Microsoft Windows Mobile double free vulnerability

Double free on receiving VCF via MMS/bluetooth...

[SecurityArchitect-009]: Microsoft Windows Mobile Double Free Vulnerability

Vendor: Microsoft Product: Windows Mobile Vulnerability: Double Free Tested vulnerable versions: Windows Mobile 6.1 and 6.5 Tested on : HTC Touch WM 6.1, HTC Touch2 WM 6.5 CREDITS: Celil nver from SecurityArchitect.Org CONTACT: celilunuvern0sp4mgmail.com Vulnerability Details and Analysis: The...

Microsoft Windows Mobile - Overly Long vCard Name Field Denial of Service

Microsoft Windows Mobile - Overly Long vCard Name Field Denial of Service source: https://www.securityfocus.com/bid/44287/info Microsoft Windows Mobile is prone to a denial-of-service vulnerability because it fails to adequately validate user-supplied input. An attacker can exploit this issue to...

Microsoft Windows Mobile bluetooth stack directory traversal

OBEX FTP directory traversal...

CVE-2008-4295

Microsoft Windows Mobile 6.0 on HTC Wiza 200 and HTC MDA 8125 devices does not properly handle the first attempt to establish a Bluetooth connection to a peer with a long name, which allows remote attackers to cause a denial of service device reboot by configuring a Bluetooth device with a long h...

CVE-2008-4295

CVE-2008-4295 affects Microsoft Windows Mobile 6.0 on HTC Wiza 200 and HTC MDA 8125. The vulnerability arises when handling the first Bluetooth connection attempt to a peer with a long name, enabling a remote attacker to cause a denial of service (device reboot) by configuring a long HCI name and...

Microsoft Windows Mobile短信处理器来源迷惑漏洞

BUGTRAQ ID: 26091 CVECAN ID: CVE-2007-5493 Windows Mobile是微软开发的用于手机的操作系统。 Windows Mobile的短信处理器中存在安全漏洞，如果发送了特制的WAP PUSH消息的话，就可能在接收者的手机上隐藏原始短信的发送者。 原始PDU如1所示，以下PDU会导致Pocket PC电话版本的SMS处理器错误的解码PDU，这样发送者的手机号码和发送时间都是错误的。 1 PDU（自动换行） 079144775810065051220C914477619269060004A7600605040B8423F025060803AE81...

Microsoft ActiveSync弱口令混淆信息泄露漏洞

BUGTRAQ ID: 25976 CVECAN ID: CVE-2007-5460 Microsoft ActiveSync是用于同步计算机与PDA的应用程序。 ActiveSync设备建立连接口令交换的过程实现上存在漏洞，攻击者可能利用此漏洞获取口令信息。 插入到USB口时设备会使用类似于标准网络接口的连接，获得IP地址后设备会通过RAPI在990/TCP端口初始化与主机的通讯，这个过程也会经历一个小型的握手例程，如果合适的话，会对主机挑战设备PIN或口令。用户提供了主机的PIN/口令后，会通过XOR与E9固定密钥进行混淆，然后通过USB网络连接发送给设备进行验证。...

CVE-2006-6902

Unspecified vulnerability in the Bluetooth stack in Microsoft Windows Mobile Pocket PC edition allows remote attackers to gain administrative access aka Remote Root via unspecified vectors...