000014177 - IIS application pool crashes when doing protocol transition

Document created by RSA Customer Support Employee on Jun 16, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000014177
Applies ToClearTrust Web Agent IIS V4.8 Agent
Win 2003 Server
Microsoft Internet Information Services 6.0  (IIS 6.0)
IssueIIS application pool crashes when doing protocol transition

The IIS Application Pool hosting the ct_iis60_agent.dll crashes when the agent is configured for Protocol Transition. 

The agent may fail in various ways, but typically the last item in the agent log file will be a heap message:

2008-07-29 13:06:20 -0400 - [4900] - <Debug> - Heap freed


Windows Application Event log shows an error in an application associated with the IIS Application Pool  (The faulting module may be any application):

Event Type:     Information
Event Source:   Application Error
Event Category: (100)
Event ID:       1004
Date:           25/07/2008
Time:           14:05:23
User:           N/A
Computer:      
Description:
Reporting queued error: faulting application
w3wp.exe, version 6.0.3790.3959, faulting module ntdll.dll, version
5.2.3790.3959, fault address 0x000417af."


 The IIS application pool restarts 3 times and then quits with an error similar to this:

Event Type: Warning
Event Source: W3SVC
Event Category: None
Event ID: 1011
Date:  05.08.2008
Time:  18:02:29
User:  N/A
Computer: 
Description:
A process serving application pool 'DefaultAppPool' suffered a fatal
communication error with the World Wide Web Publishing Service. The
process id was '1296'. The data field contains the error number.
 

CauseThe ClearTrust agent was allocating heap incorrectly.  This caused random memory to be overwritten.
ResolutionThis problem has been resolved in hotfix 4.8.0.07 for the 4.8 Agent for IIS 6.0.  Contact RSA Customer Support and request this hotfix or the latest hotfix for this agent.
Workaround

Upgraded to Windows 2003 SP2 

Microsoft changed the way the C++ heap manager works in this service pack.  This makes the effects of heap corruption more evident.

NotesNote the same problem has been resolved in hotfix 4.7.0.29 for the 4.7 Agent for IIS 6.0 and the 4.6.0.153 for the 4.6 Agent for IIS 6.0
Legacy Article IDa41809

Attachments

    Outcomes