in.mond in Sun Cluster 2.x allows local users to read arbitrary files via a symlink attack on the status file of a host running HA-NFS.
https://exchange.xforce.ibmcloud.com/vulnerabilities/6125
https://euvd.enisa.europa.eu/vulnerability/EUVD-2001-0078
http://archives.neohapsis.com/archives/bugtraq/2000-12/0180.html