CDE dtlogin in Caldera UnixWare 7.1.0, and possibly other operating systems, allows local users to gain privileges via a symlink attack on /var/dt/Xerrors since /var/dt is world-writable.
https://euvd.enisa.europa.eu/vulnerability/EUVD-2002-0105
http://www.securityfocus.com/bid/3818