The IFS bug: the IFS shell variable contains a list of characters
be treated like whitespace by a shell when parsing command names. By
changing the IFS variable to contain the "/" character, the command
"/bin/true" becomes "bin true".
All you need do is export the modified IFS variable, install a
called "bin" in your path, and run a setuid script which calls
"/bin/true". Then "bin" will be executed whilst setuid.