rdist in various UNIX systems uses popen to execute sendmail, which allows local users to gain root privileges by modifying the IFS (Internal Field Separator) variable.
https://euvd.enisa.europa.eu/vulnerability/EUVD-1999-1449
http://www.securityfocus.com/bid/31
http://www.iss.net/security_center/static/7160.php