Users can't change their NIS passwords when old SunOS aging is active and the new pam modules (passwd_auth instead of pam_unix) are being used.
The command "passwd" (as well as "passwd -r nis") aborts due to incorrect password although the correct old password has been eneterd:
$ passwd -r nis
passwd: Changing password for ....
Enter existing login passwod:
passwd: Sorry, wrong passwd
Permission denied
This only affects users in the NIS repository which do have old SunOS password aging information (the crypted password entry has an additional , and 2-4 chars at the end representing the password aging information). See comments for details.
Work Around
Edit /etc/pam.conf and replace the exiting entry "passwd auth required pam_passwd_auth.so.1" by "passwd auth required pam_unix.so.1" to use the old/obsolete pam_unix implementation.