Forum Thread: No updates available.

You are currently viewing a forum thread in the Secunia Community Forum. Please note that opinions expressed here are not of Secunia but solely reflect those of the user who wrote it.

This thread was submitted in the following forum:
Programs

Relating to this vendor:
Microsoft
And, this specific program:
Microsoft XML Core Services (MSXML) 6.x

This thread has been marked as locked.
straddarts No updates available.
Member 26th Nov, 2008 02:07
Ranking: 0
Posts: 1
User Since: 26th Nov, 2008
System Score: N/A
Location: N/A
Sirs:

I have tried repeatedly to update the Microsoft XML Core Services (MSXML) 6.x. The website says there is no update for this file.

TLis01 RE: No updates available.
Member 26th Nov, 2008 09:52
Score: 0
Posts: 5
User Since: 26th Nov 2008
System Score: N/A
Location: N/A
Sometimes it is a particular software having the msxml6.dll library insecure in its folder. PSI detects such a library as insecure even though the library version in Windows folder is secure enough ... I am not sure, though, if you can just replace the library or even delete the library from the reported folder, relying on Windows to find the library in Windows folder
Was this reply relevant?
+0
-0
webweweave RE: No updates available.
Member 26th Nov, 2008 19:02
Score: 0
Posts: 2
User Since: 20th Nov 2008
System Score: N/A
Location: N/A
I also received a warning from PSI that my XML software is insecure and recommending MSXML 6.0 be downloaded from microsoft. But I've checked this out and Microsoft does not indicate that MSXML 6.0 system requirements include VISTA. To the contrary (or at least given the usual obfuscatory information so typical of Microsoft information), it MIGHT be the case that XML 6.0 is for non-Vista versions of Windows, including several server versions and XP -- but again, NOT Vista.

Could anyone else confirm this?

Steve (webweweave)
Was this reply relevant?
+0
-0
antipodes RE: No updates available.
Member 26th Nov, 2008 22:22
Score: 0
Posts: 29
User Since: 22nd Oct 2008
System Score: N/A
Location: AU
Windows automatic updates installed msmxl 4 service pack 2(KB954430) but I also have msxml 6 installed in the windows system32 folder however when I try to download the update manually I receive advice that the download does not apply to my system. I was advised by Mr Jeppson to run the scan again but the result was the same.

I am a computer illiterate but from what I have been able to glean from the microsoft bulletins msmxl 6 is not all that relevant if you have another msxl version installed (see MS08-069)

--
antipodes
Was this reply relevant?
+0
-0
TLis01 RE: No updates available.
Member 26th Nov, 2008 22:22
Score: 0
Posts: 5
User Since: 26th Nov 2008
System Score: N/A
Location: N/A
Last edited on 26th Nov, 2008 22:25
> it MIGHT be the case that XML 6.0 is for non-Vista versions of Windows, including several server versions and XP -- but again, NOT Vista.

> Could anyone else confirm this?

Not necessarily. I would rather think that Windows Update sees the latest DLL in Windows system folder, so it does not report it as a candidate for an update. Unfortunately, various applications can have their own copies of this library in their own folders, as by default the application searches its own folder first when looking for a given DLL. Windows Update, of course, does not care about these redundant copies of the DLL. In fact, the application's installer could see, if the library is available in Windows folder and then not install its own copy, but many installers don't do this ...
Was this reply relevant?
+0
-0
BigDave_39 RE: No updates available.
Member 26th Nov, 2008 22:31
Score: 0
Posts: 177
User Since: 26th Nov 2008
System Score: N/A
Location: Washington, DC, US
on 26th Nov, 2008 22:22, TLis01 wrote:
Not necessarily. I would rather think that Windows Update sees the latest DLL in Windows system folder, so it does not report it as a candidate for an update. Unfortunately, various applications can have their own copies of this library in their own folders, as by default the application searches its own folder first when looking for a given DLL. Windows Update, of course, does not care about these redundant copies of the DLL. In fact, the application's installer could see, if the library is available in Windows folder and then not install its own copy, but many installers don't do this ...


Agreed, the best way to troubleshoot this issue is to know the path of where the PSI discovered this DLL file. Can you get that for us?

