Question: I have one server that requires a .NET3.5 patch KB951847 (per MBSA) but vulnerability scan does not report that patch as needed... the details:
Server W2003 has .NET4.0 installed but MBSA tells me that I need to install KB 951847 patch that installs .NET 3.5, why? I have ONLY installed .NET2 SP2 and .NET 4 , so .NET 4.0 shouldn't make .NET 3.5 Irrelevant?

-Server W2003 SP2 (x86)
-Nessus scan does not show any .NET vulnerabilities

please help me to solve this discrepancy, I am trying to avoid to install an unnecessary software (.NET 3.5).

Thank you :)

Answer: 
Scott Hanselman does an excellent job explaining the versioning of .NET in his blog entry:

[.NET Versioning and Multi-Targeting - .NET 4.5 is an in-place upgrade to .NET 4.0](http://www.hanselman.com/blog/NETVersioningAndMultiTargetingNET45IsAnInplaceUpgradeToNET40.aspx). 

In short, .NET 3.5 is an in-place upgrade to .NET 2 so that's why it needs to be installed. He also has another blog entry that, while IIS centric, has great information explaining the relationship between .NET 2.0 and .NET 3.5. 

[How to set an IIS Application or AppPool to use ASP.NET 3.5 rather than 2.0](http://www.hanselman.com/blog/HowToSetAnIISApplicationOrAppPoolToUseASPNET35RatherThan20.aspx)
Vulnerability scans suffer from a couple of problems: false positives and false negatives.

Which is why you always need to check the results, and why there is a thriving industry in proper penetration testing, in addition to vulnerability scanning.

Generally, MBSA is pretty good at sorting out dependencies, so perhaps you have parts of .NET installed as part of one of your applications.