rdist in various UNIX systems uses popen to execute sendmail, which allows local users to gain root privileges by modifying the IFS (Internal Field Separator) variable.
http://www.securityfocus.com/bid/31
http://www.iss.net/security_center/static/7160.php