About this question
I am reading Tanenbaum's Modern Operating Systems 3e. He says "Suppose that the program being attacked [with malicious code] is setuid root in UNIX (or has Administrator power in Windows). The [malicious code inserted with a buffer overflow attack] can now make a couple of system calls to convert the attacker's shell file on the disk into setuid root so that when it is executed it has superuser power."
What does it mean to be SETUID root? Does he mean that the program has root permissions? Why does he say that the program is setuid root? Is setuid root even safe?