Directory traversal vulnerability in the OBEX FTP Service in the Microsoft Bluetooth stack in Windows Mobile 6 Professional, and probably Windows Mobile 5.0 for Pocket PC and 5.0 for Pocket PC Phone Edition, allows remote authenticated users to list arbitrary directories, and create or read arbitrary files, via a .. (dot dot) in a pathname. NOTE: this can be leveraged for code execution by writing to a Startup folder.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2009-01-21T20:00:00
Updated: 2024-08-07T04:24:18.392Z
Reserved: 2009-01-21T00:00:00
Link: CVE-2009-0244
Vulnrichment
No data.
NVD
Status : Modified
Published: 2009-01-21T20:30:00.453
Modified: 2024-11-21T00:59:25.760
Link: CVE-2009-0244
Redhat
No data.