Systems running IPSwitch's IMail 6.06 SMTP daemon.
Prior versions are most likely vulnerable.
The vulnerability stems from the IMail SMTP daemon not doing proper bounds checking on various input data that gets passed to the IMail Mailing List handler code. In order to overwrite EIP you must know the name of a valid mailing list. Now take any valid mailing list name and put it into the following SMTP session request and you will succesfully cause a buffer overflow to happen within the IMail service which, if you supply a specially crafted buffer, will result in the ability to remotely execute code on the IMail server.