Attack Scenarios: An attacker with local access must determine the memory offsets of the program's internal tTdvect variable and the location to which he or she wishes to have data written. The attacker must craft in architecture specific binary code the commands (or 'shellcode') to be executed with higher privilege. The attacker must then run the program, using the '-d' flag to overwrite a function return address with the location of the supplied shellcode.
Well that doesn't sound very scary - unless you don't trust your own users. We don't have one user that could write architecture specific binary code, other than myself and my director of programming.
Out of JALE on the this one.