The generatesmbnt_hash function in include/functions.inc in GOsa allows remote attackers to execute arbitrary commands via a crafted password.