pt_chmod in Solaris 8 does not call fdetach to reset terminal privileges when users log out of terminals, which allows local users to write to other users' terminals by modifying the ACL of a TTY.
http://www.securityfocus.com/bid/3522
http://sunsolve.sun.com/search/document.do?assetkey=1-26-43929-1