Multiple vulnerabilities have been reported in SLmail, which can be exploited by malicious people to execute arbitrary code on a vulnerable system with SYSTEM privileges.

1) Two boundary errors exist in "slmail.exe" when handling input supplied to the commands "ETRN" and "XTRN". A malicious person can exploit this by supplying a long, specially crafted argument to one of the vulnerable commands, which causes a buffer overflow.

2) A boundary error exists in POPPASSWD, which can be exploited by connecting to port 106/tcp and supplying an overly long, specially crafted string.

3) A boundary error also exists in the POP3 service, which can be exploited to cause a stack-based buffer overflow by supplying an overly long, specially crafted password (about 2600 bytes) when attempting to log in.

The vulnerabilities have been reported in version 5.1.0.4420 and 5.1.1.2192 on Windows. Other versions may also be affected.

NOTE: The third vulnerability has also been confirmed in the latest 5.5 trial version (5.5.0.4433), as it for some reason includes an old version of "SLmail.exe" (version 5.1.1.2192 compiled in February 2003). Other 5.5 versions may therefore also be affected.

Solution
The first two vulnerabilities have reportedly been fixed in version 5.5:
Further details available to Secunia VIM customers

Provided and/or discovered by
Originall discovered by:
David Litchfield and Mark Litchfield, NGSSoftware.

POP3 password buffer overflow rediscovered in 5.5 versions by:
Muts

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://www.nextgenss.com/advisories/slmail-vulns.txt

Deep Links
Links available to Secunia VIM customers