An older vulnerability has apparently been reintroduced in eXtremail, which can be exploited by malicious people to compromise a vulnerable mail server.

The vulnerability is caused due to a format string error in the logging functionality. This can be exploited by supplying a string containing format specifiers to any SMTP command.

The vulnerability has been reported to affect both version 1.5.8 and 1.5.5. Reportedly, the vulnerability was originally fixed in version 1.1.10.

Exploits are available on the Internet.

Solution
Use another mail server product.

Provided and/or discovered by
Originally discovered by: mu-b.
Reintroduced vulnerability in latest versions discovered by: B-r00t.

Deep Links
Links available to Secunia VIM customers