A buffer overflow vulnerability has been recently discovered which affects the IMail list server.  There are several publicly released  exploits of this vulnerability which have been released by the names ETRE and ETCETERABLUE.  The risk associated with this vulnerability appears to be nullified by systems that are actively running Windows Data Execution Prevention, which is enabled by default on current operating systems. However, we still recommend applying the patch by following the steps included below.

The steps below will guide you through the replacement of the IMail list server executable:

1. Ensure that you are running IMail version 12.4 or newer.
2. Download the attached ZIP file which contains the replacement imailsrv.exe file.
3. Stop the IMail SMTP and Queue Manager services.
4. Locate the existing imailsrv.exe file in the IMail top directory and copy or move it to a backup location.
5. Extract the imailsrv.exe file from the ZIP file that was downloaded in step 1 and place it in the IMail top directory.
6. Restart the IMail SMTP and Queue Manager services.