Discussion:
MBSA 2.1 shows KB951847 is missing
(too old to reply)
Gordon Brown
2009-03-11 13:40:06 UTC
Permalink
Raw Message
I've run MBSA 2.1 on 5 servers. On all 5 it reports that KB951847 is
missing. From everything I have read, this update is only required if you
have .NET Framework 2.0 or later installed. 3 of the 5 servers do not have
this, they only have .NET Framework 1.1.
Why is MBSA telling me I need to install a huge update, when the
documentation on the update itself says I don't?????
Thanks
Doug Neal [MSFT]
2009-03-12 00:41:18 UTC
Permalink
Raw Message
You may want to be 100% sure that only .Net 1.1 is installed on these
machines. Check Add/Remove Programs and be sure to click the option to view
updates. Many customers have found that they, indeed, have a component of
.Net Framework 2.0, 3.0 or 3.5 installed - which is the cause of the KB
951847 offering.

If you still believe the MBSA report to be in error, please send me a ZIPed
copy of your WindowsUpdate.LOG to the address below with the "online."
removed. I hope that helps...
--
--
Doug Neal [MSFT]
***@online.microsoft.com

This posting is provided "AS IS" with no warranties, and confers no rights.

If newsgroup discussion with experts and MVPs is unable to solve a problem
to your satisfaction, feel free to contact PSS for support on the Microsoft
Baseline Security Analyzer (MBSA). Information is available at the following
link:
http://support.microsoft.com/default.aspx

This e-mail address does not receive e-mail, but is used for newsgroup
postings only.
Post by Gordon Brown
I've run MBSA 2.1 on 5 servers. On all 5 it reports that KB951847 is
missing. From everything I have read, this update is only required if you
have .NET Framework 2.0 or later installed. 3 of the 5 servers do not have
this, they only have .NET Framework 1.1.
Why is MBSA telling me I need to install a huge update, when the
documentation on the update itself says I don't?????
Thanks
Gordon Brown
2009-03-12 09:38:02 UTC
Permalink
Raw Message
I have checked all 5 servers. MBSA reports KB951847 is required on all of
them.
If I run the .NET Version detector from www.asoft.be it reports 3 of the
servers only have .NET 1.1.
If I use a browser and go to Microsoft Update on each of the 5 servers, only
2 of them show KB951847 as a high priority update; the other three (the .NET
1.1 ones) show it as an optional update.
I will e-mail you windowsupdate.log from one of the 1.1 servers.

Gordon
Post by Doug Neal [MSFT]
You may want to be 100% sure that only .Net 1.1 is installed on these
machines. Check Add/Remove Programs and be sure to click the option to view
updates. Many customers have found that they, indeed, have a component of
..Net Framework 2.0, 3.0 or 3.5 installed - which is the cause of the KB
951847 offering.
If you still believe the MBSA report to be in error, please send me a ZIPed
copy of your WindowsUpdate.LOG to the address below with the "online."
removed. I hope that helps...
--
--
Doug Neal [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.
If newsgroup discussion with experts and MVPs is unable to solve a problem
to your satisfaction, feel free to contact PSS for support on the Microsoft
Baseline Security Analyzer (MBSA). Information is available at the following
http://support.microsoft.com/default.aspx
This e-mail address does not receive e-mail, but is used for newsgroup
postings only.
Post by Gordon Brown
I've run MBSA 2.1 on 5 servers. On all 5 it reports that KB951847 is
missing. From everything I have read, this update is only required if you
have .NET Framework 2.0 or later installed. 3 of the 5 servers do not have
this, they only have .NET Framework 1.1.
Why is MBSA telling me I need to install a huge update, when the
documentation on the update itself says I don't?????
Thanks
Doug Neal [MSFT]
2009-03-17 18:49:59 UTC
Permalink
Raw Message
Gordon - I'm sorry this took so long, but we had to do some investigation
that resulted in uncovering an unexpected, but ultimately desirable,
behavior in MBSA.



It turns out that even though the recent "Net Framework 3.5 Service Pack 1
and .Net Framework 3.5 Family Update (KB951847)" update is applicable to
.Net 2.0, 3.0 and 3.5 as a recommended update, it is also an optional update
for users of .Net Framework 1.1. Usually, such an optional update would be
ignored by MBSA since we don't release optional items as security updates,
update rollups or service packs (the only classifications MBSA reports).
But in this one case, the .Net Framework 3.5 SP1 and Family pair of updates
are classified as a Service Pack.



This causes MBSA to report these updates due to the Service Pack
classification - which is why you are seeing this in your completed scan
reports.



As with any Service Pack or Update Rollup, this is scored as a yellow
(optional) update that's not required for security compliance as with
Security Updates.



I hope this helps explain the issue. And if you have further questions
about this update or anything more regarding MBSA, please feel free to send
them my way.
--
--
Doug Neal [MSFT]
***@online.microsoft.com

This posting is provided "AS IS" with no warranties, and confers no rights.

