rdist in various UNIX systems uses popen to execute sendmail, which allows local users to gain root privileges by modifying the IFS (Internal Field Separator) variable.
Vulnerability in restore in SunOS 4.0.3 and earlier allows local users to gain privileges.
Malicious option settings in UDP packets could force a reboot in SunOS 4.1.3 systems.
The SunView (SunTools) selectionsvc facility allows remote users to read files.