You might want to take a look at:
ftp://info.cert.org/pub/cert_advisories/CA-97.16.ftpd


NetBSD has fixed this problem and the patch is available
as noted within the advisory.