--
Big Dave
Was this reply relevant?
+0
-0
TLis01 RE: No updates available.
Member 26th Nov, 2008 22:46
Score: 0
Posts: 5
User Since: 26th Nov 2008
System Score: N/A
Location: N/A
on 26th Nov, 2008 22:31, BigDave_39 wrote:
Agreed, the best way to troubleshoot this issue is to know the path of where the PSI discovered this DLL file. Can you get that for us?

In my case, this library was found in the installation folder of PerfectDisk 2008 by Raxco, and in the windows\system32 folder, but not in the current Windows installation, but on the Dell recovery partition (I should probably hide it from the current OS!).

As you can see, these locations were not within the current Windows installation, but elsewhere ...
Was this reply relevant?
+0
-0
antipodes RE: No updates available.
Member 26th Nov, 2008 23:37
Score: 0
Posts: 29
User Since: 22nd Oct 2008
System Score: N/A
Location: AU
further to my previous reply I have spoken with a microsoft technician
who advised that this security alert in my case can be ignored and that msxml6 was used to manage internet explorer and did not require updating.His words were "trust Windows automatic updates"

Hope this helps

--
antipodes
Was this reply relevant?
+0
-0
TLis01 RE: No updates available.
Member 27th Nov, 2008 08:55
Score: 0
Posts: 5
User Since: 26th Nov 2008
System Score: N/A
Location: N/A
Last edited on 27th Nov, 2008 09:18
on 26th Nov, 2008 23:37, antipodes wrote:
further to my previous reply I have spoken with a microsoft technician
who advised that this security alert in my case can be ignored and that msxml6 was used to manage internet explorer and did not require updating.His words were "trust Windows automatic updates"

Hope this helps

I would not rather trust such statements from any vendor's representative, not only Microsoft's :-)

But to be honest, in my case it turned out to be true too, as Raxco responded that the occurence of an insecure version of this library was stored on my disk as a result of running a web-downloaded executable, which first unzipped ALL installation files to disk. This library would be used only if PerfectDisk would have to cooperate with Microsoft Exchange. As I don't have it installed, it is just an inactive file and can be safely deleted. Any future update should bring the latest version of this library.

What isn't true is the Microsoft technician's statement that "Windows automatic updates" will take care of such outdated library in a third-party application's installation. It is the application's vendor responsibility ...

I have got a worse case. My Dell notebook is equipped with Media Direct installation, which uses an insecure version of PowerPoint 2003 Viewer. It is detected as insecure, but on my system this application is not installed separately, but as a part of Media Direct. Therefore, when I try to update it using a downloaded update file from Microsoft, it says, that nothing has been found to update. Of course, as I have the entire Microsoft Office 2007 installed on my system, which is up-to-date. Unfortunately, by default the .ppt files are linked to this PowerPoint 2003 Viewer instead of the 2007 version. I had to change this assignment ... How difficult it is to get rid of the entire MediaDirect feature, you can read some stories on the web ... ;-)
Was this reply relevant?
+0
-0
txwizard RE: No updates available.
Member 2nd Dec, 2008 05:56
Score: 0
Posts: 2
User Since: 2nd Dec 2008
System Score: N/A
Location: N/A
From time to time, Microsoft publishes security bulletins that cover components that may be installed by other applications, such as, for example, Paint Shop Pro, Corel Draw, WinZip, or even some of their own products, such as Microsoft Visual Studio 6.

When they do so, the security bulletin warns that there may be copies of the relevant file(s) installed on your system that are not covered by the Microsoft updates. The bulletins always recommend that you contact your vendor for an update.

For instance, I was recently notified of such an update for my licensed copy of WinZip, which contained an insecure version of GDI+, which Microsoft had patched a few months earlier. After reviewing further information on the WinZip Web site, I determined that the simplest thing for me to do was delete the affected file, even though my installation would never have actually used it.

