The labeled networking implementation in Solaris Trusted Extensions in Sun Solaris 10 and OpenSolaris snv_39 through snv_67, when a labeled zone is in the installed state, allows remote authenticated users to bypass a Mandatory Access Control (MAC) policy and obtain access to the global zone.
http://www.securityfocus.com/bid/30602
http://sunsolve.sun.com/search/document.do?assetkey=1-26-240099-1