to the Windows Update service, the XP SP3 machine was offered .NET 1.1 and .NET 2.0 as optional updates but not .NET 3.0 as a patchable item.

[zridling]

Yikes. Microsoft's whole re-proach of XP since Vista arrived could not have been handled worse.

Damned if you don't upgrade, damned to use Vista if you do. Oy.

[cranioscopical]

This just in from the Windows Secrets (free Issue 177) newsletter:

-40hz (December 04, 2008, 10:00 AM)

I took a look at my set up after reading the newsletter.  Mine's fallen prey to this.
I had the same kind of nonsense to deal with on my previous machine, with SP2.
The issue isn't one that I'm pleased to have to revisit!

[CWuestefeld]

I think the headline of this article is a tad sensationalist. It implies that all .Net updates are blocked. In fact, it only affect .Net 3.0. That's bad, but it's really not the end of the world.

You can always upgrade to .Net 3.5, the current version. And I *think* that 3.0 was a relatively short-lived version, just a transitional thing to the current 3.5.

[cranioscopical]

For some reason 'Wupdates' thinks I need an update to 2.0 (to 2.1, I think)
on my XP SP3 box.  Of course, it cannot install it.
I know how to fix this but had to participate in the same song and dance
on my XP SP2 machine.

I think the headline of this article is a tad sensationalist.

-CWuestefeld

I'm with you on that but I find much of WS to be the same way; sensationalism sells, perhaps.

[Lashiec]

Hmmm, when I reinstalled Windows a few months ago, I applied XP SP3, and later .NET 3.5, and I was offered the security updates for .NET 2.0 and .NET 3.0, as well as .NET 1.1. What I wasn't offered yet on WU is 3.5 SP1 (and I don't remember installing it), so this may explain the reason behind it.

Windows Update could be better than it is (for example, it does not offer me updates for the Office viewers, but it does for Windows Defender, and sometimes updates fail to download correctly), but I agree with you guys that WS is a bit too jumpy for a simple matter. Not to mention two glitches don't amount to "a long series", even more considering that the first one wasn't Microsoft's fault.

[40hz]

I think the headline of this article is a tad sensationalist.

-CWuestefeld

I'm with you on that but I find much of WS to be the same way; sensationalism sells, perhaps.

-cranioscopical (December 05, 2008, 08:47 AM)

... I agree with you guys that WS is a bit too jumpy for a simple matter. Not to mention two glitches don't amount to "a long series", even more considering that the first one wasn't Microsoft's fault.

-Lashiec (December 05, 2008, 12:12 PM)

Yeah I agree with you guys too.

I don't know if I'd characterize WS as being sensationalist (at least not for this article ), but I think Lashiec hit it right on the head with the word jumpy. One of the reasons I didn't subscribe to WS is because I really can't take the breathless tone that seems to permeate most of their stuff. Makes one long for the old days of Gizmo Richards and his Tech Support Alert Newsletter.

I'm seeing a lot of that behavior from the press lately, combined with a healthy dose of truthiness added to just about everything reported.

So, is the whole news world starting to sound more and more like a blog - or is it just me?

Hmmm...maybe I should set up a blog to discuss this...

[cranioscopical]

maybe I should set up a blog to discuss this

-40hz (December 05, 2008, 12:54 PM)

Don't forget to tell Reuters when you do! 

[app103]

This is a new machine I purchased in October and my Windows CD is XP SP3, so I didn't have to download and install the service pack like a lot of other people.

I had no issues with downloading and installing .NET 1.1 or 2.0 from Windows Update. Both were offered to me and installed without a hitch.

I just noticed though, that I didn't have .NET 3.0 or 3.5 installed and went to Windows update. Neither one of them were offered.

So I did a search and found the full installers for them. When you install 3.5, you get 3.0 sp1 and 2.0 sp1, too. You won't need to go hunt down those versions.

Now if you want the installer for 3.5, it's here (direct download for full package)

And those of you looking for 3.5 sp1, you'll find it here (direct download for full package)

I had no issues installing the full package.

The other download they offer is a small bootstrapper that downloads it for you, and that one seemed to have some issues with getting stuck while downloading the necessary files. It kept stopping and starting over, and redownloading every time it hit 6MB, with the progressbar going backwards instead of forwards. So I quit it and got the full one instead.

For those of you that have to update your Windows Installer to 3.1 first, you'll find that here.

[cranioscopical]

app103: Thanks for the links. Helpful as ever and much appreciated.

[Lashiec]

OK, seems this is fixed. Automatic Updates offered me yesterday .NET 3.5 SP1 (a gigantic download, BTW), so apparently security patches for .NET are again being pushed through the update system.

[tomos]

hmm,
I'm getting offered this even though I only seem to have NET3 installed - I also have NET2 Servicepack1 but no sign of NET2 itself - what a mess

Worthwhile installing 3.5 do you think?

btw, I never bothered with SP3 (just mention in case relevant)

For those of you that have to update your Windows Installer to 3.1 first, you'll find that here.

-app103 (December 06, 2008, 08:18 PM)

I notice version 4.5 is available.
This I know nothing about - do I need to   ??

[Lashiec]

I guess so. The next major version of Paint.NET will require it, so I would need to install it sooner or later. I rarely pause to think about installing updates or not, apart from reading the notes regarding possible issues, anyway

[Lashiec]

One thing I forgot to comment is that .NET 3.5 SP1 slips an extension in Firefox without asking. Just for you to be in the know.