COMMAND

    rexd

PROBLEM

    A request  for remote  command execution  contains, among  others,
    the command to be executed, and  a user and group id. By  default,
    the rexd server believes everything  that the client sends it.  An
    intruder can exploit the service  to execute commands as any  user
    (except perhaps root). The  typical rexd server has  no protection
    against abuse: most implementations  have no provision for  access
    control, nor  do they  require that  the client  uses a privileged
    network port.