The vulnerability lies within the prwarn utility in SCO UNIX 4.2 and earlier. The root cause is likely a buffer overflow or a similar memory corruption vulnerability. The prwarn utility, when processing user-supplied input, fails to properly validate the size of the input before writing it to a fixed-size buffer. This allows an attacker to overwrite adjacent memory locations, potentially overwriting critical data structures or the return address of the function. By carefully crafting the input, an attacker can overwrite the return address with the address of malicious code (e.g., a shellcode) that grants root privileges. The exact mechanism would depend on the specific implementation of prwarn and the system's memory layout, but the core issue is a lack of bounds checking and improper input validation.