admintool in Solaris allows a local user to write to arbitrary files and gain root access.
CVSS Metrics