Solaris 2.4 pop buffer overrun

[julio.casal () SERVICOM ES (Julio Casal)]

An old one I guess known but I never saw it in the list:

Solaris 2.4 popper has an overflow in the username explotaible obviously
as root.
It's also easy to get root's shadow entry in the core dumped just failing to
log as root before overruning the username.

Cheers,
Julio.