visual - security update for microsoft asp.net mvc 4.0(kb2993928)




Windows update caused MVC3 and MVC4 stop working (6)

am i the only one who installed a Windows Update (8.1) on october 15, and suddenly MVC stop working because of this warning?

Warning 1 Could not resolve this reference. Could not locate the assembly "System.Web.Mvc, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL". Check to make sure the assembly exists on disk. If this reference is required by your code, you may get compilation errors.

It seems that this windows update installs a newer version of MVC with version number 4.0.0.1, and removes old version from program files folder.

Someone know how to fix this without crawling for each project?


For web project, you may have to update the configuration in the web.config as well:

  <dependentAssembly>
    <assemblyIdentity name="System.Web.Mvc" publicKeyToken="31bf3856ad364e35"/>
    <bindingRedirect oldVersion="1.0.0.0-4.0.0.0" newVersion="4.0.0.1"/>
  </dependentAssembly>

Had the same issue after update:

Security Update for Microsoft ASP.NET MVC 4.0 (KB2993928)
http://support.microsoft.com/kb/2993928

But only for project with a reference to the System.Web.Mvc, not installed by package.

My colleague, who hadn't installed Microsoft ASP.NET MVC 4.0 Runtime and didn't received the update, had no trouble and had still the reference to 4.0.0.0, not to 4.0.0.1

I manually changed the reference to 4.0.0. 1 , after check-in, my colleague could still build with a reference to 4.0.0. 0 .
(Working both on Win7 Pro SP1, VS2013 Pro Update 3)


Okay,

For me it was two simple steps:

First I changed all references to System.Web.Mvc from 4.0.0.0 to 4.0.0.1,

Then I had to go to the properties of System.Web.Mvc (possibly because I had removed and re-added it) and change copy local to true.

Hope this is helpful for somebody.


Please see this blog, the recommended way is to update corresponding NuGet package:

http://blogs.msdn.com/b/webdev/archive/2014/10/16/microsoft-asp-net-mvc-security-update-broke-my-build.aspx

To quote:

The problem can be resolved by implemented one of the following solutions:

  1. (Preferred) Install Microsoft.AspNet.Mvc from the NuGet gallery (this will install a binding redirect in your web.config). You can do this from the NuGet package manager or the NuGet console inside Visual Studio:

    Install-Package Microsoft.AspNet.Mvc -Version -Project PROJECTNAME

    MVC 4 version: 4.0.40804.0

    MVC 3 version: 3.0.50813.1

  2. Manually update the reference to System.Web.MVC.dll (don’t use the one in the GAC).

    Try the Add Reference -> Assemblies -> Extensions dialog box.


The best solution is update DLL to version 4.0.0.1. Try use nuget:

Install-Package Microsoft.AspNet.Mvc -Version 4.0.40804 -Project <your project name>

This will automatically update

  <dependentAssembly>
    <assemblyIdentity name="System.Web.Mvc" publicKeyToken="31bf3856ad364e35" />
    <bindingRedirect oldVersion="0.0.0.0-4.0.0.1" newVersion="4.0.0.1" />
  </dependentAssembly>

You just have to edit version System.Web.Mvc manually in:

<compilation debug="true" targetFramework="4.0">
  <assemblies>
    <add assembly="System.Web.Mvc, Version=4.0.0.1, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />


We had to manually touch each .csproj to update the version from 4.0.0.0 to 4.0.0.1 to get our builds going. Quite a pain.

New references should look like:

<Reference Include="System.Web.Mvc, Version=4.0.0.1, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL" />




windows-update