A security vulnerability in the way the rcp(1) command invokes helper applications may allow a local unprivileged user (or a remote user in the case of shared filesystems) to create files with specially crafted file names which could lead to the execution of arbitrary commands with the privileges of a local user when that local user executes the rcp(1) command on the specially crafted file names.

Note: The scp(1) utility is also affected by this issue which is described in the following documents:

CVE-2006-0225 at: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0225

Sun Alert 102961 at: http://sunsolve.sun.com/search/document.do?assetkey=1-26-102961-1