CVE-2009-0244 | Windows Mobile - Bluetooth Stack Operational Intel

Executive Risk Summary

"A directory traversal vulnerability exists in the Microsoft Bluetooth stack in Windows Mobile, allowing remote authenticated users to list arbitrary directories, create or read arbitrary files, and potentially execute code by writing to a Startup folder. This vulnerability can be exploited by sending a malicious OBEX FTP request with a .. (dot dot) in a pathname."

Anticipated Attack Path

1. Send a malicious OBEX FTP request with a .. (dot dot) in a pathname
2. Traverse directories and read or create arbitrary files
3. Write to a Startup folder to achieve code execution

Am I Vulnerable?

Verify if the device is running Windows Mobile 6 Professional, 5.0 for Pocket PC, or 5.0 for Pocket PC Phone Edition
Check for the presence of the Microsoft Bluetooth stack
Monitor for suspicious OBEX FTP requests

Operational Audit Arsenal

Target Type Service

Target Asset bthsvcs.exe

Standard Path Windows Mobile device

PowerShell

# 🛠️ Senior Engineer Universal Audit
# Target: bthsvcs.exe (Service)
$Targets = 'bthsvcs.exe'
$SearchPaths = @("$env:windir\System32", "$env:ProgramFiles", "${env:ProgramFiles(x86)}")

Get-ChildItem -Path $SearchPaths -Include $Targets -Recurse -ErrorAction SilentlyContinue | 
Select-Object FullName, @{Name="Version";Expression={$_.VersionInfo.ProductVersion}}