The way sharutils handles temporary files is insecure (as reported by the Debian BTS): http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=302412 The Debian bug contains a patch for this issue.
This issue should also affect RHEL2.1 and RHEL3
it's fixed in sharutils-4.2.1-8.9.x (RHEL2.1) and sharutils-4.2.1-16.2 (RHEL3)
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2005-377.html