The dynamic linker in Solaris allows a local user to create arbitrary files via the LD_PROFILE environmental variable and a symlink attack.Referenceshttp://www.securityfocus.com/bid/659
