Solaris 2.4 before kernel jumbo patch -35 allows set-gid programs to dump core even if the real user id is not in the set-gid group, which allows local users to overwrite or create files at higher privileges by causing a core dump, e.g. through dmesg.
The dynamic linker in Solaris allows a local user to create arbitrary files via the LDPROFILE environmental variable and a symlink attack.
ICMP messages to broadcast addresses are allowed, allowing for a Smurf attack that can cause a denial of service.
In Sun Solaris and SunOS, man and catman contain vulnerabilities that allow overwriting arbitrary files.
Buffer overflow in BNU UUCP daemon (uucpd) through long hostnames.
A race condition in the Solaris ps command allows an attacker to overwrite critical files.
Kerberos 4 key servers allow a user to masquerade as another by breaking and generating session keys.
Sendmail allows local users to write to a file and gain group permissions via a .forward or :include: file.
Oversized ICMP ping packets can result in a denial of service, aka Ping o' Death.
Sun's ftpd daemon can be subjected to a denial of service.
DNS cache poisoning via BIND, by predictable query IDs.
Delete or create a file via rpc.statd, due to invalid information.
Denial of Service vulnerability in BIND 8 Releases via maliciously formatted DNS messages.
Denial of Service vulnerabilities in BIND 4.9 and BIND 8 Releases via CNAME record and zone transfer.