Update XML Core services ?

[goodlad]

I have Secunia installed on my system to notify me about softwares & their updates.

For the past 2 days, its alerting me Microsoft XML Core Services(MSXML) 4.x needs to be updated.

So, when I clicked on it it, I went to the following page:
Download Microsoft Core XML Services (MSXML) 6.0 from Official Microsoft Download Center

I installed the script few days back & it showed success but still I have this warning. When, I again opened to check in details, I noticed in the MS page that..

System Requirements

Supported Operating System
Windows 2000 Service Pack 4, Windows Server 2003, Windows Server 2003 Service Pack 1, Windows XP Service Pack 1, Windows XP Service Pack 2

There's no W7 in there, huh ?


Looking down further,

To install MSXML 6.0 you must have Microsoft Windows® Installer 3.1 (MSI 3.1) or higher on your computer. If you are running Microsoft Windows Server 2003 Service Pack 1 (SP1) you already have the correct version. For other operating systems you may need to upgrade. Please see the Windows Installer 3.1 knowledge base article for details.

How do I know I have Windows Installer in my system or not & it shows the same supported OS details with no mention of W7 :huh:


I would appreciate some assistance on this regard, whether its a false alarm by my software or am I really missing something down here ?

 

[NoN]

I have Secunia installed on my system to notify me about softwares & their updates.

For the past 2 days, its alerting me Microsoft XML Core Services(MSXML) 4.x needs to be updated.

So, when I clicked on it it, I went to the following page:
Download Microsoft Core XML Services (MSXML) 6.0 from Official Microsoft Download Center

I installed the script few days back & it showed success but still I have this warning. When, I again opened to check in details, I noticed in the MS page that..

System Requirements

Supported Operating System
Windows 2000 Service Pack 4, Windows Server 2003, Windows Server 2003 Service Pack 1, Windows XP Service Pack 1, Windows XP Service Pack 2

There's no W7 in there, huh ?


Looking down further,

To install MSXML 6.0 you must have Microsoft Windows® Installer 3.1 (MSI 3.1) or higher on your computer. If you are running Microsoft Windows Server 2003 Service Pack 1 (SP1) you already have the correct version. For other operating systems you may need to upgrade. Please see the Windows Installer 3.1 knowledge base article for details.

How do I know I have Windows Installer in my system or not & it shows the same supported OS details with no mention of W7 :huh:


I would appreciate some assistance on this regard, whether its a false alarm by my software or am I really missing something down here ?

That must be this one you're heading for...:
Download Security Update for Microsoft XML Core Services 4.0 Service Pack 3 for x64-based Systems (KB2721691) from Official Microsoft Download Center

install it and then manually run Windows Update if it does invite you to a newer version.

 

[goodlad]

Thanks Non for your assistance

But I have x32, will x64 pack work for x32 too ?

 

[NoN]

Thanks Non for your assistance

But I have x32, will x64 pack work for x32 too ?

Oops...i'm so used to mine!

No...here the x32 link: Download Security Update for Microsoft XML Core Services 4.0 Service Pack 3 (KB2721691) from Official Microsoft Download Center

 

[goodlad]

thanks Non, appreciate your assistance.

I get an error when I try to run the application:

Error Opening the Installation Log File. Verify that the specified log file location exists and is writable

 

[NoN]

thanks Non, appreciate your assistance.

I get an error when I try to run the application:

Error Opening the Installation Log File. Verify that the specified log file location exists and is writable

That's a common error...sorry i should have told you.

Read carefully this chapter Known issues with this security update here:
MS13-002: Description of the security update for XML Core Services 4.0: January 8, 2013

Then pick up the kb973685 here:
Download Update for Microsoft XML Core Services 4.0 Service Pack 3 (KB973685) from Official Microsoft Download Center

kb973685 have to be install first in certain circumstance.

