Comment by treasy

If you look at the diagram of privsep, the authentication process is part of the privileged binary, which is where this RCE lives

http://www.citi.umich.edu/u/provos/ssh/priv.jpg