KTH Kerberos IV allows local users to overwrite arbitrary files via a symlink attack on a ticket file.