CVE-2009-0244

Directory traversal vulnerability in the OBEX FTP Service in the Microsoft Bluetooth stack in Windows Mobile 6 Professional, and probably Windows Mobile 5.0 for Pocket PC and 5.0 for Pocket PC Phone Edition, allows remote authenticated users to list arbitrary directories, and create or read arbitrary files, via a .. (dot dot) in a pathname. NOTE: this can be leveraged for code execution by writing to a Startup folder.

• CWE-22

• http://secunia.com/advisories/33598Broken Link
• http://securityreason.com/securityalert/4938Exploit
• http://www.securityfocus.com/archive/1/500199/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/33359Broken Link, Third Party Advisory, VDB Entry
• http://www.seguridadmobile.com/windows-mobile/windows-mobile-security/Microsoft-Bluetooth-Stack-Directory-Traversal.htmlBroken Link, Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48124Third Party Advisory, VDB Entry
• http://secunia.com/advisories/33598Broken Link
• http://securityreason.com/securityalert/4938Exploit
• http://www.securityfocus.com/archive/1/500199/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/33359Broken Link, Third Party Advisory, VDB Entry
• http://www.seguridadmobile.com/windows-mobile/windows-mobile-security/Microsoft-Bluetooth-Stack-Directory-Traversal.htmlBroken Link, Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48124Third Party Advisory, VDB Entry

Published

Jan 21, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-0238Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 200…8.8
• CVE-2009-0239Cross-site scripting (XSS) vulnerability in Windows Search 4…
• CVE-2009-0240listing.php in WebSVN 2.0 and possibly 1.7 beta, when using …
• CVE-2009-0241Stack-based buffer overflow in the process_path function in …
• CVE-2009-0242Rejected reason: gmetad in Ganglia 3.1.1, when supporting mu…
• CVE-2009-0243Microsoft Windows does not properly enforce the Autorun and …
• CVE-2009-0245Cross-site scripting (XSS) vulnerability in Usagi Project My…
• CVE-2009-0246Stack-based buffer overflow in easyHDR PRO 1.60.2 allows use…
• CVE-2009-0247The server for 53KF Web IM 2009 Home, Professional, and Ente…
• CVE-2009-0248Cross-site scripting (XSS) vulnerability in rankup.asp in Ka…
• CVE-2009-0249Katy Whitton RankEm stores sensitive information under the w…
• CVE-2009-0250Ryneezy phoSheezy 0.2 stores sensitive information under the…