Systems running ftpd are vulnerable.
As of the release date of this advisory, all past NetBSD releases, including NetBSD 1.5, are vulnerable. There was no limit placed on the number of matches returned. It used a stack-based buffer for storing pathnames, and the data transfers to this buffer did not enforce the end of buffer boundary. This vulnerability could lead to remote root compromise, through execution of arbitrary code in an overflowed buffer. You should replace it to fix the problem.