provided by: 
Originally published at Internet.comBy Kurt Seifried (seifried@securityportal.com) for SecurityPortal -----------------------------------
FTP used to be the king of the Internet. If you wanted to download something you went to your favorite ftp server or used Archie to find the file. Even today, the number of ftp servers is staggering, and many ftp sites contain several hundred gigabytes of online archives (take a look at your local sunsite). FTP was built to be an extremely flexible protocol, and therein lie many of its problems. The FTP protocol not only allows you to transfer files from an ftp server to your machine but from one ftp server to another ftp server directly.
PASV Versus ACTIVE
The FTP protocol actually uses two channels for communications: a control channel and a data channel. The control channel uses tcp port 21. Clients connect to it from a local port (on Windows for example this is between 1024 and _1_5000 or so) and then send and receive information. When you request a file it is sent over the data channel which can behave in one of two ways.
With active ftp, the client specifies to the server how the transfer will be done. The client chooses a local port and tells the server to send data to it. The server initiates a connection from port 20 to the client and sends the data. The problems with this are numerous; the primary one being the firewalls must allow incoming connections from port 20 to a large selection of ports on internal machines. This allows attackers to easily scan internal machines by initiating connections from port 20...
Read article at Internet.com site