In Ultrix versions 4.0 and 4.1, the /usr/bin/chroot binary is installed with improper permissions, allowing any user to execute it. This can lead to system users gaining unauthorized privileges. An attacker can create a fake root environment in /tmp/etc and /tmp/bin, copy the /bin/sh and /bin/chmod binaries to the fake environment, and then execute the chroot binary to gain root access. The attacker can then use the chmod binary to set the suid bit on the /tmp/bin/sh binary, allowing them to gain root access.