aspppd on Solaris 2.5 x86 allows local users to modify arbitrary files and gain root privileges via a symlink attack on the /tmp/.asppp.fifo file.
The WorkMan program can be used to overwrite any file to get root access.
vold in Solaris 2.x allows local users to gain root access.
Kodak Color Management System (KCMS) on Solaris allows a local user to write to arbitrary files and gain root access.
admintool in Solaris allows a local user to write to arbitrary files and gain root access.
A race condition in the Solaris ps command allows an attacker to overwrite critical files.
rmmount in SunOS 5.7 may mount file systems without the nosuid flag set, contrary to the documentation and its use in previous versions of SunOS, whi…
Sun/Solaris utmp file allows local users to gain root access if it is writable by users other than root.
Extra long export lists over 256 characters in some mount daemons allows NFS directories to be mounted by anyone.
In Solaris 2.2 and 2.3, when fsck fails on startup, it allows a local user with physical access to obtain root access.
Denial of service by sending forged ICMP unreachable packets.
The portmapper may act as a proxy and redirect service requests from an attacker, making the request appear to come from the local host, possibly byp…
The SunView (SunTools) selection_svc facility allows remote users to read files.
Certain NFS servers allow users to use mknod to gain privileges by creating a writable kmem device and setting the UID to 0.