Potentially all versions running setuid root. This buffer is on the stack, and can therefore be used to execute arbitrary instructions.
Local users can obtain superuser privileges.
A program was developed to verify this bug on a SunOS 4.1.3 machine, and succeeded in obtaining a shell running uid 0 from rdist. 1996, Electris Software Limited, All Rights Reserved. Use a version of rdist that does not require setuid root privileges. Obtain a patch from your vendor. This will contain updates on any further versions which are found to be vulnerable, and any other information received pertaining to this advisory.