Question: I have one server that requires a .NET3.5 patch KB951847 (per MBSA) but vulnerability scan does not report that patch as needed... the details:
Server W2003 has .NET4.0 installed but MBSA tells me that I need to install KB 951847 patch that installs .NET 3.5, why? I have ONLY installed .NET2 SP2 and .NET 4 , so .NET 4.0 shouldn't make .NET 3.5 Irrelevant?

-Server W2003 SP2 (x86)
-Nessus scan does not show any .NET vulnerabilities

please help me to solve this discrepancy, I am trying to avoid to install an unnecessary software (.NET 3.5).

Thank you :)

Answer: 
Scott Hanselman does an excellent job explaining the versioning of .NET in his blog entry:

[.NET Versioning and Multi-Targeting - .NET 4.5 is an in-place upgrade to .NET 4.0](http://www.hanselman.com/blog/NETVersioningAndMultiTargetingNET45IsAnInplaceUpgradeToNET40.aspx). 

In short, .NET 3.5 is an in-place upgrade to .NET 2 so that's why it needs to be installed. He also has another blog entry that, while IIS centric, has great information explaining the relationship between .NET 2.0 and .NET 3.5. 

[How to set an IIS Application or AppPool to use ASP.NET 3.5 rather than 2.0](http://www.hanselman.com/blog/HowToSetAnIISApplicationOrAppPoolToUseASPNET35RatherThan20.aspx)
Each different major version of .net (2.0, 3.0, 3.5, 4.0) are entirely separate, and require their own set of updates. If you have an app that uses .NET 3.5 you still need 3.5 even if you have 4.0.

You need to install the security updates for ALL versions of .NET that you have installed. IF you are not using .NET 3.5 you can uninstall it