BMC PATROL SNMP Agent before 3.2.07 allows local users to create arbitrary world-writeable files as root by specifying the target file as the second argument to the snmpmagt program.
https://euvd.enisa.europa.eu/vulnerability/EUVD-1999-1441
http://www.securityfocus.com/bid/525