The finger daemon that ships with dgux will allow a remote user to pipe commands, often with uid root or bin.