Atstake Security Advisory A012704-1 – The version of TruBlueEnvironment that is shipped with Mac OS X 10.3.x and 10.2.x takes the value of an environment variable and copies it into a buffer without performing any bounds checking. Since this buffer is stored on the stack, it is possible to overwrite the return stack frame and execute arbitrary code as root.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/32578/a012704-1.txt
Source: https://packetstormsecurity.com/files/32578/Atstake-Security-Advisory-04-01-27.1.html