see the recently-released security advisory: ftp://ftp.netbsd.org/pub/NetBSD/misc/security/advisories/NetBSD-SA2000-018.txt.asc The 1.4 and 1.5 branches have been patched post-release; to fix, you need to update to the latest ftpd on the release branch or apply the patches referenced in the advisory. - Bill