Format string vulnerability in tcpflow when used in a setuid context allows local users to execute arbitrary code via the device name argument as demonstrated in Sustworks IPNetSentryX and IPNetMonitorX the setuid program RunTCPFlow.