The glob functionality in ProFTPD 1.2.1 and possibly other versions allows remote attackers to cause a denial of service (CPU and memory consumption) via commands with large numbers of wildcard and other special characters as demonstrated using an ls command with multiple (1) \*/..\ (2) \*/.*\ or (3) \.*./*?/\ sequences in the argument.