The MS12-027 security bulletin was just released on 4/10 which contains a fix to Office 2003 web components.  What does this have to do with SQL Server you ask?  Well, SQL Server 2005 installs the Office 2003 web components as part of the install. I believe this is part of the management tools only, but I have not been able to confirm as of yet.  The problem that has been occurring is that the installation of this security update fails with the following error:

“The expected version of the product was not found on your system”

This is because SP3 of the Office 2003 Web Components are a prerequisite for this security update which is explained in KB2597112. If your system is updated via automatic updates, then you will already have this installed and should not experience this problem.  In many large corporate environments, security updates are managed and deployed internally.  It is easy to overlook that Office 2003 Web Components need to be patched on SQL Servers. An easy way to check is to look in “Installed Updates" in control panel and confirm that sp3 has been installed for Office 2003 Web Components.  If not, that will need to be installed prior to running this security update.

SQL 2008 and R2 does not appear to be affected.  If you look in Control Panel it may appear as though you have “Office 2003 Web Components” installed, but if you look at installed updates you will notice that what you really have is the “Office 2003 Web Components for Office 2007”.  That is the component that is installed as part of the SQL 2008 and R2 installs.  This component does not appear to have the same prerequisite.  There is an SP1 for this particular component, and I would suggest installing that if you do not have it already.

I want to thank my fellow PFE Joe McT for brining this to my attention.  It goes to show that when you have access to a PFE as a customer, you get access to all PFEs!

Happy patching everyone!