The client then writes the necessary files for printing using NFS, and informs the pcnfsd server that the files are ready for printing. The returned path name must be exported via to its clients by the NFS server. The NFS server and the pcnfsd server may be two separate machines. This means that the target of the symbolic link will be mode 777. Note that pcnfsd must run as root when servicing print requests so that it can assume the identity of the PC user when interacting with UNIX print commands.
Remote users can execute arbitrary commands on the machine where pcnfsd runs.
For the first vulnerability, local users can change the permissions on any file accessible to the local system that the root user can change. For the second vulnerability, remote users can execute arbitrary commands as root on the machine where pcnfsd runs. What this can lead to is bounded by the creativity of the intruder. Exploitation of these vulnerabilities is only part of a larger attack scenario. Once exploited, there are many pathologies that could follow.