Allegedly at one point Dennis Mumaugh over at the NSA had a list of UNIX security bugs that became classified.

Mike Muuss (and the rest of us BRLers)  decided not to request a copy because we figured we’d be better off not being constrained by knowing some bug we were disseminating information on (to other system adminsitrators) was classified.    We did have a little informal meeting with Dennis in the hall and ran through our list of known issues at the time.

My favorite isn’t so much a UNIX bug but a PDP-11 hardware bug.    It’s just that I think it may be impossible on a DEC operating system to create a program that manifests it (you have to fill your entire address space with SPL instructions).