Luigi Auriemma has discovered a vulnerability in SurgeFTP, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to a NULL pointer dereference error when parsing HTTP headers. This can be exploited to crash an affected server via an overly large "Content-Length" HTTP header sent to the administration web server (by default port 7021/TCP).

The vulnerability is confirmed in version 2.3a1. Other versions may also be affected.

Solution
Restrict access to trusted users only.

Provided and/or discovered by
Luigi Auriemma

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://aluigi.altervista.org/adv/surgeftpizza-adv.txt

Deep Links
Links available to Secunia VIM customers