Unknown vulnerability in Mac OS X 10.3.9 allows local users to gain privileges via (1) chfn, (2) chpass, and (3) chsh, which "use external helper programs in an insecure manner."
http://www.us-cert.gov/cas/techalerts/TA05-136A.html
http://www.kb.cert.org/vuls/id/331694
http://lists.apple.com/archives/security-announce/2005/May/msg00001.html