Race condition in the dircmp script in Sun Solaris 8 through 10 and OpenSolaris snv_01 through snv_111 allows local users to overwrite arbitrary files probably involving a symlink attack on temporary files.