Description of problem:
The Diatheke CGI allows arbitrary command execution in the context of the webserver, e.g. www-data by simply abusing the range parameter.
For example, &range=yes will consume tons of resources on the affected webserver. Escalation of privleges and command shells are left as an exercise to the reader.
From Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=466449