Extra long export lists over 256 characters in some mount daemons allows NFS directories to be mounted by anyone.

Automount daemon automountd allows local or remote users to gain privileges via shell metacharacters.

Solaris ufsrestore buffer overflow.

The SunView (SunTools) selection_svc facility allows remote users to read files.

Solaris rpcbind can be exploited to overwrite arbitrary files and gain root access.

Multiple buffer overflows in how dtmail handles attachments allows a remote attacker to execute commands.

Local user gains root privileges via buffer overflow in rdist, via expstr() function.

Denial of Service vulnerabilities in BIND 4.9 and BIND 8 Releases via CNAME record and zone transfer.

Command execution in Sun systems via buffer overflow in the at program.

Buffer overflow in Solaris kcms_configure via a long NETPATH environmental variable.

NIS finger allows an attacker to conduct a denial of service via a large number of finger requests, resulting in a large number of NIS queries.

Solaris rpcbind listens on a high numbered UDP port, which may not be filtered since the standard port number is 111.

The NIS+ rpc.nisd server allows remote attackers to execute certain RPC calls without authentication to obtain system information, disable logging, or modify caches.

The dynamic linker in Solaris allows a local user to create arbitrary files via the LD_PROFILE environmental variable and a symlink attack.

Buffer overflow in BIND 8.2 via NXT records.

Denial of service in BIND named via malformed SIG records.

Denial of service in BIND by improperly closing TCP sessions via so_linger.

Buffer overflow in CDE dtmail and dtmailpr programs allows local users to gain privileges via a long -f option.

Buffer overflow in CDE mailtool allows local users to gain root privileges via a long MIME Content-Type.

The passwd command in Solaris can be subjected to a denial of service.