A remotely exploitable format string vulnerability exists in smtp.proxy up to and including version 1.1.3. The bug is present and exploitable regardless of any compile time and runtime configuration options and can be exploited by sending a message with an embedded format string in either the client hostname or the message-id.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/33534/0xbadc0ded-04.txt
Source: https://packetstormsecurity.com/files/33534/0xbadc0ded-04.txt.html