New security patch causes services to fail to start

[mike@mc]

Hello,

As per the email advising to install the new version of Mail Enable for security reasons, I went ahead and installed the 3.64 version from your site.

Unfortunately after the install finished, and after a reboot also, several of the Mail Enable services failed to start.

On investigation the services that failed to start (about half of them) were missing the path to the executable. I had to manually edit the registry to fix the missing paths. After that, all services have started ok.

Just wanted you to know in case you want to do a quick fix on the installation package and save other people the same hassle.

Regards,
Mike

[nethub]

same here

the Path in service is not full path (e.g. "\MEIMAPS.exe", "\MEHTTPS.EXE"), which make the service fail to start......


Secondly, even I change the registry that IMAP service to use full path ""C:\Program Files\Mail Enable\bin\MEIMAPS.exe", the IMAP service still doesn't work.

Normally after the IMAP service starts, while telnet the server port 143, it will shows "* OK IMAP4rev1 server ready at 04/23/13 03:02:37", but not there is nothing showing and all IMAP clients (e.g. Outlook) is unable to login IMAP now......

[mike@mc]

Just came back here to say the same thing! IMAP is completely broken now.

Troubleshooting done so far, with no positive outcome yet

• Restarted the IMAP service several times
• Rebooted the server
• Turned off the firewall briefly (eek!)
• Checked that POP is working (it is)
• Checked that Webmail is working (it is)
• Tried TELNET from a remote pc - got the same result as you - absolutely nothing
• Tried TELNET from the mail server itself - got the same result as you - absolutely nothing

What else should I try? Other than fly to Mail Enable headquarters and bang on the door till someone comes up with a fix?

I am very very glad I only have a few dozen users to apologise to. If I was a medium or large enterprise I would be spitting tacks on this one.

PLEASE MailEnable - sort this out before I get the "you broke da internetz" calls.



In case it helps, here are a few lines from the IMAP debug log. My mail client is trying to connect on both 143 (standard) and 995 (SSL) for two seperate accounts.


04/22/13 19:43:41 Inbound Connection from 67.230.174.216 on port 995 (SSL)
04/22/13 19:44:11 Socket=[1492] Command=[] Host=[67.230.174.216] Status=[0].
04/22/13 19:44:11 [1492] end of conversation. Session=56609884
04/22/13 19:44:11 Inbound Connection from 67.230.174.216 on port 995 (SSL)
04/22/13 19:44:11 Inbound Connection from 67.230.174.216 on port 143 (non-SSL)
04/22/13 19:45:32 Socket=[1320] Command=[] Host=[67.230.174.216] Status=[10060].The connection has timed out.
04/22/13 19:45:32 [1320] end of conversation. Session=90557532
04/22/13 19:45:32 Socket=[1428] Command=[] Host=[67.230.174.216] Status=[10060].The connection has timed out.
04/22/13 19:45:32 [1428] end of conversation. Session=56609884

[JoelW]

I've received the email from MailEnable yesterday stating critical security vulnerabilities need to be patched ASAP, so naturally I began updating.

After running the upgrade on three of our servers I realised that despite appearances, things weren't actually working flawlessly and the IMAP service is not starting.

Nothing seems to be showing in the Event Log to explain what's going wrong. I've been through some of the options in the bin/meinstaller.exe executable, but re-registering DLLs, fixing permissions etc doesn't seem to help either.

At this point I'm going to hold off upgrading any of our other servers until a solution is posted, as we can't afford to have IMAP stop working on any more servers.

Any help getting this fixed would be greatly appreciated!

[JoelW]

same here

the Path in service is not full path (e.g. "\MEIMAPS.exe", "\MEHTTPS.EXE"), which make the service fail to start......


Secondly, even I change the registry that IMAP service to use full path ""C:\Program Files\Mail Enable\bin\MEIMAPS.exe", the IMAP service still doesn't work.

Normally after the IMAP service starts, while telnet the server port 143, it will shows "* OK IMAP4rev1 server ready at 04/23/13 03:02:37", but not there is nothing showing and all IMAP clients (e.g. Outlook) is unable to login IMAP now......

I had a look at one of our other servers which hasn't been upgraded, and compared the registry entries and you're correct. It looks like the following registry keys have been changed and are causing the issue:

HKLM \ SYSTEM \ ControlSet001 \ services \ MEIMAPS \ ImagePath

On my upgraded machine, this key's value was "\MEIMAPS.exe" whereas my non-upgraded machine contained the full path.

I modified the registry key on the upgraded machine so it was using the full path, and I can now start the IMAP service from the ME interface. Testing confirms the service is now working and listening on the IMAP port.

Hopefully this will help a few people until this is fixed up.

EDIT: The above issues have so far all occurred on ME 5.x Professional updates. I just upgraded one of our ME 6.x servers, and this problem did not occur. IMAP started perfectly after the upgrade, and the registry key still contains the full path. This issue may be localised to the 5.x installers, or even just the Professional one.

[mike@mc]

Hi Joel,

Thanks for providing your experience. Can you confirm that for your servers that you can receive email via IMAP? As you can see for me & nethub, we both were able to get the service started, but then IMAP was still not working despite the service running.