I arrived at this thread because a copy of MSXML Core Services was installed into my copy of Visual Studio 6, which is end of life. After comparing the version information on that copy, which is part of a directory that is used to construct new Visual Basic 6 applications, with the production copy installed in my Windows directory, I decided that I could safely copy the newer DLL from my Windows directory.
Was this reply relevant?
+0
-0
TLis01 RE: No updates available.
Member 2nd Dec, 2008 09:05
Score: 0
Posts: 5
User Since: 26th Nov 2008
System Score: N/A
Location: N/A
True, sometimes this is present in Microsoft's bulletins, but not everyone gets them, right? Moreover, when the vendor does not publish a patch, replacing a file with a newer version should be always done with caution, as the backwards compatibility cannot be always guaranteed. Be sure to keep a copy of the original DLL in a safe place until you test the vulnerable application on some less important data ...
Was this reply relevant?
+0
-0
dlsm5c RE: No updates available.
Member 3rd Dec, 2008 00:33
Score: 0
Posts: 1
User Since: 2nd Dec 2008
System Score: N/A
Location: N/A
Last edited on 3rd Dec, 2008 00:40
Ok guys and girls I not that computer literate to begin with. PSI is saqying that my MSXML 6.x version 6.10.1129.0 is insure also and I found the same as above on the thread. I don't know where to look for these things. Also I too have PowerPoint viewer 2003 which PSI says that its insecure which I did a update download and rescan and PSI still says it is insecure. Plus I had two things from Adobe. I recently updated from Adobe 8 to Adobe 9. When 9 was installed I guess AdobeAir 1.x version 1.0.8.4990 came with it. Anyway PSI said both were insecure. So I did a update on the AdobeAir first. When it was done the Adobe 9 went off thew PSI insecure list but the AdobeAir still showed insecure. Yes I typed that right. I updated the AdobeAir first and the Adobe 9 went off the list of insecure. So I updated the AdobeAir two more times and it still shows insecure. No I don't know where to look for what path. Pertaining to Windows updates: I've had this computer for almost two yrs. Windows Vista the auto update was on and doing updates the only thing that I did download from the net, everything was fine until about two months ago when I did a Windows update everything went south. My graphics card, resolution on the screen, among other things quit working right. I called a tech not from windows but from where I got the computer, Circuit city, He told how to find the restore points and to go back to the date before all the trouble. Well the only updates that was on the list was the one the one when everything messed up. He then told me I would have to Restore which I don't want to do unless I HAVE TO. He also told me that he has his auto update turned off. But I thought that would'nt be a good idea. But happening lead to PSI, Driver Detective, and RegCure, Hopeing that I could fix rather restore. If anybody has any suggestions on how to cure, find, fix, repair, or even restore I would greatly appreciate it. Thank you
Was this reply relevant?
+0
-0
andyrich RE: No updates available.
Member 7th Dec, 2008 21:28
Score: 0
Posts: 1
User Since: 7th Dec 2008
System Score: N/A
Location: N/A
i think the only way around this is to reinstall windows again
as there are no updates for this problem and watch what we download
Was this reply relevant?
+0
-0
Patrick.B RE: No updates available.
Member 8th Dec, 2008 03:58
Score: 0
Posts: 12
User Since: 8th Dec 2008
System Score: N/A
Location: N/A
This appears to be a false positive by PSI for MSXML6.dll on Vista computers. I can find no update to my MSXML6.dll v6.20.1099.0 by searching for [msxml] in Microsoft Downloads. I tried a couple and was told they did not apply to my system. Others are for Windows XP, not Vista.

Of course, Vista Windows Update finds no update.

The path is the only one that it should be:
"[Drive letter]:\WINDOWS\system32"

Other than this unacknowledged issue, I have found PSI to be great and have recommended it to several friends.

