That version restricts the port numbers to ports above 1024. However, it does not block access to third-party machines. V2.2-4, scheduled for release next week, will do that as well. This is done via a modification to our implementation of the PORT command. Work is currently underway to identify all affected systems.
Patches are forthcoming.
NCR Corporation NCR is delivering a set of operating system dependent patches which contain an update for this problem. After installation of the respective patch, the default behavior will be to protect from this vulnerability. A new ftpd man-page describe how to enable the old RFC compliant behavior. The OpenBSD project FTP bounce can be fixed in the operating system by fixing all vulnerable services by checking for connections from port 20. Since this has been done in OpenBSD, OpenBSD is not vulnerable and does NOT NEED the variable port command.