Companies that run Microsoft Exchange on their own servers get a built-in anti-malware scanner (called FIP-FS) that downloads fresh signature updates. Each update carries a version number.
In the first hours of 1 January 2022, mail on Exchange Server 2016 and 2019 stopped moving. Messages piled up in the transport queues, the outgoing and incoming lines where email waits to be processed. The servers' event logs showed the scan engine failing to load, with one telling line:
Can't convert "2201010001" to long.
Microsoft's explanation: "a date check failure with the change of the new year", not a problem with the malware engine itself. "The version checking performed against the signature file is causing the malware engine to crash."
Security researcher Joseph Roosen, quoted by BleepingComputer, spelled out the arithmetic. The version held a date value and was stored as a signed 32-bit integer, which tops out at 2,147,483,647. Through 2021, versions starting with 21 fitted. The 2022 value, 2,201,010,001, did not.
Some admins kept mail flowing by switching malware filtering off, which also left them unprotected. Microsoft's fix needed customer action on every affected server: a script that removed the scan engine and its update data, then downloaded a fresh engine. Afterwards, Microsoft said, the update version should read 2112330001 or higher. Read as a date, that's 21-12-33: the 33rd of December 2021, a version number that fits.
- 2,147,483,647: the largest signed 32-bit integer
- 2201010001: the 2022 version number that didn't fit
- 2112330001: the version the fix installs instead
- 2 Exchange versions hit: Server 2016 and 2019
Why it matters: A field that packs a date into a number has an expiry date of its own. Check what your formats do at the next year, decade or limit, and test the clock forward before the calendar does it for you.