Baby FTP Server (BabyFTP) 1.2 and possibly other versions before May 31 2003 allows remote attackers to cause a denial of service via a large number of connections from the same IP address which triggers an access violation.