IBM AIX 4.1

Denial of service in AIX telnet can freeze a system and prevent users from accessing the server.

Jolt ICMP attack causes a denial of service in Windows 95 and Windows NT systems.

Vulnerability in AIX 3.2.x and 4.x allows local users to gain write access to files on locally or remotely mounted AIX filesystems.

Sendmail allows local users to write to a file and gain group permissions via a .forward or :include: file.

AIX piodmgrsu command allows local users to gain additional group privileges.

Vulnerability in ptrace in AIX 4.3 allows local users to gain privileges by attaching to a setgid program.

Vulnerability in AIX 4.1.4 and HP-UX 10.01 and 9.05 allows local users to cause a denial of service (crash) by using a socket to connect to a port on the localhost, calling shutdown to clear the socket, then using the same socket to connect to a different port on localhost.

lquerypv in AIX 4.1 and 4.2 allows local users to read arbitrary files by specifying the file in the -h command line parameter.

pcnfsd (aka rpc.pcnfsd) allows local users to change file permissions, or execute arbitrary commands through arguments in the RPC call.

sadc in IBM AIX 4.1 through 4.3, when called from programs such as timex that are setgid adm, allows local users to overwrite arbitrary files via a symlink attack.