Question: I have one server that requires a .NET3.5 patch KB951847 (per MBSA) but vulnerability scan does not report that patch as needed... the details:
Server W2003 has .NET4.0 installed but MBSA tells me that I need to install KB 951847 patch that installs .NET 3.5, why? I have ONLY installed .NET2 SP2 and .NET 4 , so .NET 4.0 shouldn't make .NET 3.5 Irrelevant?

-Server W2003 SP2 (x86)
-Nessus scan does not show any .NET vulnerabilities

please help me to solve this discrepancy, I am trying to avoid to install an unnecessary software (.NET 3.5).

Thank you :)

Answer: 
.NET 3.0/3.5/3.5 SP1 were DLL/feature additions/optimizations on top of .NET 2.0.

Internally, all of these versions of .NET use the same core CLR (Common Language Runtime) executable. So, just the presence of .NET 2.0 SP2 on your machine is enough to expose the vulnerability MBSA is flagging.

With .NET 4.0, Microsoft actually re-wrote the CLR, creating a new, separate executable. If you only had 4.0 on the machine, you probably wouldn't be getting flagged for this patch.

This TechNet article explains the relationship between .NET 2.0 and 3.0/3.5/3.5 SP1 somewhat:   

[.NET Framework 3.5.1 Features Overview](http://technet.microsoft.com/en-us/library/cc772269.aspx)
Vulnerability scans suffer from a couple of problems: false positives and false negatives.

Which is why you always need to check the results, and why there is a thriving industry in proper penetration testing, in addition to vulnerability scanning.

Generally, MBSA is pretty good at sorting out dependencies, so perhaps you have parts of .NET installed as part of one of your applications.