I am running 3.64. I am not sure what version nethub is running. If you are using running 5.xx and only had the service path error, and not the ensuing IMAP failure, then that is good news for 5.xx users.

Please Mail Enable - help us fix this asap.

Regards,
Mike

[JoelW]

Hi Joel,

Thanks for providing your experience. Can you confirm that for your servers that you can receive email via IMAP? As you can see for me & nethub, we both were able to get the service started, but then IMAP was still not working despite the service running.

My initial test was just to make sure the IMAP service was responding to connections, which it was via telnet. After seeing your message though, I've run a more in-depth test and I can confirm the IMAP service is working normally, allowing authentication and mail viewing as normal.

I've now run upgrades on 6.x, 5.x and 3.x servers and only the 5.x servers have encountered this problem with the services not starting. Fixing the registry keys to use the full path has worked so far.

If your IMAP installations are not working despite the service starting then it sounds like it might be a different issue to the one I've been seeing... here's hoping ME support can get onto it quickly for you guys!

[mike@mc]

Thanks for the fast reply.

That's interesting - it suggests that the first problem (the service executable paths) may not be relevant to the version of the installer but rather the environment (OS perhaps?). My 3.64 server is running on Windows 2008 x64. What is the platform for your 5.xx version that had this issue?

For the second problem - IMAP not responding even after the IMAP service starts - I wonder if there is some special startup parameters or something for that service that are missing - meaning the service starts but not properly. Would you mind posting a screenshot from the registry on your 3.64 server that shows the settings for the IMAP service?

Thanks Joel.
Mike

[nethub]

JoelW,

Unfortunately, it doesn't work in 3.64, even I change to full path, the IMAP service can be started, but it doesn't work fine. all IMAP software are unable to login the IMAP server.

same here

the Path in service is not full path (e.g. "\MEIMAPS.exe", "\MEHTTPS.EXE"), which make the service fail to start......


Secondly, even I change the registry that IMAP service to use full path ""C:\Program Files\Mail Enable\bin\MEIMAPS.exe", the IMAP service still doesn't work.

Normally after the IMAP service starts, while telnet the server port 143, it will shows "* OK IMAP4rev1 server ready at 04/23/13 03:02:37", but not there is nothing showing and all IMAP clients (e.g. Outlook) is unable to login IMAP now......

I had a look at one of our other servers which hasn't been upgraded, and compared the registry entries and you're correct. It looks like the following registry keys have been changed and are causing the issue:

HKLM \ SYSTEM \ ControlSet001 \ services \ MEIMAPS \ ImagePath

On my upgraded machine, this key's value was "\MEIMAPS.exe" whereas my non-upgraded machine contained the full path.

I modified the registry key on the upgraded machine so it was using the full path, and I can now start the IMAP service from the ME interface. Testing confirms the service is now working and listening on the IMAP port.

Hopefully this will help a few people until this is fixed up.

EDIT: The above issues have so far all occurred on ME 5.x Professional updates. I just upgraded one of our ME 6.x servers, and this problem did not occur. IMAP started perfectly after the upgrade, and the registry key still contains the full path. This issue may be localised to the 5.x installers, or even just the Professional one.

[JoelW]

That's interesting - it suggests that the first problem (the service executable paths) may not be relevant to the version of the installer but rather the environment (OS perhaps?). My 3.64 server is running on Windows 2008 x64. What is the platform for your 5.xx version that had this issue?

All of the 5.x servers I have are Window Server 2k8 64bit with SP2. That said, I have just gone through another 5.x update and this time the problem did not occur, so back to square one I guess.

For the second problem - IMAP not responding even after the IMAP service starts - I wonder if there is some special startup parameters or something for that service that are missing - meaning the service starts but not properly. Would you mind posting a screenshot from the registry on your 3.64 server that shows the settings for the IMAP service?

I'm not sure how much help it'll be, but I've taken a screenshot of the MEIMAPS services registry keys (from a 3.x server) which you can view here - http://imgur.com/K73CUmL

[mike@mc]

Mail Enable responded to a ticket that I opened and indicated a new version, 3.65, is now available for download here:
http://www.mailenable.com/downloadprevious.asp

I installed this - and now IMAP is working properly. (And I did not get the executable path problem either).

Thanks Mail Enable for the fast turnaround on this one.

nethub - give it a try - hopefully it works for you too.

Regards,
Mike

[nethub]

JoelW, Mike,

I believe that it is related the MailEnable version, we tested version 6 doesn't has the path problem and the IMAP can start properly and no login problem.

We didn't test version 5, but according to JoelW's reply, I guess version 5 has the path problem only, but no login problem.

For version 3, we guess it has both path problem and login problem (even correct the full path).

[nethub]

Thanks Mike!! It is good that Mailenable released a new version, we will try ASAP~~~~~~~~~~

Mail Enable responded to a ticket that I opened and indicated a new version, 3.65, is now available for download here:
http://www.mailenable.com/downloadprevious.asp

I installed this - and now IMAP is working properly. (And I did not get the executable path problem either).

Thanks Mail Enable for the fast turnaround on this one.

nethub - give it a try - hopefully it works for you too.

Regards,
Mike

[nethub]

confirmed that new version 3.65 works well, thanks all

[ahumeniy]

Path change in registry for all services worked for me.