Unknown vulnerability in UDP RPC for Solaris 2.5.1 through 9 for SPARC, and 2.5.1 through 8 for x86, allows remote attackers to cause a denial of service (memory consumption) via certain arguments in RPC calls that cause large amounts of memory to be allocated.
Directory traversal vulnerability in Sun Kodak Color Management System (KCMS) library service daemon (kcmsserver) allows remote attackers to read arbitrary files via the KCSOPENPROFILE procedure.
Unknown vulnerability in the System Serial Console terminal in Solaris 2.5.1, 2.6, and 7 allows local users to monitor keystrokes and possibly steal sensitive information.
Unknown vulnerability in NFS on Solaris 2.5.1 through Solaris 9 allows an NFS client to cause a denial of service by killing the lockd daemon.
Buffer overflow in mailx in Solaris 8 and earlier allows a local attacker to gain additional privileges via a long '-F' command line option.
Multiple TCP implementations could allow remote attackers to cause a denial of service (bandwidth and CPU exhaustion) by setting the maximum segment size (MSS) to a very small number and requesting large amounts of data, which generates more packets with less TCP-level data that amplify network traffic and consume more server CPU to process.
Denial of service in Solaris TCP streams driver via a malicious connection that causes the server to panic as a result of recursive calls to mutexenter.
The dynamic linker in Solaris allows a local user to create arbitrary files via the LDPROFILE environmental variable and a symlink attack.
sdtcmconvert in Solaris 2.6 allows a local user to overwrite sensitive files via a symlink attack.
In Sun Solaris and SunOS, man and catman contain vulnerabilities that allow overwriting arbitrary files.
Sun's ftpd daemon can be subjected to a denial of service.
Buffer overflow in BNU UUCP daemon (uucpd) through long hostnames.
Denial of Service vulnerability in BIND 8 Releases via maliciously formatted DNS messages.
Denial of Service vulnerabilities in BIND 4.9 and BIND 8 Releases via CNAME record and zone transfer.
Buffer overflow in SGI IRIX mailx program.
ICMP messages to broadcast addresses are allowed, allowing for a Smurf attack that can cause a denial of service.
Denial of service through Solaris 2.5.1 telnet by sending ^D characters.
DNS cache poisoning via BIND, by predictable query IDs.
Oversized ICMP ping packets can result in a denial of service, aka Ping o' Death.
Sendmail allows local users to write to a file and gain group permissions via a .forward or :include: file.