rscsi in cdrtools 2.01 and earlier allows local users to overwrite arbitrary files and gain root privileges by specifying the target file as a command line argument, which is modified while rscsi is running with privileges.
http://www.secnetops.com/research/advisories/SRT2003-08-01-0126.txt