scoadmin for Caldera/SCO OpenServer 5.0.5 and 5.0.6 allows local users to overwrite arbitrary files via a symlink attack on temporary files, as demonstrated using log files.
https://euvd.enisa.europa.eu/vulnerability/EUVD-2002-0879
http://www.securityfocus.com/bid/4875