Stack-based buffer overflow in (1) backupsh and (2) authsh in SCO Openserver 5.0.7 allows local users to execute arbitrary code via a long HOME environment variable.
http://www.securityfocus.com/bid/15160
http://www.idefense.com/application/poi/display?type=vulnerabilities