XADM: Chat Fails w/ Invalid Number of Reply/Request Arguments

• Microsoft Exchange Server version 5.5

SYMPTOMS

The Microsoft Exchange Server 5.5 Chat Service stops responding; there is an Access Violation causing the Inetinfo.exe process to terminate.

CAUSE

The Exchange Server Chat Service fails to verify that a minimum number of four arguments (including the command) are being passed to the REQUEST and REPLY commands. Failure of a Chat client to provide enough arguments can result in the service failure described here.

STATUS

Microsoft has confirmed this to be a problem in Exchange version 5.5. A supported fix is now available, but has not been fully regression tested and should be applied only to systems experiencing this specific problem. Unless you are severely impacted by this specific problem, Microsoft recommends that you wait for the next Service Pack that contains this fix. Contact Microsoft Technical Support for more information.

MORE INFORMATION

With the fix applied, the Exchange Server Chat Service is modified to check the number of arguments provided and to reply with an error to a chat client that does not provide enough arguments.

When you are experiencing this problem, if you examine the Drwtsn32.log file generated by a failing process in the %systemroot% directory, you may see an entry similar to the following:

   Application exception occurred:
        App: exe\inetinfo.dbg (pid=137)
        When: 12/10/1997 @ 9:52:13.279
        Exception number: c0000005 (access violation)

   State Dump for Thread Id 0x1c7

   eax=78040338 ebx=0215415a ecx=00000009 edx=00002000 esi=00000000
   edi=1003a8bc
   eip=7802b225 esp=07bbeb40 ebp=07bbeb4c iopl=0         nv up ei pl zr na
   po nc
   cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000
   efl=00000246

   function: memicmp
        7802b208 7440             jz      memicmp+0x4d (7802b24a)
        7802b20a 8b7508           mov     esi,[ebp+0x8]
        7802b20d 8b7d0c           mov     edi,[ebp+0xc]
        7802b210 8d0538030478    lea eax,[_lc_handle (78040338)]
        7802b216 83780800         cmp    dword ptr [eax+0x8],0x0
        7802b21a 7540             jnz     memicmp+0x5f (7802b25c)
        7802b21c b741             mov     bh,0x41
        7802b21e b35a             mov     bl,0x5a
        7802b220 b620             mov     dh,0x20
        7802b222 2e8bc0           mov     eax,cs:eax
   FAULT ->7802b225 8a26             mov     ah,[esi]
        7802b227 46               inc     esi
        7802b228 8a07             mov     al,[edi]
        7802b22a 47               inc     edi
        7802b22b 38c4             cmp     ah,al
        7802b22d 7418             jz      memicmp+0x4a (7802b247)
        7802b22f 38fc             cmp     ah,bh
        7802b231 7206             jb      memicmp+0x3c (7802b239)
        7802b233 38dc             cmp     ah,bl
        7802b235 7702             ja      memicmp+0x3c (7802b239)
        7802b237 02e6             add     ah,dh
        7802b239 38f8             cmp     al,bh

   *----> Stack Back Trace <----*

   FramePtr ReturnAd Param#1  Param#2  Param#3  Param#4  Function Name
   07bbeb4c 10011156 00000000 1003a8bc 00000009 0000005e msvcrt!memicmp
   07bbecec 1001aa84 07bbed0c 07bbee48 00000002 02151dc0
   ChatSvc!CIrcUser::CommandMessage