BMC PATROL Agent prior to 3.2.07 allows local users to gain root privileges via a symlink attack on a temporary file.
bmc patrol agent 3.2
bmc patrol agent 3.2.3