The vulnerability is caused by a format string error within the construction of bounce messages for non-existent domains. It can be exploited by passing a malicious original destination address, according to an advisory from vulnerability monitoring firm Secunia.
Ollie Whitehouse, researcher at rival firm Symantec, reported the flaw, according to the Symantec advisory.
If the flaw is successfully exploited, a malicious user could execute arbitrary code onto a compromised PC.
McAfee told users of McAfee WebShield SMTP 4.x to apply patch P0803, released in August of 2003.
McAfee did not have the flaw listed on its Threat Center webpage today.
.png&h=140&w=231&c=1&s=0)
iTnews Executive Retreat - Security Leaders Edition
_(1).jpg&h=140&w=231&c=1&s=0)
