[AusNOG] On Prem Exchange issues - y2k22 bug.

[DaZZa]

Probably related Reddit thread

https://www.reddit.com/r/sysadmin/comments/rt91z6/exchange_2019_antimalware_bad_update

Appears to be related to the long signed integer value for version numbers
allowing values only up to 2,147,483,647 - so when version numbers for the
malware/inline virus scanner were in 2021 - the first two numbers were "21"
and it worked.

Now it's 2022 - the first two numbers are "22", and it b0rks the update

It's almost comical that a company as big as Microsoft - especially after
the hype around Y2K bugs all those years ago - has missed this so blatantly
- but I suppose the company that we should be used to that by now.



DaZZa

On Sat, 1 Jan 2022, 6:20 pm Mark Dignam, <mark at innaloo.net> wrote:

> People.
>
>
>
> There appears to a y2k22 bug in Exchange servers - and its fairly nasty.
> As of midnight UTC, the Filtering Service stopped passing emails, email
> goes in - and never gets delivered to the mailbox.  Easiest thing to look
> for in the event logs:
>
> *The FIP-FS Filtering Management Service was unable to acquire a scanner
> within the specified timeout.*
>
> or
>
> *The FIP-FS "Microsoft" Scan Engine failed to load. PID: 12348, Error
> Code: 0x80004005. Error Description: Can't convert "2201010001" to long.*
>
>
>
> Office365 appears NOT affected at this stage. (as expected, with MS's
> current "move to our cloud" strategy)
>
> https://twitter.com/JRoosen/status/1477120097747677184
>
>
>
> Quick fix for a 2016 system, open a Exchange Management Power Shell
> screen…
>
>
>
> cd $exscripts
>
> .\Disable-AntimalwareScanning.ps1
>
> Restart-Service MSExchangeTRansport
>
>
>
> And anything waiting in the submission will get delivered in the next few
> mins.
>
>
>
>
>
>
>
>
>
>
> _______________________________________________
> AusNOG mailing list
> AusNOG at lists.ausnog.net
> http://lists.ausnog.net/mailman/listinfo/ausnog
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ausnog.net/pipermail/ausnog/attachments/20220101/09a163dc/attachment.htm>