A race condition in nessus-adduser in Nessus 2.0.11 and possibly earlier versions, if the TMPDIR environment variable is not set, allows local users to gain privileges.
https://exchange.xforce.ibmcloud.com/vulnerabilities/16768
http://www.securityfocus.com/bid/10784
http://www.nessus.org/nessus_2_0.html