The default configuration of BenHur Firewall release 3 update 066 fix 2 allows remote attackers to access arbitrary services by connecting from source port 20.
https://euvd.enisa.europa.eu/vulnerability/EUVD-2002-2285
http://www.securityfocus.com/bid/5279
http://www.iss.net/security_center/static/9644.php
http://www.aerasec.de/security/advisories/txt/ae-200207-028-BenHur-activeFTPruleset.txt