SunOS rpc.cmsd allows attackers to obtain root access by overwriting arbitrary files.
The AIX FTP client can be forced to execute commands from a malicious server through shell metacharacters (e.g. a pipe character).
NFS cache poisoning.
Buffer overflow of rlogin program using TERM environmental variable.
Buffer overflow in syslog utility allows local or remote attackers to gain root privileges.