PT-2009-2916 · Microsoft · Windows Mobile+1

Alberto Moreno Tablado · Published 2009-01-21 · Updated 2024-01-26 · CVE-2009-0244

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows Mobile versions 5.0 for Pocket PC and 5.0 for Pocket PC Phone Edition Windows Mobile 6 Professional

Description A directory traversal issue in the OBEX FTP Service of the Microsoft Bluetooth stack allows remote authenticated users to list arbitrary directories, create or read arbitrary files, via a .. (dot dot) in a pathname. This can be leveraged for code execution by writing to a Startup folder.

Recommendations For Windows Mobile 5.0 for Pocket PC and 5.0 for Pocket PC Phone Edition, restrict access to the OBEX FTP Service to minimize the risk of exploitation. For Windows Mobile 6 Professional, consider disabling the OBEX FTP Service until a patch is available. Avoid using the .. (dot dot) sequence in pathnames for the OBEX FTP Service until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2009-0244

Affected Products

Bluetooth

Windows Mobile

References · 8

• 🔥 http://securityreason.com/securityalert/4938 · Exploit
• 🔥 http://seguridadmobile.com/windows-mobile/windows-mobile-security/Microsoft-Bluetooth-Stack-Directory-Traversal.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-0244 · Security Note
• http://securityfocus.com/bid/33359 · Note
• http://secunia.com/advisories/33598 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48124 · Note
• https://t.me/cvenotify/68906 · Telegram Post
• http://securityfocus.com/archive/1/500199/100/0/threaded · Note