>Um, I thought the sendmail hole the the Morris worm used was >the infamous 'wizard' mode, where you telnetted into the sendmail port >and typed 'wizard'. Then sendmail just asked for a password >and if you provided it, dropped you in to a root shell. Nope, it was the 'debug' hole, where you can remotely set up your own aliases, e.g. to a program consisting of sed '1,/^$/d' | sh