MS12-027 may fail on servers with SQL 2005

The MS12-027 security bulletin was just released on 4/10 which contains a fix to Office 2003 web components.  What does this have to do with SQL Server you ask?  Well, SQL Server 2005 installs the Office 2003 web components as part of the install. I believe this is part of the management tools only, but I have not been able to confirm as of yet.  The problem that has been occurring is that the installation of this security update fails with the following error:

“The expected version of the product was not found on your system”

This is because SP3 of the Office 2003 Web Components are a prerequisite for this security update which is explained in KB2597112. If your system is updated via automatic updates, then you will already have this installed and should not experience this problem.  In many large corporate environments, security updates are managed and deployed internally.  It is easy to overlook that Office 2003 Web Components need to be patched on SQL Servers. An easy way to check is to look in “Installed Updates" in control panel and confirm that sp3 has been installed for Office 2003 Web Components.  If not, that will need to be installed prior to running this security update.

SQL 2008 and R2 does not appear to be affected.  If you look in Control Panel it may appear as though you have “Office 2003 Web Components” installed, but if you look at installed updates you will notice that what you really have is the “Office 2003 Web Components for Office 2007”.  That is the component that is installed as part of the SQL 2008 and R2 installs.  This component does not appear to have the same prerequisite.  There is an SP1 for this particular component, and I would suggest installing that if you do not have it already.

I want to thank my fellow PFE Joe McT for brining this to my attention.  It goes to show that when you have access to a PFE as a customer, you get access to all PFEs!

Happy patching everyone!

Comments (9)

  1. John W. Vinson says:

    Thanks for posting this. I've just gotten burned by this error.

    I'm currently doing the huge download for SQL/Server 2005 SP4 (which probably needs doing anyway) but it's not clear that this update includes the Office 2003 Web Components. Could you explain how to check that I have this update, or how to get it if I don't?

  2. SQLGardner says:

    In control panel, you can look at installed updates.  You should see Office 2003 Web Components in the list of products and you will see if SP3 for Office 2003 Web Components is listed as one of the updates that have been installed for that product.

  3. John W. Vinson says:

    Alas, it appears that Office 2003 Web Components SP3 (OWC11SP3) is in fact installed.

    I'm only using this machine for a small portion of my work – I've got a different box with Windows7 and newer versions of Office that's my main production box. I'm half tempted just to ignore this update, since it's proving such a hassle! Would that be playing with fire?

  4. SQLGardner says:

    I would definitely suggest applying this update!  THe only reason it is a hassle is if you don't have sp3 for Office 2003 Web Components.  The reason it is a prereq, is that is the lowest supported version of the Office 2003 Web Components.  Since it seems you have sp3 installed, you should have no issues with this update.

  5. John W. Vinson says:

    That's what's frustrating! If I look in Add & Remove Programs, and view Updates, the SP3 for Office Web Components IS installed.

    It has not been re-downloading the update; where does WinXP store the downloaded files? Could I delete it to force a re-download? Or could I download it (from the MSDN downloads site) on my other machine and run it on the XP box?

    Thanks for the help, and sorry to keep bugging you – but the "official" channels (MS Answers, etc.) are not even acknowledging my posts. :-{(

  6. John W. Vinson says:

    Well, I clearly SHOULD have no trouble… but trouble I've got. The FixIt tool is failing instantly. I'm going to try to find the half-hour or so to go through the extensive manual process for resetting the update software. I tried it once and may have fumblefingered something (the instructions are horrible, don't fit on a page when printed, and are in a bulleted list that cannot be easily copied and pasted to a .BAT file or even the command prompt).

    I'm grumpy about this. But I'm hoping I'll get there without having to wipe and rebuild this machine.

  7. SQLGardner says:

    Sorry for the delay in my response, John. Unfortunately I am not sure about on a Win XP box as that version of the OS is out of support. If you have an extended support agreement, your may want to call and open a case with Microsoft Support.

  8. Patching a 2008 R2 Server that has SQL 2005 installed, but no 2003 Web components. Checked Programs and Features and View installed Updates…Not there. When I try to install patch MS12-027, I get the error in your blog/article. An Info Assurance Tool (Retina) scanned the Server and reported this vulnerability. I got SP3 Office 2003, but that does not install either. No real surprise, 'cause Programs and Features gives no inidcation of Office 2003 Web components being installed. I left a similar comment, but I was not logged in. Hope only there is only one post to the blog. Thanks…Jim

  9. Adding to my previous post. We have the Hyper-V Role installed on our 2008 R2 Server and recently added MS System Center Virt. Mach. Mgr. Perhaps this added SQL Server 2005. Does the SCVMM install leave out the 2003 Web component perhaps? Another SysAd has been doing the Hyper-V. But I think that is where the SQL 2005 install came from? But MS12-027 still won't execute the patch sucessfully.

Skip to main content