 

[A Guy]

There is much discussion on the Secunia forums. Bottom line is PSI is reporting the file as end of life because MS support just ended. HOWEVER, the suggested fix they link to is (MSXML) 6.0, and does not apply to Windows 7. Also, if you have MSXML 4 SP3, version 4.30.2117 then it is the latest version and is not insecure, just end of life according to Secunia:

Microsoft has announced that the widely used Microsoft XML Core Services (MSXML) 4.x has reached the end of its lifecycle. The announcement was made back in 2013 (Microsoft Support), stating that April 12th 2014 was the EOL date. This is further supported by the official Microsoft Lifecycle Policy found here: Microsoft Product Lifecycle Search

As a result, all versions of Microsoft XML Core Services (MSXML) 4.x will correctly be flagged as EOL by the Secunia products, recommending an upgrade to Microsoft XML Core Services (MSXML) 6.x, as stated in the Microsoft announcement.

--
Kind regards,

Jais Vemmer
xSI Signatures Specialist

So, it is not insecure, but rather EOL. They (Secunia) will not fix this, as in their eyes it isn't broken, It is indeed end of life. However, the 'fix" they link to is not correct, and does not apply. If the less then 100% score bothers you, do as I did, and mark that listing as Ignore. If there is an updated file, you will receive it via Windows Update. But don't expect one as MS are the ones marking it EOL.

A Guy

 

[goodlad]

thanks friends for the assistance

There is much discussion on the Secunia forums. Bottom line is PSI is reporting the file as end of life because MS support just ended. HOWEVER, the suggested fix they link to is (MSXML) 6.0, and does not apply to Windows 7. Also, if you have MSXML 4 SP3, version 4.30.2117 then it is the latest version and is not insecure, just end of life according to Secunia:

Microsoft has announced that the widely used Microsoft XML Core Services (MSXML) 4.x has reached the end of its lifecycle. The announcement was made back in 2013 (Microsoft Support), stating that April 12th 2014 was the EOL date. This is further supported by the official Microsoft Lifecycle Policy found here: Microsoft Product Lifecycle Search

As a result, all versions of Microsoft XML Core Services (MSXML) 4.x will correctly be flagged as EOL by the Secunia products, recommending an upgrade to Microsoft XML Core Services (MSXML) 6.x, as stated in the Microsoft announcement.

--
Kind regards,

Jais Vemmer
xSI Signatures Specialist

So, it is not insecure, but rather EOL. They (Secunia) will not fix this, as in their eyes it isn't broken, It is indeed end of life. However, the 'fix" they link to is not correct, and does not apply. If the less then 100% score bothers you, do as I did, and mark that listing as Ignore. If there is an updated file, you will receive it via Windows Update. But don't expect one as MS are the ones marking it EOL.

A Guy

ah I didn't know about this EOL & I had set the list to ignore to avoid the constant nuisance of secunia popping up every now & then.

Really appreciate it

 

[A Guy]

No worries, while we will never know if we could do without it, it is likely to never be a security problem. A Guy

 

[chigwells]

Hi All,
I would like to add that I had the exact same issue. Installed Secunia on a freshly rebuilt system.
I've downloaded the x64 SP3 update, and will now tell Secunia to ignore it.
It installed without the hiccups goodlad had.
Many thanks

 

[Callender]

Microsoft XML Core Services 6.0

Microsoft XML Core Services 4.x has been superceded by Microsoft XML Core Services 6.x

Re Secunia: Can't comment on the download link they offer. All I can say is that Microsoft XML Core Services 6 is installed and working on my 64 bit Windows 7 machine. I've left Microsoft XML Core Services 4.x installed but if anyone wants me to remove it for test purposes I'm willing to try.

See security bulletin here:

https://technet.microsoft.com/en-us/library/security/ms12-043.aspx

 

[jhbroady]

May I safely uninstall MSXML 4.x?

As with everyone else, Secunia PSI flags MSXML 4.x as EOL.

I updated to MSXML6.x, may I now safely uninstall MSXML 4.x?

Running Windows 7.

 

[Callender]

If flagged it up for me too. See earlier post. I have actually removed it with no issues. End of life just means that it will not get any more patches or security updates. Here's what I have currently:

​

I'd say install MSXML 6 and remove MSXML 4. You can always reinstall MSXML 4 if you experience any issues with any program that installed MSXML 6.