Sun Solaris 2.5

Solaris sysdef command allows local users to read kernel memory, potentially leading to root privileges.

Buffer overflow in Solaris chkperm command allows local users to gain root access via a long -n option.

ICMP messages to broadcast addresses are allowed, allowing for a Smurf attack that can cause a denial of service.

DNS cache poisoning via BIND, by predictable query IDs.

Sun's ftpd daemon can be subjected to a denial of service.

Buffer overflow in mailx in Solaris 8 and earlier allows a local attacker to gain additional privileges via a long '-F' command line option.

Buffer overflow in SGI IRIX mailx program.

Sendmail allows local users to write to a file and gain group permissions via a .forward or :include: file.

The dynamic linker in Solaris allows a local user to create arbitrary files via the LD_PROFILE environmental variable and a symlink attack.

Buffer overflow in BNU UUCP daemon (uucpd) through long hostnames.

sdtcm_convert in Solaris 2.6 allows a local user to overwrite sensitive files via a symlink attack.

Unspecified vulnerability in the XView library (libxview.so) in Solaris 2.5 to 10 allows local users to corrupt files via unknown vectors related to the handling of the clipboard selection while an XView application exits.

ping in Solaris 2.3 through 2.6 allows local users to cause a denial of service (crash) via a ping request to a multicast address through the loopback interface, e.g. via ping -i.

The access permissions for a UNIX domain socket are ignored in Solaris 2.x and SunOS 4.x, and other BSD-based operating systems before 4.4, which could allow local users to connect to the socket and possibly disrupt or control the operations of the program using that socket.

The finger daemon (in.fingerd) in Sun Solaris 2.5 through 8 and SunOS 5.5 through 5.8 allows remote attackers to list all accounts on a host by typing finger 'a b c d e f g h'@host.

Solaris ff.core allows local users to modify files.