If newsgroup discussion with experts and MVPs is unable to solve a problem
to your satisfaction, feel free to contact PSS for support on the Microsoft
Baseline Security Analyzer (MBSA). Information is available at the following
link:
http://support.microsoft.com/default.aspx

This e-mail address does not receive e-mail, but is used for newsgroup
postings only.
Post by Gordon Brown
I have checked all 5 servers. MBSA reports KB951847 is required on all of
them.
If I run the .NET Version detector from www.asoft.be it reports 3 of the
servers only have .NET 1.1.
If I use a browser and go to Microsoft Update on each of the 5 servers, only
2 of them show KB951847 as a high priority update; the other three (the .NET
1.1 ones) show it as an optional update.
I will e-mail you windowsupdate.log from one of the 1.1 servers.
Gordon
Post by Doug Neal [MSFT]
You may want to be 100% sure that only .Net 1.1 is installed on these
machines. Check Add/Remove Programs and be sure to click the option to view
updates. Many customers have found that they, indeed, have a component of
..Net Framework 2.0, 3.0 or 3.5 installed - which is the cause of the KB
951847 offering.
If you still believe the MBSA report to be in error, please send me a ZIPed
copy of your WindowsUpdate.LOG to the address below with the "online."
removed. I hope that helps...
--
--
Doug Neal [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.
If newsgroup discussion with experts and MVPs is unable to solve a problem
to your satisfaction, feel free to contact PSS for support on the Microsoft
Baseline Security Analyzer (MBSA). Information is available at the following
http://support.microsoft.com/default.aspx
This e-mail address does not receive e-mail, but is used for newsgroup
postings only.
Post by Gordon Brown
I've run MBSA 2.1 on 5 servers. On all 5 it reports that KB951847 is
missing. From everything I have read, this update is only required if you
have .NET Framework 2.0 or later installed. 3 of the 5 servers do not have
this, they only have .NET Framework 1.1.
Why is MBSA telling me I need to install a huge update, when the
documentation on the update itself says I don't?????
Thanks
Justin Dixon
2009-04-07 19:17:02 UTC
Permalink
Raw Message
I have installed 951847 on a few machines and the MBSA Report still shows it
as a missing Service Pack. I re-ran the installer to make usre it was
installed and was asked to Repair or Remove the installation, so I chose
repair. Even after this, the MBSA report still shows this as a missing
service pack on these 10 machines.

Any ideas??
Post by Doug Neal [MSFT]
Gordon - I'm sorry this took so long, but we had to do some investigation
that resulted in uncovering an unexpected, but ultimately desirable,
behavior in MBSA.
It turns out that even though the recent "Net Framework 3.5 Service Pack 1
and .Net Framework 3.5 Family Update (KB951847)" update is applicable to
..Net 2.0, 3.0 and 3.5 as a recommended update, it is also an optional update
for users of .Net Framework 1.1. Usually, such an optional update would be
ignored by MBSA since we don't release optional items as security updates,
update rollups or service packs (the only classifications MBSA reports).
But in this one case, the .Net Framework 3.5 SP1 and Family pair of updates
are classified as a Service Pack.
This causes MBSA to report these updates due to the Service Pack
classification - which is why you are seeing this in your completed scan
reports.
As with any Service Pack or Update Rollup, this is scored as a yellow
(optional) update that's not required for security compliance as with
Security Updates.
I hope this helps explain the issue. And if you have further questions
about this update or anything more regarding MBSA, please feel free to send
them my way.
--
--
Doug Neal [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.
If newsgroup discussion with experts and MVPs is unable to solve a problem
to your satisfaction, feel free to contact PSS for support on the Microsoft
Baseline Security Analyzer (MBSA). Information is available at the following
http://support.microsoft.com/default.aspx
This e-mail address does not receive e-mail, but is used for newsgroup
postings only.
Post by Gordon Brown
I have checked all 5 servers. MBSA reports KB951847 is required on all of
them.
If I run the .NET Version detector from www.asoft.be it reports 3 of the
servers only have .NET 1.1.
If I use a browser and go to Microsoft Update on each of the 5 servers, only
2 of them show KB951847 as a high priority update; the other three (the .NET
1.1 ones) show it as an optional update.
I will e-mail you windowsupdate.log from one of the 1.1 servers.
Gordon
Post by Doug Neal [MSFT]
You may want to be 100% sure that only .Net 1.1 is installed on these
machines. Check Add/Remove Programs and be sure to click the option to view
updates. Many customers have found that they, indeed, have a component of
..Net Framework 2.0, 3.0 or 3.5 installed - which is the cause of the KB
951847 offering.
If you still believe the MBSA report to be in error, please send me a ZIPed
copy of your WindowsUpdate.LOG to the address below with the "online."
removed. I hope that helps...
--
--
Doug Neal [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.
If newsgroup discussion with experts and MVPs is unable to solve a problem
to your satisfaction, feel free to contact PSS for support on the Microsoft
Baseline Security Analyzer (MBSA). Information is available at the following
http://support.microsoft.com/default.aspx
This e-mail address does not receive e-mail, but is used for newsgroup
postings only.
Post by Gordon Brown
I've run MBSA 2.1 on 5 servers. On all 5 it reports that KB951847 is
missing. From everything I have read, this update is only required if you
have .NET Framework 2.0 or later installed. 3 of the 5 servers do not have
this, they only have .NET Framework 1.1.
Why is MBSA telling me I need to install a huge update, when the
documentation on the update itself says I don't?????
Thanks
Loading...