Kaseya Community

Problem with Security Updates for the 2007 Microsoft Office System

  • I submitted these problems as a ticket to K Support (Ticket ID: 198803). Thought I would also post here...


    We are having problems deploying two Security Updates for the 2007 Microsoft Office System. They are:

    - Security Update for the 2007 Microsoft Office System (KB951944)
    Patch name = office2007-kb951944-fullfile-x86-glb.exe
    Switches = /Q

    - Security Update for the 2007 Microsoft Office System (KB972581)
    Patch name = office2007-972581-fullfile-x86-glb.exe
    Switches = /quiet /norestart

    We have seen three problems, as follows:

    PROBLEM #1. Security Update for the 2007 Microsoft Office System (KB951944). Kaseya shows Patch name = office2007-kb951944-fullfile-x86-glb.exe and switch of /Q. But this does not appear to be a valid switch. When running the EXE file with the /? parameter, it does not list /Q as a valid switch. It does list /quiet /norestart - which seem to be valid switches for other Office patches.

    PROBLEM #2. Security Update for the 2007 Microsoft Office System (KB951944). Deploying this patch via results in a failure. We changed Kaseya to keep the EXE file, and then manually ran the EXE file from a command prompt. Kaseya appears to download the correct file name (office2007-kb951944-fullfile-x86-glb.exe) from Microsoft, however, on the manual install the following error occurs “The expected version of the product was not found on your system”. We found that the EXE file size that Kaseya downloads is a 15.5 MB file, while the Kaseya patch details screen reports a 7.75MB file. Taking the same machine to Windows Update, it attempts to download a 7.75MB (approx) file.

    PROBLEM #3. Problem with Security Update for the 2007 Microsoft Office System (KB972581). Similar to problem #2 above. Deploying this patch via results in a failure. We changed Kaseya to keep the EXE file, and then manually ran the EXE file from a command prompt, the message “The expected version of the product was not found on your system” appears. Kaseya downloads a file (office2007-972581-fullfile-x86-glb.exe) of approx 2.5MB. The Kaseya patch details calls for a 1.1MB file. The actual EXE file that downloads via Kaseya is approx 2.5MB. Taking the machine to Windows Update, it attempts to download a 1.1MB (approx) file.

    We have seen the above errors on multiple machines.

    Legacy Forum Name: Problem with Security Updates for the 2007 Microsoft Office System,
    Legacy Posted By Username: lwolf
  • It would appear that the process for vetting patches needs to looked at.

    This is something like Problem #1 with the wrong switches is getting through too often.

    While performing pre-deployment testing is always a good idea for each Kaseya installation, the purpose of that testing should not be to catch quality issues.

    Thanks for catching this one and submitting a ticket.

    I can't say I have run into your other two issues.

    Legacy Forum Name: Patch Management,
    Legacy Posted By Username: smbtechnology
  • It does seem like we have experienced a fair number of incorrect switches lately.

    Legacy Forum Name: Patch Management,
    Legacy Posted By Username: lwolf
  • must be the new guys fault...

    Legacy Forum Name: Patch Management,
    Legacy Posted By Username: thirteentwenty
  • I submitted a ticket reporting the problems on Friday afternoon (Ticket ID: 198803). It is now Tuesday morning, and I have received no response other than the "your request has been escalated." Uuuugggghhhhh.

    Legacy Forum Name: Patch Management,
    Legacy Posted By Username: lwolf
  • I received a message that PROBLEM #1 has been hotifixed.

    No fixes for PROBLEM #2 and #3 as of yet.

    Legacy Forum Name: Patch Management,
    Legacy Posted By Username: lwolf
  • Finally, getting some attention from K Support. yeah!

    Here is the latest message that I received. I thought I would share it, because it contained some interesting background info on patching.

    ============================================
    [Ticket Notes ~ticId='198803']
    Ticket ID: 198803
    ---------------------------------------------------------
    Author: su.chen
    Date: 15:07:24 13-Nov-09
    Hi Lloyd,

    Here's an update:

    When we perform a patch scan, we attempt to obtain a download link for a single patch file that can be executed from a command line. Unfortunately, there are some cases where the download link is for a cabinet (.cab) file.

    So we created a service where the VSA sends us an email with WUA scan data for the above case where a single executable patch file is not provided. We have a tool that we use to import and manage this data. We then use this data to go to various Microsoft sources to look for a downloadable single executable patch file. Both KB951944 and KB972581 are the cases. We detected them as .cab files and replaced .cab files with downloadable single executable patch files. I verified that the downloadable links we have provided are correct and are obtained from Microsoft Download Center below:

    http://www.microsoft.com/downloads/details.aspx?familyid=fb457536-26c5-428b-97e4-1fc13718266e&displaylang=en
    http://www.microsoft.com/downloads/details.aspx?familyid=98d7c4ab-f8ca-4806-a609-453fb29b02ec&displaylang=en

    For some reason, these downloadable files from Microsoft seems to error out though the WUA patch scan reported that the machine needs it. We've seen this in the past where the detection logic for the one provided by Microsoft Download Center differs from the one used by Microsoft Update.

    I think in this case, it's best to go back to using the .cab files for these updates rather than the links provided by Kaseya. (Using .cab files will require internet connection and it ignores the patch file source configration though.) I can do this through the Patch Location page. With your permission, I'd like to make this change on your system for those two updates and also make sure that the workaround is successful by trying to install the update on one of the machines that are missing. Can you please let me know if this is ok and which machine I can try this on.

    Thanks,
    Su
    ============================================

    Legacy Forum Name: Patch Management,
    Legacy Posted By Username: lwolf
  • I am happy to report that this problem seems to have been solved. Patches are working since K support change to using the *.cab file, instead of the EXE file.

    Legacy Forum Name: Patch Management,
    Legacy Posted By Username: lwolf
  • As long as they don't need a cab file for a big patch download like a SQL service pack. We who must try and make a living in the bandwidth challenged parts of the world really need to be able to control what Kaseya downloads.

    Legacy Forum Name: Patch Management,
    Legacy Posted By Username: smbtechnology