Is the ethereum.org/dao contract vulnerable to recursive call attacks?

Question

Does putting p.executed = true after p.recipient.call() make this vulnerable to recursive calls?

function executeProposal(uint proposalNumber, bytes transactionBytecode) returns (int result) {
    Proposal p = proposals[proposalNumber];
    if (p.executed) throw;

    p.recipient.call.value(p.amount)(transactionBytecode);

    p.executed = true;

From ethereum.org/dao

Answer 1

Yes!
the attacker would have to use a call in his wallets fallback function and call the function again so he will be able to detract the money within the same recursion call, before p.executed = true.