Microsoft Invents The “Year 2022” Bug

Microsoft released a new version of Exchange Server at the start of the new year, which promptly caused everybody’s on-premises servers to crash. The reason? The version number. There is apparently code somewhere in the bowels of the software that interprets that number as a signed 32-bit integer, computed as the (year - 2000) × 100 million + additional digits for the month and day etc. Spot the problem with that? The largest representable such integer is 2147483647, so the top two digits can’t be greater than 21. So it can’t actually represent the correct version number for any version released after 2021. Why does the code do that? Who knows... Microsoft’s fix? Change the version number to restrict the top two digits to 21, and increment the lower digits instead, beyond their usual range (e.g. so the release date becomes effectively something like “33 December 2021”). They released a PowerShell script to automate the fix, but it might not work properly, so there is an option for a manual fix as well. <https://arstechnica.com/information-technology/2022/01/exchange-server-bug-gets-a-fix-after-ruining-admins-new-years-plans/>

I wrote:
Microsoft released a new version of Exchange Server at the start of the new year, which promptly caused everybody’s on-premises servers to crash.
The reason? The version number.
According to Microsoft’s blog post, linked from this report <https://www.theregister.com/2022/01/03/exchange_servery2k22_flaw/>, the version number concerned is not that of the server software, but of the antivirus signature file.
They released a PowerShell script to automate the fix, but it might not work properly, so there is an option for a manual fix as well.
Seems the fix is far from simple: Microsoft’s post about the bug and how to address it was updated seven times between publication on January 1st and the time this story was posted. Chatter in Microsoft forums and elsewhere suggests that the fix can be tricky to apply, and sometimes fails.
participants (1)
-
Lawrence D'Oliveiro