Atstake Security Advisory A041003-1 – MacOS X DirectoryService, which runs setuid as root, uses a system() to execute the touch command without properly using a full path. Due to this, a local attacker can execute commands as root.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/31015/a041003-1.txt
Source: https://packetstormsecurity.com/files/31015/Atstake-Security-Advisory-03-04-10.1.html