Update XML Core services ?

goodlad said:

I have Secunia installed on my system to notify me about softwares & their updates.

For the past 2 days, its alerting me Microsoft XML Core Services(MSXML) 4.x needs to be updated.

So, when I clicked on it it, I went to the following page:
Download Microsoft Core XML Services (MSXML) 6.0 from Official Microsoft Download Center

I installed the script few days back & it showed success but still I have this warning. When, I again opened to check in details, I noticed in the MS page that..

System Requirements

Supported Operating System
Windows 2000 Service Pack 4, Windows Server 2003, Windows Server 2003 Service Pack 1, Windows XP Service Pack 1, Windows XP Service Pack 2

There's no W7 in there, huh ?


Looking down further,

To install MSXML 6.0 you must have Microsoft Windows® Installer 3.1 (MSI 3.1) or higher on your computer. If you are running Microsoft Windows Server 2003 Service Pack 1 (SP1) you already have the correct version. For other operating systems you may need to upgrade. Please see the Windows Installer 3.1 knowledge base article for details.

How do I know I have Windows Installer in my system or not & it shows the same supported OS details with no mention of W7


I would appreciate some assistance on this regard, whether its a false alarm by my software or am I really missing something down here ?

That must be this one you're heading for...:
Download Security Update for Microsoft XML Core Services 4.0 Service Pack 3 for x64-based Systems (KB2721691) from Official Microsoft Download Center

install it and then manually run Windows Update if it does invite you to a newer version.

goodlad said:

Thanks Non for your assistance :)

But I have x32, will x64 pack work for x32 too ?

Oops...i'm so used to mine!

No...here the x32 link: Download Security Update for Microsoft XML Core Services 4.0 Service Pack 3 (KB2721691) from Official Microsoft Download Center

goodlad said:

thanks Non, appreciate your assistance.

I get an error when I try to run the application:

Error Opening the Installation Log File. Verify that the specified log file location exists and is writable

That's a common error...sorry i should have told you.

Read carefully this chapter Known issues with this security update here:
MS13-002: Description of the security update for XML Core Services 4.0: January 8, 2013

Then pick up the kb973685 here:
Download Update for Microsoft XML Core Services 4.0 Service Pack 3 (KB973685) from Official Microsoft Download Center

kb973685 have to be install first in certain circumstance.

There is much discussion on the Secunia forums. Bottom line is PSI is reporting the file as end of life because MS support just ended. HOWEVER, the suggested fix they link to is (MSXML) 6.0, and does not apply to Windows 7. Also, if you have MSXML 4 SP3, version 4.30.2117 then it is the latest version and is not insecure, just end of life according to Secunia:

Microsoft has announced that the widely used Microsoft XML Core Services (MSXML) 4.x has reached the end of its lifecycle. The announcement was made back in 2013 (Microsoft Support), stating that April 12th 2014 was the EOL date. This is further supported by the official Microsoft Lifecycle Policy found here: Microsoft Product Lifecycle Search

As a result, all versions of Microsoft XML Core Services (MSXML) 4.x will correctly be flagged as EOL by the Secunia products, recommending an upgrade to Microsoft XML Core Services (MSXML) 6.x, as stated in the Microsoft announcement.

--
Kind regards,

Jais Vemmer
xSI Signatures Specialist

So, it is not insecure, but rather EOL. They (Secunia) will not fix this, as in their eyes it isn't broken, It is indeed end of life. However, the 'fix" they link to is not correct, and does not apply. If the less then 100% score bothers you, do as I did, and mark that listing as Ignore. If there is an updated file, you will receive it via Windows Update. But don't expect one as MS are the ones marking it EOL.

A Guy

No worries, while we will never know if we could do without it, it is likely to never be a security problem. A Guy