HPUX sysdiag allows local users to gain root privileges via a symlink attack during log file creation.
hp hp-ux 9.04
hp hp-ux 9.05