Solaris Solstice AdminSuite (AdminSuite) 2.1 and 2.2 allows local users to gain privileges via the save option in the Database Manager, which is running with setgid bin privileges.
http://www.securityfocus.com/bid/208
http://sunsolve.sun.com/pub-cgi/retrieve.pl?doctype=coll&doc=secbull/145