Buffer overflow in Solaris kcms_configure command allows local users to gain root access.

In Solaris 2.2 and 2.3, when fsck fails on startup, it allows a local user with physical access to obtain root access.

Buffer overflow in the libauth library in Solaris allows local users to gain additional privileges, possibly root access.

The Sun sdtcm_convert calendar utility for OpenWindows has a buffer overflow which can gain root access.

In Sun Solaris and SunOS, man and catman contain vulnerabilities that allow overwriting arbitrary files.

Solaris ff.core allows local users to modify files.

rpc.statd allows remote attackers to forward RPC calls to the local operating system via the SM_MON and SM_NOTIFY commands, which in turn could be used to remotely exploit other bugs such as in automountd.

A Unix account has a default, null, blank, or missing password.

ICMP messages to broadcast addresses are allowed, allowing for a Smurf attack that can cause a denial of service.

rpc.admind in Solaris is not running in a secure mode.

The BSD profil system call allows a local user to modify the internal data space of a program via profiling and execve.

sdtcm_convert in Solaris 2.6 allows a local user to overwrite sensitive files via a symlink attack.

The ToolTalk ttsession daemon uses weak RPC authentication, which allows a remote attacker to execute commands.

The CDE dtspcd daemon allows local users to execute arbitrary commands via a symlink attack.

Buffer overflow in the AddSuLog function of the CDE dtaction utility allows local users to gain root privileges via a long user name.

Buffer overflow in CDE Calendar Manager Service Daemon (rpc.cmsd).

Buffer overflow in Solaris libc, ufsrestore, and rcp via LC_MESSAGES environmental variable.

Buffer overflow in Solaris lpset program allows local users to gain root access.

The dynamic linker in Solaris allows a local user to create arbitrary files via the LD_PROFILE environmental variable and a symlink attack.

The NIS+ rpc.nisd server allows remote attackers to execute certain RPC calls without authentication to obtain system information, disable logging, or modify caches.