The method used by sendmail version 5 to open a control file is insecure. A race condition exists whereby another process may obtain a control-file file descriptor, opened for write access.
Local users can write their own control files, and run programs as any user, bar root .
This increases chances of obtaining root access on the local system. A program to exploit this vulnerability is available as of now. This program has been tested with the latest Sun patch, and should work on other platforms. This will prevent normal users gaining access to the queue files directly. Contact vendor for fix.