SSH 2.0.11 and previous versions allows local users to request remote forwarding from privileged ports without being root.
ssh ssh2 2.0.11