VR13, released January 28, 1999. The bug was reproducible only on a libc5 Linux system. The Linux glibc version of NcFTPd 2.3.4 ftp server is NOT vulnerable. NcFTPd 2.3.5 or later. Affected users may upgrade free of charge to the latest version.
All versions ARE vulnerable.
The md5 checksums are current for the above mentioned Revision date only. OpenServer Versions 5.0.5 and earlier IS vulnerable. 4.3.x ARE NOT vulnerable. HPUX Versions 10.x and 11.x ARE NOT vulnerable. HP is continuing their investigation.