XCON: Exchange 2000 MTA May Stop Unexpectedly Under RPC Denial of Service Attack

View products that this article applies to.

This article was previously published under Q295435

Expand all | Collapse all

SYMPTOMS

The Exchange 2000 Server message transfer agent (MTA) may stop unexpectedly while under a remote procedure call (RPC) denial of service attack. A call stack similar to the following may be logged in the Drwtsn32.log:

ChildEBP RetAddr  Args to Child              
0d36fbbc 00232aa6 005efbe8 00180978 0018f8c0 ntdll!DbgBreakPoint
0d36fbd8 00231ba6 00000000 00000000 00180978 MTAAQSVR!MtarAQGetQueueInfo+0xc6
0d36fcf8 77d448bc 0d36fdfc 0018ee58 0d36fdfc MTAAQSVR!mtaaqsvc_MtarAQGetQueueInfo+0x156
0d36fd30 77d447ec 00231a50 0d36fdfc 0d36fe40 RPCRT4!DispatchToStubInC+0x84
0d36fd88 77d446fe 00000002 00000000 0d36fe40 RPCRT4!RPC_INTERFACE__DispatchToStubWorker+0x100
0d36fda8 77d591ec 0d36fdfc 00000000 0d36fe40 RPCRT4!RPC_INTERFACE__DispatchToStub+0x5e
0d36fdd8 77d71589 0d36fdfc 001415d4 00000000 RPCRT4!RPC_INTERFACE__DispatchToStubWithObject+0xa9
0d36fe44 77d4c63d 00183270 00182e88 001414c8 RPCRT4!OSF_SCALL__DispatchHelper+0x93
0d36fe58 77d4c43e 00000000 00000002 00000001 RPCRT4!OSF_SCALL__DispatchRPCCall+0x115
0d36fe90 77d4c199 00182e70 00000483 00000002 RPCRT4!OSF_SCALL__ProcessReceivedPDU+0x43
0d36feb0 77d4bd7d 00182e70 00000410 00015f90 RPCRT4!OSF_SCALL__BeginRpcCall+0xd0
0d36ff10 77d4bcf4 00000000 00182e70 00000410 RPCRT4!OSF_SCONNECTION__ProcessReceiveComplete+0x235
0d36ff20 77d5d7e2 00139640 0000000c 00000000 RPCRT4!ProcessConnectionServerReceivedEvent+0x1b
0d36ff74 77d5d689 77d52c9b 00139640 00000000 RPCRT4!LOADABLE_TRANSPORT__ProcessIOEvents+0xcd
0d36ff78 77d52c9b 00139640 00000000 4014e4c0 RPCRT4!ProcessIOEventsWrapper+0x9
0d36ffa8 77d52bb9 00139390 0d36ffec 77e837cd RPCRT4!BaseCachedThreadRoutine+0x11f
0d36ffb4 77e837cd 00163d68 00000000 4014e4c0 RPCRT4!ThreadStartRoutine+0x18
0d36ffec 00000000 77d52ba1 00163d68 00000000 KERNEL32!TlsSetValue+0xf0

Back to the top

CAUSE

This behavior is caused by a logic error in the MTA.

Back to the top

RESOLUTION

To resolve this problem, obtain the latest service pack for Microsoft Exchange 2000 Server. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

301378 (http://support.microsoft.com/kb/301378/EN-US/ ) XGEN: How to Obtain the Latest Exchange 2000 Server Service Pack

The English version of this fix should have the following file attributes or later:

Component: MTA

Collapse this tableExpand this table

File name	Version
Emsmta.exe	6.0.4418.86

Back to the top

STATUS

Microsoft has confirmed that this is a problem in Microsoft Exchange 2000 Server. This problem was first corrected in Microsoft Exchange 2000 Server Service Pack 1.

Back to the top