The dynamic linker in Solaris allows a local user to create arbitrary files via the LDPROFILE environmental variable and a symlink attack.

sdtcmconvert in Solaris 2.6 allows a local user to overwrite sensitive files via a symlink attack.

ICMP messages to broadcast addresses are allowed, allowing for a Smurf attack that can cause a denial of service.

In Sun Solaris and SunOS, man and catman contain vulnerabilities that allow overwriting arbitrary files.

Buffer overflow in BNU UUCP daemon (uucpd) through long hostnames.

Sendmail allows local users to write to a file and gain group permissions via a .forward or :include: file.

Oversized ICMP ping packets can result in a denial of service, aka Ping o' Death.

Buffer overflow in SGI IRIX mailx program.

Sun's ftpd daemon can be subjected to a denial of service.

DNS cache poisoning via BIND, by predictable query IDs.

Delete or create a file via rpc.statd, due to invalid information.

Denial of Service vulnerability in BIND 8 Releases via maliciously formatted DNS messages.

Denial of Service vulnerabilities in BIND 4.9 and BIND 8 Releases via CNAME record and zone transfer.

Buffer overflow in mailx in Solaris 8 and earlier allows a local attacker to gain additional privileges via a long '-F' command line option.

Unknown vulnerability in NFS on Solaris 2.5.1 through Solaris 9 allows an NFS client to cause a denial of service by killing the lockd daemon.