Question

Windows update - 9/11 & 9/10 - Breaks Web Access 9.0.2 & 9.1.1

Web Client

Updated December 16, 2014

asked on September 11, 2014

The latest windows update released this week (Wednesday) has resulted in malfunctioning of the Laserfiche Web Access version 9.0.2 & 9.1.1. When users login to Web Access, they encounter the following error message below. I am attaching a text file with the complete message.

The quickest way we got the system back to functional level was to undo/uninstall the following .NET updates:

Security Update for Microsoft .NET Framework 4.5 and 4.5.1 on Windows 7, Vista, Server 2008, Server 2008 R2 x64 (KB2894854)

Security Update for Microsoft .NET Framework 4.5, 4.5.1 and 4.5.2 on Windows 7, Vista, Server 2008, Server 2008 R2 x64 (KB2972216)

This has happened for us on Windows 7 as well as Server 2008 R2 machines.

Server Error in '/Laserfiche' Application.

Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.

See http://go.microsoft.com/fwlink/?LinkID=314055 for more information.

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.Web.HttpException: Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.

This is just an FYI and maybe Laserfiche can help address the issue.

IIS Error.txt (3.8 KB)

| Download

1 0

Answer

APPROVED ANSWER

replied on December 16, 2014

Update: the issue has been permenately resolved in Web Access 9.2 (https://support.laserfiche.com/KB/1013525) and the recently released Web Access 9.1.1 Service Pack 2 (https://support.laserfiche.com/KB/1013574). Brian's post will also resolve the issue in the case where updating is not possible.

0 0

Replies

replied on September 11, 2014

We saw the same results as Laura. KB2894854v2 is causing the issue. I first uninstalled KB2972216 and the problem remained. After uninstalling KB2894854v2, the issue was resolved. I then went back and reinstalled KB2972216 and issue remains resolved.

2 0

replied on September 12, 2014

Please note that we have released KB 1013541, which contains the same workaround that was provided.

2 0

replied on September 11, 2014 • Show version history

Microsoft has re-released the .NET updates. See http://support.microsoft.com/kb/2905247/en-us for information about the re-release as well as http://support.microsoft.com/kb/2915218 for information about resolving the view state issue.

Make sure that you have version 2 of the update installed. See below

1 0

replied on September 11, 2014

This fixed the problem. Would have been a wonderful notice to email out to people. FYI even if Version 2 is installed you can still get the error. We had Version 2 installed and could not get it fixed. We uninstalled both of the updates and everything works fine again.

0 0

replied on September 11, 2014 • Show version history

Do you still get the error if Web Access is configured to automatically log in using Windows Authentication?

0 0

replied on September 11, 2014 • Show version history

Can you try disabling the view state validation as described on this page of the documentation (bottom section)? It fixed Web Access for us internally. We'll look into this in more detail over the next few days, since it seems to be a conflict between two features that are separately trying to improve the security of Web Access.

0 0

replied on September 11, 2014

There's a typo in our documentation, but the element to add should be

<EnableViewStateKey Value="False" />

1 0

replied on September 15, 2014

Hi Guys, our IT updated our web access server with the following updates, can someone help us isolate which one might have caused the issue. It is none of the ones mentioned above

I am attaching the screenshot of the updates.

We would like to see if we can restore service without the workaround since Laserfiche suggests not to disable the ViewStateCheck without ensuring we have safeguards against CSRF and Malicious Replay attacks.

Thank you for your help.

webaccess-server-updates.png (85.44 KB)

| Download

0 0

replied on September 17, 2014

Jeff Neelley's post worked for us.

0 0

You are not allowed to follow up in this post.

Question

Question

Windows update - 9/11 & 9/10 - Breaks Web Access 9.0.2 & 9.1.1

Answer

Replies

Sign in to reply to this post.