The mail server began showing symptoms similar to those of March 16. This time the problem was traced to some problem with the imapd process, since shutting down Webmail, and killing all imapd processes caused the system to recover. Restarting the mail server did solve the problem.

We also noticed a number of CGI redirect attacks directed at the Webmail interface of Hermione. Although they have been fairly steady, it may be that Webmail is vulnerable to certain of these attacks. Since Webmail is not supported by Captaris anymore, it’s anyone’s guess as to whether it is vulnerable. Right now, until we get a better idea of what’s going on, we can only update the imap server, and continue to investigate these attacks.