PT-2009-2916 · Microsoft · Windows Mobile+1

Alberto Moreno Tablado · Publicado 2009-01-21 · Atualizado 2024-01-26 · CVE-2009-0244

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows Mobile versions 5.0 for Pocket PC and 5.0 for Pocket PC Phone Edition Windows Mobile 6 Professional

Description A directory traversal issue in the OBEX FTP Service of the Microsoft Bluetooth stack allows remote authenticated users to list arbitrary directories, create or read arbitrary files, via a .. (dot dot) in a pathname. This can be leveraged for code execution by writing to a Startup folder.

Recommendations For Windows Mobile 5.0 for Pocket PC and 5.0 for Pocket PC Phone Edition, restrict access to the OBEX FTP Service to minimize the risk of exploitation. For Windows Mobile 6 Professional, consider disabling the OBEX FTP Service until a patch is available. Avoid using the .. (dot dot) sequence in pathnames for the OBEX FTP Service until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2009-0244

Produtos afetados

Bluetooth

Windows Mobile

Referências · 8

• 🔥 http://securityreason.com/securityalert/4938 · Exploit
• 🔥 http://seguridadmobile.com/windows-mobile/windows-mobile-security/Microsoft-Bluetooth-Stack-Directory-Traversal.html · Exploit
• http://securityfocus.com/bid/33359 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-0244 · Nota de Segurança
• http://secunia.com/advisories/33598 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48124 · Nota
• https://t.me/cvenotify/68906 · Publicação no Telegram
• http://securityfocus.com/archive/1/500199/100/0/threaded · Nota