EDIT: Since I got modded down for saying this, try to Google for it. There are less than 300 hits for "localhost vulnerability," with this article leading the charge. It's simply a mistake by someone who doesn't know the terminology.
It could have been some weird IP spoofing attack where the host gets confused and thinks a remote connection is actually localhost and grants it some privilege or other.
For example maybe you have a ton of services setup to only listen on localhost:port. Maybe there's some exploit that allows connections from outside.
That's what the title sounds like to me, which is quite different.
anyway.
I'm guessing you got downmodded because nobody cares, although being wrong couldn't have helped.
A short time ago a "local root" exploit was posted to the full-disclosure mailing list;
You don't know what you're talking about. This exploit appears to give local users root privileges, making it a local root exploit exactly as the security advisory states.
The phrase "localhost vulnerability" remains meaningless techno-babble. Localhost refers to a network address and this exploit appears to have nothing to do with that.
I would bet pretty good money that he does:-)
He has claimed that "localhost vulnerability" was the term used on the OpenBSD list in the 1990s. Why don't you try to find it there: http://emailthreads.org/list/openbsd-security-announce.en.ht...
The bet is over when I demonstrate to you that (a) I didn't invent the term "localhost vulnerability", much as I wish I had, and (b) this vulnerability isn't strictly a "root" vulnerability. I'll withhold any further description in the interests of routing money from your bank account to a deserving charity, and I will match any dollar amount that davidw agrees to.
Did you even read the exploit code? He's figured out a way to overwrite LD_PRELOAD environment variable for anything SUID. That means that you get to tell the binary to load libraries other than what it planned on loading. And hence run arbitrary code.
This has nothing to do with "localhost." If you'd like to give examples of people using "localhost vulnerability" in the past, go right ahead and link to them.