locked
EMET 5.2 W/EAF crashes Outlook (even in safe mode!) but no EMET log event generated RRS feed

  • Question

  • I've been running EMET 5.2 since it was released, but today it started crashing Outlook on me. I'm running Outlook 2010 (x64) Version 14.0.7145.5000.

    The event log entries generated are either:

         Faulting application name: OUTLOOK.EXE, version: 14.0.7143.5000, time stamp: 0x54b56e3e

         Faulting module name: ntdll.dll, version: 6.1.7601.22436, time stamp: 0x521eb03f

         Exception code: 0xc0000005

         Fault offset: 0x00000000000187dd

         Faulting process id: 0x51c

         Faulting application start time: 0x01d0739c64291a48

         Faulting application path: C:\Program Files\Microsoft Outlook\Office14\OUTLOOK.EXE

         Faulting module path: C:\Windows\SYSTEM32\ntdll.dll

    or else:

         .NET Runtime version 2.0.50727.5485 - CLR: Fatal Execution Engine Error (000007FEF107600A) (80131506)

    No EMET logs are generated when this happens, but I've verified repeatedly that I can make the issue come or go by enabling/disabling the EAF mitigation for Outlook in the EMET config.

    The following updates were loaded just prior to this behavior manifesting:

         Update for Microsoft OneDrive for Business (KB2920746) 64-Bit Edition

         Update for Microsoft Project 2013 (KB2956187) 64-Bit Edition

         Security Update for Microsoft Excel 2010 (KB2956142) 64-Bit Edition

         Update for Microsoft Outlook 2013 (KB2956170) 64-Bit Edition

         Security Update for Windows 7 for x64-based Systems (KB3033929)

         Update for Microsoft Lync 2013 (KB2956174) 64-Bit Edition

         Update for Microsoft Excel 2013 (KB2956145) 64-Bit Edition

         Security Update for Microsoft Office 2013 (KB2956151) 64-Bit Edition

         Cumulative Security Update for Internet Explorer 11 for Windows 7 for x64-based Systems (KB3021952)

         Update for Microsoft Visio Viewer 2010 (KB2837587) 64-Bit Edition

    Can you guys look into this? I'm betting this must be affecting others.

    Thanks

    Friday, April 10, 2015 3:50 PM