admintool in Solaris allows a local user to write to arbitrary files and gain root access.
sun solaris 2.5.1
sun solaris 2.5
sun sunos 5.5
sun sunos 5.5.1