Format string vulnerability in Foundstone FScan 1.12 with banner grabbing enabled allows remote attackers to execute arbitrary code on the scanning system via format string specifiers in the server banner.
http://www.securityfocus.com/bid/4549
http://www.iss.net/security_center/static/8895.php