CVE-2009-0244

HighCVSS 8.8/10Last modified Jun 16, 2026

Description

Directory traversal vulnerability in the OBEX FTP Service in the Microsoft Bluetooth stack in Windows Mobile 6 Professional, and probably Windows Mobile 5.0 for Pocket PC and 5.0 for Pocket PC Phone Edition, allows remote authenticated users to list arbitrary directories, and create or read arbitrary files, via a .. (dot dot) in a pathname. NOTE: this can be leveraged for code execution by writing to a Startup folder.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/33598Broken Link
http://securityreason.com/securityalert/4938Exploit
http://www.securityfocus.com/archive/1/500199/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/33359Broken Link, Third Party Advisory, VDB Entry
http://www.seguridadmobile.com/windows-mobile/windows-mobile-security/Microsoft-Bluetooth-Stack-Directory-Traversal.htmlBroken Link, Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/48124Third Party Advisory, VDB Entry
http://secunia.com/advisories/33598Broken Link
http://securityreason.com/securityalert/4938Exploit
http://www.securityfocus.com/archive/1/500199/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/33359Broken Link, Third Party Advisory, VDB Entry
http://www.seguridadmobile.com/windows-mobile/windows-mobile-security/Microsoft-Bluetooth-Stack-Directory-Traversal.htmlBroken Link, Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/48124Third Party Advisory, VDB Entry

Timeline

Published: Jan 21, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-02454.3Cross-site scripting (XSS) vulnerability in Usagi Project MyNETS 1.2.0.1 and earlier allows remote attackers to inject arbitrary web script CVE-2009-02469.3Stack-based buffer overflow in easyHDR PRO 1.60.2 allows user-assisted attackers to execute arbitrary code via an invalid Radiance RGBE (aka CVE-2009-02474.3The server for 53KF Web IM 2009 Home, Professional, and Enterprise editions relies on client-side protection mechanisms against cross-site s CVE-2009-02484.3Cross-site scripting (XSS) vulnerability in rankup.asp in Katy Whitton RankEm allows remote attackers to inject arbitrary web script or HTML CVE-2009-02495.0Katy Whitton RankEm stores sensitive information under the web root with insufficient access control, which allows remote attackers to downl CVE-2009-02505.0Ryneezy phoSheezy 0.2 stores sensitive information under the web root with insufficient access control, which allows remote attackers to dow CVE-2009-02516.5Static code injection vulnerability in admin.php in Ryneezy phoSheezy 0.2 allows remote authenticated administrators to inject arbitrary PHP CVE-2009-02527.5Multiple SQL injection vulnerabilities in default.asp in Enthrallweb eReservations allow remote attackers to execute arbitrary SQL commands CVE-2009-02536.8Mozilla Firefox 3.0.5 allows remote attackers to trick a user into visiting an arbitrary URL via an onclick action that moves a crafted elem CVE-2009-02549.3Stack-based buffer overflow in easyHDR PRO 1.60.2 allows user-assisted attackers to execute arbitrary code via an invalid Flexible Image Tra CVE-2009-02557.5The System extension Install tool in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 creates the encryption key with CVE-2009-02567.5Session fixation vulnerability in the authentication library in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allo