diff -Nur smeserver-vacation-1.1.old/root/usr/share/perl5/vendor_perl/esmith/FormMagick/Panel/uservacations.pm smeserver-vacation-1.1/root/usr/share/perl5/vendor_perl/esmith/FormMagick/Panel/uservacations.pm
--- smeserver-vacation-1.1.old/root/usr/share/perl5/vendor_perl/esmith/FormMagick/Panel/uservacations.pm	2017-01-16 16:12:48.728000000 -0500
+++ smeserver-vacation-1.1/root/usr/share/perl5/vendor_perl/esmith/FormMagick/Panel/uservacations.pm	2017-01-16 16:32:49.593000000 -0500
@@ -414,14 +414,33 @@
     $vacation_text =~ s/\r//g;
 
     unlink $vfile;
+    # for the next lines to avoid race condition vulnerability, we switch the effective user to 
+    # the one needed see SME #9073 . Those 4 lines are for explanation of the used variables.
+    #$< - real user id (uid); unique value
+    #$> - effective user id (euid); unique value
+    #$( - real group id (gid); list (separated by spaces) of groups
+    #$) - effective group id (egid); list (separated by spaces) of groups
+
+    # remember the UID of the user currently running this script
+    my $original_uid = $>;
+    my $original_gid = $);
+
+    # switch effective UID running this script to $user
+    # in order to prevent race condition vulnerability
+    my $uid = getpwnam($user) or die "Could not get UID for $user\n";
+    my $gid = getgrnam($user) or die "Could not get GID for $user\n";
+    $) = $gid;# should be switched first while still root!
+    $> = $uid;
+
     open (VACATION, ">$vfile")
       or die ("Error opening vacation message.\n");
 
     print VACATION "$vacation_text";
     close VACATION;
 
-    esmith::util::chownFile($user, $user,
-    "/home/e-smith/files/users/$user/.vacation.msg");
+    # switch effective UID and GID back to original user
+    $> = $original_uid;
+    $) = $original_gid;
 
     $adb->set_prop($user, 'EmailVacation', $EmailVacation);
     $adb->set_prop($user, 'EmailVacationFrom', $EmailVacationFrom);