[comments inline...]
Michael W wrote:
> Hello,
>
> I have a situation that has just arisen on my computer (Win 2000 Pro, latest
> SP and updates) that I don't understand or what I should do (or where to
> "go") to resolve it. A set of critical updates just appeared when I scanned
> on the Windows Update Web site. Just appeared for me, that is. I scan there
> (manually) frequently (at least once a week). There were five in total, these
> also listed for me when I ran MBSA locally (KB: 824151, 841533, 840987,
> 841356, 834707).
>
> These all downloaded and installed just fine (from the web site). I did the
> first four together, and after a restart, reconnect and rescan, the last
> "Cumulative Security Update for Internet Explorer (834707) MS04-038" done
> last and by itself. No problema.
>
>
> However, MBSA still indicates a problem with MSXML (in two places it
> indicates). Note: these same two indicated from the start. They are: see [1]
> and [2] following...
>
> [1.]
>
> In the Windows Security Updates "Issue":
> "Vulnerability in WebDav XML Message Handler Could Lead to a Denial of
> Service (824151) MS04-030". Note: this the first KB number listed above.
> (Thus do not understand why MBSA indicates it is still a problem, as
> apparently the update for it ran successfully from the Windows Update Web
> page). The "Reason" description for this issue: "File version is less than
> expected. [C:\WINNT\system32\msxml3.dll, 8.40.9419.0 < 8.50.2162.0]"
>
> Doing a search for msxml3.dll, 3 copies are found. All the same version
> "8.40.9419.0", locations Windir\System32, "$ProgramFiles\Common
> Files\Microsoft Shared\SFPCA Cache", and Windir\RegisteredPackages\{ a large
> reg key ID }.
>
> I do note that there is no copy found in the Windir\system32\dllcache
> folder. ??
That's pretty normal, sometimes it is there, and sometimes not. My
Win2k MSXML 3.0 SP4 installation was not found to be found in the
dllcache folder, but after installing KB824151 (a.k.a. MSXML 3.0 SP5),
the xml files was there.
> The "How to Correct this" link in MBSA indicates that Windows Update Web
> Site should find and correct this problem.. Why it did not (apparently?) when
> KB824151 ran originally, I also wonder why.
>
> What to do?
Your KB824151 installation must have failed is some way. For me, on
Win2k, it installs msxml3.dll 8.50.2162.0 (MSXML 3.0 SP5). Before
installing KB824151, I had v8.40.9419.0 (MSXML 3.0 SP4)
Download and install KB824151 manually from here and see if it helps
(this was the way I did install it, I did not use WU):
http://www.microsoft.com/downloads/d...4-D841905CE181
> [2.]
>
> MBSA's third "issue" (shaded blue areas) entitled "MSXML Security Updates"
> has a Yellow "X", and "1 products are using a service pack not at the latest
> version or have other warnings. Three columns indicate:
>
> Security Update:
> MSXML 3.0
>
> Description:
> MSXML 3.0 SP4
>
> Reason:
> The latest service pack for this product is not installed.
> Currently SP4 is installed. The latest service pack is SP5.
>
> In Control Panel\Add Remove Programs, an entry entitled "MSXML 4.0 SP2
> Parser and SDK" size 1.29MB is listed. Cannot verify the status, I see
> nothing where this might be (other than system folders).
>
> I don't understand what the problem is. Is it MSXML 3.0 SP4 vs. SP5? How did
> this suddenly occur? (I wonder, I realize this you don't know). Unless the
> most recently obtained MBSA data file is somehow wrong or screwed up. My MBSA
> is version 1.2.4013.0, with database version 2004.10.12.0 (Office
> 11.0.0.7005).
>
> No indication what I should do nor where to go. (Red X Severe indicated for
> [1] above).
>
> I know MSXML has other versions well beyond 3.0 or 4.0.
There is no newer version of MSXML than 4.0.
> Do all these have many Service Packs? For example, SP5 for 3.0.
Currently, MSXML 3.0 is at SP5, MSXML 4.0 is at SP2.
> I knew XML would be trouble when I first learned about it. A text file is
> not a database. I know, I know. I've heard all the purists' arguments many
> times. In any argument, a Text file is easily opened (encouraged to go so)
> and thus easily edited by any one or any editor. This opposed to having
> database services or at least an Excel backup file to protect data. I
> shouldn't preach with I don't really believe, and most of you are saved and
> in the choir already anyway, eh?
>
> Beyond what to do for the above MSXML issues, can anyone shed a little light
> what all these MSXML versions and Service Packs mean? i.e. what is being
> defined and why "MSXML" vs. say "XML" ?
MSXML 4.0 SP2 does not replace MSXML 3.0 because some obsolete and
non-conformant features are no longer supported. You may run MSXML 4.0
and MSXML 3.0 and earlier versions concurrently.
The service pack updates to the MSXML versions provides a number of
security and bug fixes, it's a convenient way to "bunch" them together.
--
torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scr...r/default.mspx
Similar Threads
Linear Mode
