Directory traversal vulnerability in the OBEX FTP Service in the Microsoft Bluetooth stack in Windows Mobile 6 Professional and probably Windows Mobile 5.0 for Pocket PC and 5.0 for Pocket PC Phone Edition allows remote authenticated users to list arbitrary directories and create or read arbitrary files via a .. (dot dot) in a pathname. NOTE: this can be leveraged for code execution by writing to a Startup folder.