An SMTP session with the server, where mail is destined to a valid mailing list and where a specially formatted command is supplied to the server, can cause arbitrary code to be executed. A remote user can execute arbitrary code on the server with system level privileges. The vendor has released a patch. Systems running IPSwitch's IMail 6.06 SMTP daemon.
Prior versions are most likely vulnerable.
The vulnerability stems from the IMail SMTP daemon not doing proper bounds checking on various input data that gets passed to the IMail Mailing List handler code. In order to overwrite EIP you must know the name of a valid mailing list. Now take any valid mailing list name and put it into the following SMTP session request and you will succesfully cause a buffer overflow to happen within the IMail service which, if you supply a specially crafted buffer, will result in the ability to remotely execute code on the IMail server. Check back to the eEye website as we will post an exploit at some point. In fact IMail was able to get a corrective patch out within two days of contacting them.