Threat Level: green Handler on Duty: Deborah Hale

SANS ISC: InfoSec Handlers Diary Blog - Any other reports of decade change problems? InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Any other reports of decade change problems?

Published: 2010-01-04
Last Updated: 2010-01-05 22:35:02 UTC
by Toby Kohlenberg (Version: 3)
16 comment(s)

We are curious whether anyone else is seeing the sorts of issues like the one with Symantec we just reported. Have you seen problems with the change from 200* to 20**?

UPDATE 1: Johannes mentioned that DShield actually had problems due to a regex on incoming logs looking for 200[0-9], to prevent ridiculously future dates being sent in. He ended up fixing it early in the morning on Jan 1.  Anyone else have stories to share?

UPDATE 2: We've had two interesting issues pointed out.

UPDATE 3: Splunk has released an update to fix the parsing issue for the date/timestamps that use a two character year (such as 09 or 10 for 2009 and 2010 respectively) that fix the datetime.xml. Additional information available here.

UPDATE 4: We've got more and more of these rolling in. Thanks to everyone who is submitting these:

  • Users of Invision Power Board are unable to create new blog entries
  • Palm Pre WebOS seems to be having problems with its Exchange calendar sync
  • Windows Mobile and maybe other cell phones are having issues. SMS messages sent in 2010 are being dated 2016
  • SAP have detected a problem in the spool area which affects all customers in the world regardless of the SAP release and any support package level. As soon as the retention time of a spool request exceeds 2009/12/31 a wrong date 2100/01/01 is entered during creation of the spool request. As a consequence these spool requests will not be deleted anymore from the spool reorg jobs. Using the default retention period this affects all spool requests on each SAP system in the world created since 2009/12/23
  • Arcsight - Perpetual license keys received before December 1st, 2007 still show a license expiration date of January 1st, 2010, in the ESM v4.0.x and v3.5.x Console. While the January 1st, 2010 expiration date is not enforced for perpetual licenses by the product, it has caused concerns and confusion. Customers who have upgraded to ESM v4.5.1.0 or v4.5.1.3 have encountered issues where their console connections have been rejected.
Keywords:
16 comment(s)
Diary Archives