Patrick B.
Was this reply relevant?
+0
-0
DonChamp RE: No updates available.
Member 8th Dec, 2008 18:22
Score: 0
Posts: 2
User Since: 31st Mar 2008
System Score: N/A
Location: N/A
I have no complicating factors as other outdated programs and am using WinXP with all updates. I get the same hassle in all areas on MSXML6. I was not even able to delete it from the noted folder!
There must be some circular argument here. MS offers no upgrade or update, as noted by others.
In my Add/Remove Programs in Control Panel MSXML is not even listed as something to take out. Further, there are two MSXML dll files for version 8!
This is really confusing.
Regards
Don Champ
Was this reply relevant?
+0
-0
turbobent RE: No updates available.
Member 8th Dec, 2008 19:04
Score: 0
Posts: 10
User Since: 7th Dec 2008
System Score: N/A
Location: N/A
Last edited on 8th Dec, 2008 22:10
I have had the same message.
But as you write : no updates.
The strange thing is that Secunia " claims " the path
to be d:\windows\system32\msxml6.dll, !!!!!! but that is wrong.
the path is c:\windows\system32\msxml6.dll
So Secunia are reading my pc in a wrong way
Was this reply relevant?
+0
-0
Hendrik91 RE: No updates available.
Member 9th Dec, 2008 01:43
Score: 0
Posts: 16
User Since: 25th Sep 2008
System Score: N/A
Location: DE
Sometimes the file can also be on a CD/DVD, for example a installation CD for a program which uses that files. If that is true, PSI detects the program on the CD/DVD/USB-Device or whatever and, if it is not the latest version, shows it as insecure. Simpliy add it to the exceptions then.
Was this reply relevant?
+0
-0
oly2c RE: No updates available.
Member 11th Dec, 2008 14:44
Score: 0
Posts: 6
User Since: 26th Nov 2008
System Score: N/A
Location: N/A
Secunia detects an unpatched version of msxml6.dll in my Recovery partition. The main OS is up to date.
Is there any security risk from an as yet unused partition or should I set Secunia to ignore this program. If I do that will it ignore the correct version in Vista when checking future updates? It is an integral part of Vista so presumably Windows Updates will take care of future patches. Only version 4 shows in Control Panel and Belarc.
Was this reply relevant?
+0
-0
Patrick.B RE: No updates available.
Member 13th Dec, 2008 19:27
Score: 0
Posts: 12
User Since: 8th Dec 2008
System Score: N/A
Location: N/A
@oly2c

>> Secunia detects an unpatched version of msxml6.dll in my Recovery partition. The main OS is up to date. Is there any security risk from an as yet unused partition or should I set Secunia to ignore this program.

Ignore it. It is benign as long as you do not perform a recovery operation that would bring the old version back to be used again.

>> If I do that will it ignore the correct version in Vista when checking future updates?

No. The current version in Vista will still be checked. PSI only ignore the specific location that you choose to ignore.

-- Patrick B.
Was this reply relevant?
+0
-0
oly2c RE: No updates available.
Member 13th Dec, 2008 21:30
Score: 0
Posts: 6
User Since: 26th Nov 2008
System Score: N/A
Location: N/A
Thanks Patrick. Better safe than sorry.
Was this reply relevant?
+0
-0
thesun RE: No updates available.
Member 14th Dec, 2008 04:38
Score: 0
Posts: 2
User Since: 9th Dec 2008
System Score: N/A
Location: N/A
i think this problem is only with vista and secunia does not differnciate between xp and vista yet for system components. my vista came with the laptop and i dont think the xml thing is in vista at all
Was this reply relevant?
+0
-0
oly2c RE: No updates available.
Member 14th Dec, 2008 13:17
Score: 0
Posts: 6
User Since: 26th Nov 2008
System Score: N/A
Location: N/A
on 14th Dec, 2008 04:38, thesun wrote:
i think this problem is only with vista and secunia does not differnciate between xp and vista yet for system components. my vista came with the laptop and i dont think the xml thing is in vista at all


I understand that MSXML6 is included in Vista by default.
Have a look in windows/system32.
Was this reply relevant?
+0
-0
kd4pdy RE: No updates available.
Member 16th Dec, 2008 09:49
Score: 0
Posts: 1
User Since: 11th Jan 2008
System Score: N/A
Location: Somewhere just East of the middle of nowhere, US
Last edited on 19th Dec, 2008 04:55
on 26th Nov, 2008 22:46, TLis01 wrote:
In my case, this library was found in the installation folder of PerfectDisk 2008 by Raxco, and in the windows\system32 folder, but not in the current Windows installation, but on the Dell recovery partition (I should probably hide it from the current OS!).

As you can see, these locations were not within the current Windows installation, but elsewhere ...


I to had a 100% score before installing PerfectDisk 2008. I got two hits on the last scan. One is the x86 install and the other is the x64 install.

