Race condition in shtool 2.0.1 and earlier allows local users to create or modify arbitrary files via a symlink attack on the .shtool.$$ temporary file. http://www.zataz.net/adviso/shtool-05252005.txt php contains shtool in its source.
This issue should also affect RHEL2.1 and RHEL3
*** This bug has been marked as a duplicate of 159000 ***