Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Windows Mobile OBEX FTP Service lets attacker read/write files

CVE-2009-0244 · published 17 years ago
Summary

The OBEX file‑transfer service in Windows Mobile 6 Professional (and likely Windows Mobile 5.0 Pocket PC editions) can be tricked by an authenticated remote user into navigating outside its intended folder using ".." in a path. This lets the attacker list any directory and create or read any file, including placing malicious code in the Startup folder. Apply any available updates from Microsoft and restrict Bluetooth file‑transfer use to trusted devices.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
microsoft windows_mobile 5.0
6.0
cpe:2.3:o:microsoft:windows_mobile:5.0:*:*:*:*:*:*:*
Original advisory text
Directory traversal vulnerability in the OBEX FTP Service in the Microsoft Bluetooth stack in Windows Mobile 6 Professional, and probably Windows Mobile 5.0 for Pocket PC and 5.0 for Pocket PC Phon...
Directory traversal vulnerability in the OBEX FTP Service in the Microsoft Bluetooth stack in Windows Mobile 6 Professional, and probably Windows Mobile 5.0 for Pocket PC and 5.0 for Pocket PC Phone Edition, allows remote authenticated users to list arbitrary directories, and create or read arbitrary files, via a .. (dot dot) in a pathname. NOTE: this can be leveraged for code execution by writing to a Startup folder.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.8 High
Exploitation
30% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published21 Jan 2009
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2009-0244 · NVD
Track software like this
Free during beta