The vulnerability in ProFTPD versions 1.2pre1, 1.2pre3, and 1.2pre3 is a remotely exploitable buffer overflow. It is caused by a sprintf() function in the log_xfer() routine in src/log.c. The vulnerability in ProFTPD version 1.2pre4 is a mkdir overflow, where the name of the created path cannot exceed 255 characters. ProFTPD version 1.2pre6 limits the command buffer size to 512 characters in src/main.c and modifies the fix from version 1.2pre4.