Install Beta 2 Office Web Components
In keeping with my here's another situation where a patch for a vulnerable Microsoft product can't and won't automatically be applied. Similar to MSXML 4.0 SP2, this occurs with older software with publicly available exploits already written. This scenario, once again, comes to us thanks to our trusty vulnerability management system - however this time it's a very specific scenario that will only occur in enterprises. In short MS09-043 for Office Web Components (OWC) for Office 2007 won't deploy correctly on systems that use SCCM 2007 for deployment due to problems with the Microsoft Update Catalog.
2007 Microsoft Office System Known Issues/ReadMe. Install Beta2 Office Web Components. Failure to upgrade Office 2007 Beta 2 TR to RTM version with the. Download the latest from Windows, Windows Apps, Office, Xbox, Skype, Windows 10, Lumia phone, Edge & Internet Explorer, Dev Tools & more.
This story begins with an anomaly detected by a Vulnerability Management System. MS09-043 was released in August 2009, and covered a number of products including Office XP and 2003, ISA Server, and the more obscure Microsoft Office 2003 Web Components for the 2007 Microsoft Office System. MS09-043 patches a vulnerability in OWC that has publicly available exploits that are included in Metasploit, CANVAS, and Core Impact. What is Office Web Components?### Wikipedia provides the following information on OWC: Office Web Components (OWC) are a group of Object Linking and Embedding (OLE) components available in Office 2000, XP and 2003. These ActiveX Controls can be plugged into web pages, Visual Basic and Visual Basic for Applications (VBA) forms, Windows Forms or programmed in-memory. In it's simplest form OWC is an ActiveX component that you're likely to find on Windows Machines. Office 2007 and above don't include OWC any more and the weirdly named Microsoft Office 2003 Web Components for the 2007 Microsoft Office System is the last supported version released by Microsoft.
What caused the issue?### In this instance the Vulnerability Management System was showing a vulnerability relating to MS09-043, however the automated patching tools were showing that MS09-043 wasn't required. The investigation found that SCCM relies on the Microsoft Update Catalog to determine if an update has been superseded. It makes sense that if a patch has been superseded it can be ignored and just the newer patch applied. In this instance there is an error with the supersedence and SCCM believes that Microsoft Office Access Runtime and Data Connectivity 2007 Service Pack 3 (SP3) supersedes the MS09-043 patch of KB947318.
If you only have OWC 2003 for 2007 Office System installed without Office 2003 or 2007 the Office Access Runtime and Data Connectivity 2007 SP3 won't install. The reason it won't install is that the installer can't detect any installed versions of Access or Microsoft's Data Connectivity tools as part of it's prerequisite checks. This scenario is most likely when you've your version of Office is 2010 (or newer) but you still have legacy applications needing OWC). If you examine the contents of the Office Access Runtime and Data Connectivity 2007 SP3 package the updated OWC dll files are included, they just never get a chance to install.
I've created a case with Microsoft and asked that they either:. Fix the supersedence issue in the Microsoft Update Catalog. Update the Office Access Runtime and Data Connectivity SP3 package to detect and update OWC. Unfortunately neither of these will be occurring due to the age of the Office Suite in question and a workaround in SCCM 2012 being available.
This is despite OWC 2003 for 2007 systems being in extended support until 2017 and SCCM 2007 R3 being in extended support until 2019. Mitigation### If you're using SCCM 2007 Microsoft recommended one of the following to mitigate the problem:. Manually deploy KB947318 as a package. Enable your clients to install updates from your WSUS instance as well as SCCM. Upgrade to SCCM 2012 and use the new supersedence rules. 1 - 2 -best viewed with Internet Explorer due to Active-X requirements 3 - Web Components#Office Web Components which is released under the Creative Commons Attribution-Share-Alike License 3.0(4 - 5 - 6 - 7 - Read by this author.
KB Articles:. Office 2003 Web Components Service Pack 1 for the 2007 Microsoft Office System delivers important customer-requested stability and performance improvements, while incorporating further enhancements to user security.
This service pack also includes all the updates released for the Office 2003 Web Components prior to December of 2007. You can get a more complete description of SP1, including a list of issues that were fixed in the Microsoft Knoowledge Base article. Service Pack 1 will install even if a publicly available update has already been installed on your computer. SP1 also includes stability improvements developed as a result of user input from the and from Microsoft Product Support feedback. Supported Operating System Windows Server 2003 Service Pack 1, Windows Vista, Windows XP Service Pack 2.
This update applies to the following programs:. Microsoft® Office 2003 Web Components for the 2007 Microsoft® Office System Additional requirements:. To successfully install SP1, you must have Microsoft Installer 3.1 (MSI 3.1) or higher.
For more information, including instructions for downloading MSI 3.1, please see the Microsoft Knowledge Base article. To successfully install SP1, you will need more free hard disk space than the size of the patch itself. For more specific information about the space requirements, please see the Microsoft Knowledge Base article. There are several scenarios that may require you to reboot your computer after SP1 is installed.
For more information, see the Microsoft Knowledge Base article. To install this update, do one of the following:. Use (recommended).
Microsoft Update consolidates updates provided by Windows Update and Office Update into one location and enables you to choose automatic delivery and installation of high-priority updates. Use on the Office Online Web site. After running the automatic detection, Office Update prompts you to install updates and service packs that bring your Office products up to the best quality available. Office Update is not supported on Windows Vista.
Install the Office 2003 Web Components SP1 manually. To do this, follow these steps:. Download the file by clicking the Download button at the top of this page. Save the file to your hard disk drive.
Microsoft Office Web Components
It is recommended that you quit any programs you are running. In Windows Explorer, double-click the.exe file that you saved to your hard disk drive, and follow the instructions on the screen. When using other Microsoft Office products If you are using the following Microsoft Office products, we recommend that you get the latest service packs:. 2007 Microsoft® Office System:. Microsoft® Office Project 2007:.
Microsoft® Office Visio® 2007:. Microsoft® Office SharePoint® Designer 2007: To remove this download There is no uninstall feature for this download. For more information, see the Microsoft Knowledge Base article. Administrator resources Administrators working in managed environments can find complete resources for deploying Office updates in an organization on the site. For further information about this update, see Microsoft Knowledge Base article.