Standard disclaimer applies. No, I'm not saying commercial software is particularly less secure than GPL code, and not saying specific vendor is writing code less secure than other vendors. The most alarming thing is that some of commercial vendors really focused on security, but we have no way to distinguish them from those giving vague promises.
Commercial vendors have to solve the problem together.
But, of course, it only my humble point of view. It's a DoS, because single-threaded server crashes. But no matter - it's trivially exploitable. Simple retaddr overwrite bug, input buffer is not stripped, there's no any kind of character validation. Local access with daemon privledges can be gained, allowing futher privledge escalation.