Mail Security for Microsoft Exchange 7.9.x experiences multiple process crashes

Products

• Mail Security for Microsoft Exchange

Issue/Introduction

During manual, scheduled or realtime scanning, Symantec Mail Security for Microsoft Exchange experiences multiple process crashes. In the Windows Application event log, the sequence of events starts with multiple event ID 45s indicating Scan engine failures while scanning different items, followed by Event ID 167 indicating the SAVFMSECtrl.exe process terminated unexpectedly. This may also be accompanied by event ID 218s showing files as unscannable.

Type : Warning

Event : 45

Source : Symantec Mail Security for Microsoft Exchange

Category : Unscannable

Description:

Scan Engine Failure.

HRESULT = 0x80004005.  This error occurred while scanning the attachment "<attachment name>" of message "<subject>" located in "<mailbox>".

 

Type : Error

Event : 167

Source : Symantec Mail Security for Microsoft Exchange

Category : Service

Description:

The process SAVFMSECtrl.EXE terminated unexpectedly

 

Type : Warning

Event : 168

Source : Symantec Mail Security for Microsoft Exchange

Category : Service

Description:

The process SAVFMSECtrl.EXE was restarted.

 

Type : Warning

Event : 218

Source : Symantec Mail Security for Microsoft Exchange

Category : Unscannable

Description:

The attachment "<attachment name>" located in message with subject "<subject>", located in SMTP has violated the following policy settings:

Scan: Auto-Protect

Rule: Unscannable File Rule

The following actions were taken on it:

The attachment "<attachment name>" was <action> for the following reason(s):

Timeout occurred while scanning this item

For more information, visit https://entced.symantec.com/entt?product=SMSMSE&build=symantec_ent&version=7.9.1.51&language=english&module=event_logging&error=218 .

Cause

When the size of the recipients field exceeds the memory buffer allocated for scanning, the SAVFMSECtrl.exe (controller) process crashes, which causes the SAVFMSESp.exe (scanner process) processes to be terminated by the new instance of the controller process that is spawned, and all items being processed at the time are marked as unscannable.

Resolution

A patch has been created for SMSMSE 7.9.1 to prevent this issue from occurring. Apply the attached patch to prevent these crashes.

This patch is for a specific processing scenario and is not included in SMSMSE 7.10 as no feedback was received to Engineering regarding the effectiveness of this hotfix.