http://www.exploit-db.com/exploits/8055/ says:
The telnet protocol allows to pass environment variables inside the telnet traffic and assign them to the other side of the tcp connection. The telnet daemon of FreeBSD 7.0-RELEASE does not check for LD_* (like LD_PRELOAD) environment variables prior to executing /bin/login. So passing an environment variable with the identifier LD_PRELOAD and the value of a precompiled library that is on the filesystem of the victims box that includes malicious code is possible. When /bin/login is executed with the user id and group id 0 ('root') it preloads the library that was set by remote connection through a telnet environment definition and executes it. It is unlikely that this bug can be exploited remotely but is not impossible. An attacker could f.e. upload a malicious library using ftp (including anonymous ftp users), nfs, smb or any other (file) transfer protocol. One scenario to exploit the bug remotely would be a ftp server running beside the telnet daemon serving also anoynmous users with write access. Then the attacker would upload the malicious library and defines the LD_PRELOAD variable to something similar to /var/ftp/mallib.so to gain remote root access.
So, if I create a new telnet and inetd under a non-super user, is this exploit not working? It seems so as /bin/login must be executed with the user id of root, but I am not sure if /bin/login is always executed as the user id of root...