CVE-2009-0244 — HIGH (8.8) — White Hats Nepal

Vulnerability Description

Directory traversal vulnerability in the OBEX FTP Service in the Microsoft Bluetooth stack in Windows Mobile 6 Professional, and probably Windows Mobile 5.0 for Pocket PC and 5.0 for Pocket PC Phone Edition, allows remote authenticated users to list arbitrary directories, and create or read arbitrary files, via a .. (dot dot) in a pathname. NOTE: this can be leveraged for code execution by writing to a Startup folder.

CVSS Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Microsoft	Windows Mobile	5.0

Related Weaknesses (CWE)

CWE-22

References

http://secunia.com/advisories/33598Broken Link
http://securityreason.com/securityalert/4938Exploit
http://www.securityfocus.com/archive/1/500199/100/0/threadedBroken LinkThird Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/33359Broken LinkThird Party AdvisoryVDB Entry
http://www.seguridadmobile.com/windows-mobile/windows-mobile-security/Microsoft-Broken LinkExploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/48124Third Party AdvisoryVDB Entry
http://secunia.com/advisories/33598Broken Link
http://securityreason.com/securityalert/4938Exploit
http://www.securityfocus.com/archive/1/500199/100/0/threadedBroken LinkThird Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/33359Broken LinkThird Party AdvisoryVDB Entry
http://www.seguridadmobile.com/windows-mobile/windows-mobile-security/Microsoft-Broken LinkExploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/48124Third Party AdvisoryVDB Entry

FAQ

What is CVE-2009-0244?

CVE-2009-0244 is a vulnerability with a CVSS score of 8.8 (HIGH). Directory traversal vulnerability in the OBEX FTP Service in the Microsoft Bluetooth stack in Windows Mobile 6 Professional, and probably Windows Mobile 5.0 for Pocket PC and 5.0 for Pocket PC Phone E...

How severe is CVE-2009-0244?

CVE-2009-0244 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2009-0244?

Check the references section above for vendor advisories and patch information. Affected products include: Microsoft Windows Mobile.