Steve Bellovin wrote:

> There's been a fair amount of discussion on bugtraq about a security 
> hole in wu-ftpd.  It's not part of NetBSD, but it is in the package 
> collection and it's pretty popular...

There's also been some discussion about the OpenBSD port of ftpd being 
vulnerable on Linux.  FreeBSD said their ftpd is not vulnerable, OpenBSD 
said the same.  So I guess this has to do with the glob implementation, 
and it looks like *BSD's is different then Linux's.

# uname -srm
NetBSD 1.5X i386


# ftp localhost
220 localhost FTP server (NetBSD-ftpd 20010627) ready.
Name (localhost:root): emre
331 Password required for emre.
Password:
230-
230 User emre logged in.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls ~{
229 Entering Extended Passive Mode (|||63120|)
150 Opening ASCII mode data connection for '/bin/ls'.
226 Transfer complete.
ftp>