Microsoft KB Archive/295435

= XCON: Exchange 2000 MTA May Stop Unexpectedly Under RPC Denial of Service Attack =

Article ID: 295435

Article Last Modified on 2/20/2007

-

APPLIES TO


 * Microsoft Exchange 2000 Server Standard Edition

-



This article was previously published under Q295435



SYMPTOMS
The Exchange 2000 Server message transfer agent (MTA) may stop unexpectedly while under a remote procedure call (RPC) denial of service attack. A call stack similar to the following may be logged in the Drwtsn32.log:

ChildEBP RetAddr Args to Child 0d36fbbc 00232aa6 005efbe8 00180978 0018f8c0 ntdll!DbgBreakPoint 0d36fbd8 00231ba6 00000000 00000000 00180978 MTAAQSVR!MtarAQGetQueueInfo+0xc6 0d36fcf8 77d448bc 0d36fdfc 0018ee58 0d36fdfc MTAAQSVR!mtaaqsvc_MtarAQGetQueueInfo+0x156 0d36fd30 77d447ec 00231a50 0d36fdfc 0d36fe40 RPCRT4!DispatchToStubInC+0x84 0d36fd88 77d446fe 00000002 00000000 0d36fe40 RPCRT4!RPC_INTERFACE__DispatchToStubWorker+0x100 0d36fda8 77d591ec 0d36fdfc 00000000 0d36fe40 RPCRT4!RPC_INTERFACE__DispatchToStub+0x5e 0d36fdd8 77d71589 0d36fdfc 001415d4 00000000 RPCRT4!RPC_INTERFACE__DispatchToStubWithObject+0xa9 0d36fe44 77d4c63d 00183270 00182e88 001414c8 RPCRT4!OSF_SCALL__DispatchHelper+0x93 0d36fe58 77d4c43e 00000000 00000002 00000001 RPCRT4!OSF_SCALL__DispatchRPCCall+0x115 0d36fe90 77d4c199 00182e70 00000483 00000002 RPCRT4!OSF_SCALL__ProcessReceivedPDU+0x43 0d36feb0 77d4bd7d 00182e70 00000410 00015f90 RPCRT4!OSF_SCALL__BeginRpcCall+0xd0 0d36ff10 77d4bcf4 00000000 00182e70 00000410 RPCRT4!OSF_SCONNECTION__ProcessReceiveComplete+0x235 0d36ff20 77d5d7e2 00139640 0000000c 00000000 RPCRT4!ProcessConnectionServerReceivedEvent+0x1b 0d36ff74 77d5d689 77d52c9b 00139640 00000000 RPCRT4!LOADABLE_TRANSPORT__ProcessIOEvents+0xcd 0d36ff78 77d52c9b 00139640 00000000 4014e4c0 RPCRT4!ProcessIOEventsWrapper+0x9 0d36ffa8 77d52bb9 00139390 0d36ffec 77e837cd RPCRT4!BaseCachedThreadRoutine+0x11f 0d36ffb4 77e837cd 00163d68 00000000 4014e4c0 RPCRT4!ThreadStartRoutine+0x18 0d36ffec 00000000 77d52ba1 00163d68 00000000 KERNEL32!TlsSetValue+0xf0



CAUSE
This behavior is caused by a logic error in the MTA.



RESOLUTION
To resolve this problem, obtain the latest service pack for Microsoft Exchange 2000 Server. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

301378 XGEN: How to Obtain the Latest Exchange 2000 Server Service Pack

The English version of this fix should have the following file attributes or later:

Component: MTA



STATUS
Microsoft has confirmed that this is a problem in Microsoft Exchange 2000 Server. This problem was first corrected in Microsoft Exchange 2000 Server Service Pack 1.

Keywords: kbbug kbexchange2000presp1fix kbfix kbqfe KB295435

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.