This has not yet been published by Microsoft. It will be published
within the next few weeks, mainly because I asked them to. I felt this
was information badly needed, and I think this is the best group to
share this information.
A co-worker and I were able to determine how to tell exactly what
version of .NET Framework is installed.
We had to do this because we had to manually deploy the MS05-004
Security Bulletin to thousands of machines, and had no concrete way of
determining what was installed and not installed.
The MS05-004 hotfix will patch any system with 1.0 SP2, 1.0 SP3, 1.1,
and 1.1 SP1.
You can use this information to do a batch file, script, C++ exe,
whatever. We put it into a script.
Note: The file versions are versions that do NOT have the MS05-004
ASP.NET vulnerability patch installed.
1.0 no SP:
Registry:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramewor k\policy\v1.0]
"3705"="3321-3705"
File:
(Windir)\Microsoft.NET\Framework\v1.0.3705\system. web.dll has a version
of 1.0.3705.0
1.0 SP1:
Registry:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramewor k\policy\v1.0]
"3705"="3321-3705"
File:
(Windir)\Microsoft.NET\Framework\v1.0.3705\system. web.dll has a version
of 1.0.3705.0
1.0 SP2:
Registry:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramewor k\policy\v1.0]
"3705"="3321-3705"
File:
(Windir)\Microsoft.NET\Framework\v1.0.3705\system. web.dll has a version
of 1.0.3705.288
1.0 SP3:
Registry:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramewor k\policy\v1.0]
"3705"="3321-3705"
File:
(Windir)\Microsoft.NET\Framework\v1.0.3705\system. web.dll has a version
of 1.0.3705.6018
1.1 no SP
Registry:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramewor k\policy\v1.1]
"4322"="3706-4322"
File:
(Windir)\Microsoft.NET\Framework\v1.1.4322\system. web.dll has a version
of 1.1.4322.573
1.1 SP1
Registry:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramewor k\policy\v1.1]
"4322"="3706-4322"
File:
(Windir)\Microsoft.NET\Framework\v1.1.4322\system. web.dll has a version
of 1.1.4322.2032
==
Now, here is the file information that shows that the items have been
patched. This info is available publicly from MS's website:
MS05-004 (887219)
ASP.NET Path Validation Vulnerability
http://www.microsoft.com/technet/sec.../MS05-004.mspx
To tell if patch installed:
- Search drive for the file 'System.web.dll'.
- Version and Date information below depend on what version and Service
Pack of .NET Framework is installed.
Microsoft .NET Framework version 1.0 Service Pack 3: Version
1.0.3705.6021, 1,200,128 bytes, Date 07-Oct-2004
Microsoft .NET Framework version 1.0 Service Pack 2: Version
1.0.3705.556, 1,200,128 bytes, Date 19-Nov-2004
Microsoft .NET Framework version 1.1 Service Pack 1 (2000 or XP):
Version 1.1.4322.2037, 1,257,472 bytes, Date 08-Oct-2004
Microsoft .NET Framework version 1.1 Service Pack 1 (Server 2003):
Version 1.1.4322.2037, 1,257,472 bytes, 19-Oct-2004
Microsoft .NET Framework version 1.1 (No SP)(2000 or XP): Version
1.1.4322.1085, 1,257,472 bytes, Date 26-Oct-2004
Microsoft .NET Framework version 1.1 (No SP)(Server 2003): Version
1.1.4322.1085, 1,257,472 bytes, Date 28-Oct-2004
Hope this helps. I can tell you that it sure helped me.
Jim
