Hidden messages in an Exchange Server 2007 mailbox can be downloaded by any IMAP4 client

In a Microsoft Exchange Server 2007 environment, you create a hidden message in your Inbox folder. If you log on to the mailbox by using an IMAP4 client, the hidden message is downloaded and visible.

Note This issue does not occur in other clients, such as Microsoft Office Outlook Web Access (OWA), POP3 clients, or MAPI clients.

IMAP4 clients obtain messages from the server by using two methods. However, Exchange Server 2007 only blocks hidden messages in one of these methods. Therefore, if the IMAP client uses the other method, the hidden message is downloaded and visible.

To resolve this problem, install the following update rollup:

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.