Discovered by: Mark Dowd
The best bugs are the ones vendors call impossible to exploit until a researcher proves them wrong. The exploitation of the Sendmail signal handler race condition is complicated, but very interesting. Great quote from Eric Allman:
ISS explained it to us and told us that they had managed to craft an exploit in their lab, but frankly we don’t see how it can be practical. This literally requires nanosecond precision in the millisecond world of networking.
For more exploitation details see the Matasano and Daily-Dave posts.