the serv-u thing looks like a misconfiguration to me. i'd be curious how many installs in the wild are actually vulnerable. ie.
1) was there a previous install process that did set correct permissions for the access list tree?
2) did sites secure the access list tree themselves after install/security review?
the msmq thing isn't great, but any professionally managed site would be protecting/firewalling application level sockets anyhow.
not to say the bugs aren't real, they are, just wondering how much exposure they actually open up in the wild when combined with basic security hygiene.