Forum Thread: microsoft core xml services (msxml) 4.x Update

You are currently viewing a forum thread in the Secunia Community Forum. Please note that opinions expressed here are not of Secunia but solely reflect those of the user who wrote it.

This thread was submitted in the following forum:
Programs

Relating to this vendor:
Microsoft
And, this specific program:
Microsoft XML Core Services (MSXML) 4.x

This thread has been marked as locked.
ediebluestar microsoft core xml services (msxml) 4.x Update
Member 29th Jul, 2014 20:08
Ranking: 0
Posts: 5
User Since: 15th Sep, 2010
System Score: N/A
Location: US
I have had this message for weeks on my Secunia PSI report. The message is I have a program that requires a manual update, but after I follow the instructions, the message still returns. I am wondering do I need this update - what is it - and can I ignore it. Thanks for whatever advice anyone might have.

Maurice Joyce RE: microsoft core xml services (msxml) 4.x Update
Handling Contributor 29th Jul, 2014 21:32
Score: 12325
Posts: 9,575
User Since: 4th Jan 2009
System Score: N/A
Location: UK
I would take a look at this thread:

https://secunia.com/community/forum/thread/show/15...

Scroll down & you will see a large post created by me. You might find the post useful.

--
Maurice

Microsoft Surface 4 Intel i7 64Bit
Windows 10 Pro version 1809 Build 17763.404
16 GB RAM
IE & Edge Only
Was this reply relevant?
+2
-0
ediebluestar RE: microsoft core xml services (msxml) 4.x Update
Member 29th Jul, 2014 22:43
Score: 0
Posts: 5
User Since: 15th Sep 2010
System Score: N/A
Location: US
Thank you so much for your kind reply. I have to admit this is all over my head, but from what I can gather, I have MSXML 4.0 SP3 Parser listed in my Programs (using WIndows 8.1). The Secunia PSI (3.0.09016) says I have the installed version 4.30.2100.0. I have only had this computer a little over a month. You said in one of your posts: "Secunia have muddied the waters - it is vital that those using MSXML 4 update to version 4.30.2117.0 ASAP. Once that is achieved by all then further investigation will be required on the true status of MSXML4." I am not sure how I would do that - can I just uninstall MSXML 4.0 SP3 and move on? I apologize for being so clueless here, but any advice is very much appreciated.
Was this reply relevant?
+0
-0
Maurice Joyce RE: microsoft core xml services (msxml) 4.x Update
Handling Contributor 29th Jul, 2014 23:58
Score: 12325
Posts: 9,575
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Please do not worry about being clueless - understanding how MSXML 4 was updated/used is not easy.

It looks like you have installed a very old programme that uses vulnerable version of MSXML4.

I would advise that we rename the file that PSI is showing as vulnerable/EOL. That will negate any vulnerability & also give you a chance to find out which programme is using MSXML4 because it will almost certainly fail when you try to use it.

If you are not sure how to rename can you please supply this info & I will give you an easy to use script.

Open PSI>once open select Show Programs.
You will now see a page full of programme icons or a list.
Right click on the programme in error>select Show Details - that will open a box showing the path & version number of the offending file.
Write down the exact file path & install version - return to the Forum & type that information.

It will look something like this & gives the detail I require.

https://1ncuig.bn1.livefilestore.com/y2pdpZyETXNZa...





--
Maurice

Microsoft Surface 4 Intel i7 64Bit
Windows 10 Pro version 1809 Build 17763.404
16 GB RAM
IE & Edge Only
Was this reply relevant?
+2
-0
ediebluestar RE: microsoft core xml services (msxml) 4.x Update
Member 30th Jul, 2014 00:41
Score: 0
Posts: 5
User Since: 15th Sep 2010
System Score: N/A
Location: US
Thanks again. I am not sure how to rename this file. Secunia PSI just says it needs to be updated - there is no mention of end of life, that I can tell. When I right click, the details are just as in your example: File Location: C:\Windows\SysWOW64\msxm.4dll - Installed Version: 4.30.2100.
Was this reply relevant?
+0
-0
Maurice Joyce RE: microsoft core xml services (msxml) 4.x Update
Handling Contributor 30th Jul, 2014 02:38
Score: 12325
Posts: 9,575
User Since: 4th Jan 2009
System Score: N/A
Location: UK
1. Open PSI>once open select Show Programs - You will now see a page full of programme icons or a list.

2. Right click on the programme in error>select Show Details - that will open a box showing the path & version number of C:\Windows\SysWOW64\msxm.4dll

3. Double left click on that file & it will open Windows (File) Explorer & you will be able to see the vulnerable file msxml.4dllin the right hand pane - you may need to scroll to find it.

4. Right click on it & select RENAME then rename the file by adding .OLD so it looks like this msxml.4dll.OLD
Once complete it should look like this:
https://1ncuig.bn1.livefilestore.com/y2pIzKLOjo2ak...

5. Exit Windows (File) Explorer by clicking on the red X (top right) & then carry out a full PSI scan.

6. All should now be in order.
a. That file should not be showing & you should get a 100% security score & green icon.

b. At some stage an old programme may well fail because that is the one dependant on MSXML 4. If you want it to work you need to reverse the procedure & remove the .OLD extension.

Hope this helps.

--
Maurice

Microsoft Surface 4 Intel i7 64Bit
Windows 10 Pro version 1809 Build 17763.404
16 GB RAM
IE & Edge Only
Was this reply relevant?
+6
-0
ediebluestar RE: microsoft core xml services (msxml) 4.x Update
Member 30th Jul, 2014 05:46
Score: 0
Posts: 5
User Since: 15th Sep 2010
System Score: N/A
Location: US
Wow, this worked great. I am not sure what it is all about, but once again, thank you so much!!
Was this reply relevant?
+0
-0
Maurice Joyce RE: microsoft core xml services (msxml) 4.x Update
Handling Contributor 30th Jul, 2014 08:37
Score: 12325
Posts: 9,575
User Since: 4th Jan 2009
System Score: N/A
Location: UK
To explain.

What we have done is to cripple MSXML 4 so that it cannot be used. On that basis it is no longer a security risk but remains available if at a later date you decide to use MSXML 4 again.

At some stage you may click on an old programme you have installed & it will not function correctly because it requires MSXML 4 You then have the option to uninstall that programme or you can reverse the MSXML procedure to allow it to work.

Eventually you may wish to uninstall MSXML 4 but at the moment it is harmless & gives you flexibility of action.

Does that information help?


--
Maurice

Microsoft Surface 4 Intel i7 64Bit
Windows 10 Pro version 1809 Build 17763.404
16 GB RAM
IE & Edge Only
Was this reply relevant?
+3
-0
ediebluestar RE: microsoft core xml services (msxml) 4.x Update
Member 30th Jul, 2014 17:36
Score: 0
Posts: 5
User Since: 15th Sep 2010
System Score: N/A
Location: US
Yes, you explain it very well - thanks again. I am not sure how I would exactly uninstall this program if I need to, but I will wait for another day for that - if needed! Thank you so much - it seems you are very helpful to a lot of people on this forum.
Was this reply relevant?
+0
-0

This thread has been marked as locked.