Since the client is unprivileged, there is no possibility for the legitimate stderr stream to be destined for a privileged port. In addition, spoofing techniques could allow the client to direct the stderr stream towards an arbitrary host as well as an arbitrary port, possibly exploiting a given trust model. Since rexecd terminates if the stderr port can't be connected to, and the port can be specified, rexecd can be used to easily scan the client host from the server host. Duplicated slack coding style. Needs to be a prog because shells strip out nulls.
Similar fixes go for rshd.