Format string vulnerability in Pablo FTP Server 1.5 1.3 and possibly other versions allows remote attackers to cause a denial of service and possibly execute arbitrary code via format strings in the USER command.