Allegedly at one point Dennis Mumaugh over at the NSA had a list of UNIX security bugs
that became classified.
Mike Muuss (and the rest of us BRLers) decided not to request a copy because we figured
we’d be better off not being constrained by knowing some bug we were disseminating
information on (to other system adminsitrators) was classified. We did have a little
informal meeting with Dennis in the hall and ran through our list of known issues at the
time.
My favorite isn’t so much a UNIX bug but a PDP-11 hardware bug. It’s just that I think
it may be impossible on a DEC operating system to create a program that manifests it (you
have to fill your entire address space with SPL instructions).