Screaming Penguin - Source Does Matter

NewsForge has more details on the recent kernel exploit that caused the owning of 4 debian project machines.

Note that the exploit has been seen "in the wild". Also note that even if you dont have any other users on your machines other than people you trust, if you use any type of clear text passwords (pop, imap, cvs, ftp, etc without TLS) then it would be TRIVIAL to sniff out a non priveleged account and then use that account to perform the escalation exploit.

Upgrade your machines, check for any binaries that have been changed and change your passwords.