File locations returned from Secunia PSI:

c:\Program Files\Raxco\PerfectDisk2008Install\x86\program files\Raxco\PerfectDisk2008\msxml6.dll

c:\Program Files\Raxco\PerfectDisk2008Install\x64\Program Files 64\Raxco\PerfectDisk2008\msxml6.dll

I deleted the C:\Program Files\Raxco\PerfectDisk2008Install folder, did another scan and got another 100% secure score. After program is installed PerfectDisk still runs with out this folder

Jim


--
- - -
"No trees were killed in the sending of this message.
However, a large number of electrons were terribly inconvenienced".
Was this reply relevant?
+0
-0
Cocio21 RE: No updates available.
Member 26th Dec, 2008 17:09
Score: 0
Posts: 1
User Since: 26th Dec 2008
System Score: N/A
Location: N/A
Last edited on 26th Dec, 2008 17:39
Was this reply relevant?
+0
-0
irvinf RE: No updates available.
Member 28th Dec, 2008 15:41
Score: 0
Posts: 1
User Since: 18th Jan 2008
System Score: N/A
Location: US
Raxco suggests deleting ProgramFile\Raxco\PerfectDisk2008Install folder.
A newer version of MSXML will be used when updating.
Was this reply relevant?
+0
-0
chaser66 RE: No updates available.
Member 5th Jan, 2009 08:46
Score: 0
Posts: 2
User Since: 28th Jun 2008
System Score: N/A
Location: N/A
on 26th Nov, 2008 02:07, straddarts wrote:
Sirs:

I have tried repeatedly to update the Microsoft XML Core Services (MSXML) 6.x. The website says there is no update for this file.

Was this reply relevant?
+0
-0
regquinton RE: No updates available.
Member 5th Jan, 2009 20:45
Score: 0
Posts: 1
User Since: 5th Aug 2008
System Score: N/A
Location: N/A
On my Dell laptop there's a D: recovery partition and that's what Secunia PSI is griping about.

D:\Windows\System32\msxml6.dll

My C: partition is fine and up to date. I've added an ignore rule for this one, I'd advise the same for others who are getting similar gripes on partions other similar partitions.
Was this reply relevant?
+0
-0
actcons RE: No updates available.
Member 25th Jan, 2009 15:39
Score: 0
Posts: 1
User Since: 6th Nov 2008
System Score: N/A
Location: N/A
I am having the same problem...Originally I had a problem with Java......the moment I updated it Secunia tells me I have 8 programs insecure.............several of the MS including IE (only used for MS downloads) and I use automatic updates. Checking with MS downloads I am fully up to date...............is this a secunia fault?
Was this reply relevant?
+0
-0
puget1 RE: No updates available.
Member 1st Mar, 2009 16:44
Score:
Posts: 612
User Since: 21st Dec 2007
System Score: N/A
Location: US
Last edited on 26th Aug, 2009 17:39


--
Windows 10 64bit

There is No magic bullet in computing; only work a rounds.
















Was this reply relevant?
+0
-0
Stolberg RE: No updates available.
Member 26th Aug, 2009 02:23
Score: 0
Posts: 2
User Since: 27th Jul 2009
System Score: N/A
Location: N/A
on 26th Nov, 2008 02:07, straddarts wrote:
Sirs:

I have tried repeatedly to update the Microsoft XML Core Services (MSXML) 6.x. The website says there is no update for this file.

Was this reply relevant?
+0
-0
Stolberg RE: No updates available.
Member 26th Aug, 2009 02:23
Score: 0
Posts: 2
User Since: 27th Jul 2009
System Score: N/A
Location: N/A
on 26th Nov, 2008 02:07, straddarts wrote:
Sirs:

I have tried repeatedly to update the Microsoft XML Core Services (MSXML) 6.x. The website says there is no update for this file.

Was this reply relevant?
+0
-0
Slamgeden RE: No updates available.
Member 26th Aug, 2009 09:22
Score: 0
Posts: 181
User Since: 17th Jul 2009
System Score: N/A
Location: N/A
Always reboot. Windows can apply the updates pr. auto, then not really install them before the next reboot. This is likely the problem.

--
Assorted Fnords.
Was this reply relevant?
+0
-0

This thread has been marked as locked.