Дыра в passwd(1) на Solaris:
The passwd command computes the hash of a password typed at run-time or the hash of each password in a list. A vulnerability exists in this command. PLATFORM: Solaris 8, 9 (SPARC and x86 Platforms) A local unprivileged user may be able to gain unauthorized root privileges due to a security issue involving the passwd(1) command.
>>> Подробности