The vulnerability lies in the Common Desktop Environment (CDE) graphical user interface for *nix systems. There is a remotely exploitable buffer overflow flaw in the CDE Subprocess Control Service, known as 'dtspcd', which accepts requests from clients to execute commands and launch applications remotely.
http://www.vnunet.com/News/1128363