Very simple, script (when executed as root) overwrites hardlinks that could be set by any user to any file on the harddisk. For instance, a malicious user can place a hardlink 'typescript' to /etc/passwd (or any other file) in his home directory. If the root user would execute script in that directory it would cause script to overwrite that file. Script does check for symlinks and asks if the symlink should be overwritten, it lacks checking hardlinks. http://archives.neohapsis.com/archives/bugtraq/2001-12/0119.html
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2005-782.html