(1.2 release is, however, and this should be pulled up and released ASAP)
The previous version (1.11) checked into current limits the duration of
setuid-root periods much more than the 1.2 released version does, so the
attacker DID get a shell, but it was not a root shell.
37449d45b0