/bin/login gives root to group utmp
There is a group-utmp-to-root privilege escalation vulnerability in /bin/login in Debian, and I expect in all other Linux distros. For details and exploit please see http://bugs.debian.org/505271 Currently am not aware of any group utmp issues that could be leveraged to get root. Cheers, Paul Sza...