One of the bugs I found and reported to Vixie about a year ago regarding his vixiecron, was that you could do the following: MAILTO="whatever; /bin/cp /bin/sh /tmp; chmod 4777 /tmp/sh" He fixed this, and with it introduced a new bug we also reported. I can't really remember the details, but it had something to do with a temporary file he was using, that you could predict, and thus link to /etc/master.passwd or something. Cor