Ftp(1) can be made to execute arbitrary commands by a malicious webserver

This seems nasty, I don't use OSX but does this mean they are all vulnerable?