Mitigation: Product Versioning
In the .NET Framework 4.6 and later, product versioning has changed from the previous releases of the .NET Framework (the .NET Framework 4, 4.5, 4.5.1, and 4.5.2).
Product versioning changes
The following are the detailed changes:
The value of the
Versionentry in the
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Fullkey has changed to
4.6.xxxxx for the .NET Framework 4.6 and its point releases, and to
4.7.xxxxx for the .NET Framework 4.7. In the .NET Framework 4.5, 4.5.1, and 4.5.2, it had the format
The file and product versioning for .NET Framework files has changed from the earlier versioning scheme of
4.6.X.0for the .NET Framework 4.6 and its point releases, and to
4.7.X.0for the .NET Framework 4.7 and its point releases. You can see these new values when you view the file's Properties after right-clicking on a file.
The AssemblyFileVersionAttribute and AssemblyInformationalVersionAttribute attributes for managed assemblies have Version values in the form
4.6.X.0for the .NET Framework 4.6 and its point releases, and
4.7.X.0for the .NET Framework 4.7.
In the .NET Framework 4.6, 4.6.1, 4.6.2, and 4.7, the Environment.Version property returns the fixed version string
4.0.30319.42000. In the .NET Framework 4, 4.5, 4.5.1, and 4.5.2, it returns version strings in the format
4.0.30319.xxxxx(for example, "4.0.30319.18010"). Note that we do not recommend application code taking any new dependency on the Environment.Version property.
Handling the product versioning changes
In general, applications should depend on the recommended techniques for detecting such things as the runtime version of the .NET Framework and the installation directory:
To detect the runtime version of the .NET Framework, see How to: Determine Which .NET Framework Versions Are Installed.
To determine the installation path for the .NET Framework, use the value of the
InstallPathentry in the
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Fullkey.
The subkey name is
NET Framework Setup, not
.NET Framework Setup.
To determine the directory path to the .NET Framework common language runtime, call the RuntimeEnvironment.GetRuntimeDirectory method.
To get the CLR version, call the RuntimeEnvironment.GetSystemVersion method. For the .NET Framework 4 and its point releases (the .NET Framework 4.5, 4.5.1, 4.5.2, and .NET Framework 4.6, 4.6.1, 4.6.2, and 4.7), it returns the string