Yes, they should have caught that hole long ago in development.
Yes, the admin should have installed the patches.
SQL Server was written in unmanaged code that easily allowed buffer overflows.
.NET provides a whole new realm of security and a much more secure way to code.
Do some Research on this people.