in.mond in Sun Cluster 2.x allows local users to read arbitrary files via a symlink attack on the status file of a host running HA-NFS.
https://exchange.xforce.ibmcloud.com/vulnerabilities/6125
http://archives.neohapsis.com/archives/bugtraq/2000-12/0180.html