a buffer overflow in /bin/df on Irix 5.3, 6.2 and 6.3. /bin/df is installed suid root and hence root access is achievable for local users.