launchd 106 in Apple Mac OS X 10.4.x up to 10.4.1 allows local users to overwrite arbitrary files via a symlink attack on the socket file in an insecure temporary directory.
http://www.suresec.org/advisories/adv3.pdf
http://marc.info/?l=bugtraq&m=111833509424379&w=2
http://lists.apple.com/archives/security-announce/2005/Jun/msg00000.html