Older versions of sendmail (circa 1995) incorrectly used popen to process certain arguments.
There is a problem with the way that the older (circa 1995) versions of Sun Microsystems, Inc. version of sendmail processes the -oR option. This problem has been verified as existing in the version of sendmail that is in SunOS 4.1.X, including patches 100377-19 (for SunOS 4.1.3), 101665-04 (for SunOS 4.1.3_U1), and 102423-01 (for SunOS 4.1.4).
The -oR option specifies the host, called the mail hub, to which mail should be forwarded when a user on a client of that hub receives mail. This host can be identified with the -oR option on the command line as
Local users can obtain root access.
Upgrade to the most recent version of sendmail.
Sun Microsystems Inc.
Thanks to 8lgm for reporting this vulnerability.
This document was written by Larry Rogers and Shawn Hernan.