The remote host is missing an update to proftpd announced via advisory DSA 795-2.

https://secure1.securityspace.com/smysecure/catid.html?in=DSA%20795-2

infamous42md reported that proftpd suffers from two format string vulnerabilities. In the first, a user with the ability to create a directory could trigger the format string error if there is a proftpd shutdown message configured to use the %C, %R, or %U variables. In the second, the error is triggered if mod_sql is used to retrieve messages from a database and if format strings have been inserted into the database by a user with permission to do so. There was a build error for the sarge i386 proftpd packages released in DSA 795-1. A new build, 1.2.10-15sarge1.0.1, has been prepared to correct this error. The packages for other architectures are unaffected.