The program ospf_monitor (which helps administrators monitor and control routers and other equipment that support the OSPF protocol) was found to be vulnerable to stack smashing (causing the program execute arbitrary code).
By executing ospf_monitor (that has setuid of root) with following parameter `perl -e'print "A"x1066'` you can cause it to crash. A malicious user could send a specially created code within the parameter, causing ospf_monitor to execute it, giving the user root shell access.
The bug was confirmed on FreeBSD 2.2.6 and Solaris 2.5.