Airscanner have been rather busy recently and have identified a total of four products for the WM2003 platform which have security vulnerabilites. 

I suppose it was only a matter of time before this platform would start to give rise the same problems its older siblings suffer from - at least this time it's the third party products rather than the O/S itself.

Below are the summaries, click on the headings for the full details on the Airscanner website.

Airscanner Mobile Security Advisory #05082201:
File Transfer Anywhere v3.01 Local Server Password Disclosure

"Product:
TTXN File Transfer Anywhere v3.01 server

Platform:
Tested on Windows Mobile Pocket PC 2003

Requirements:
Mobile device running Windows Mobile Pocket PC with Transfer Anywhere v3.01 installed

August 22 2005

Risk Level:
Medium, a local attacker can view server passwords in plain text.

Summary:
File Transfer Anywhere is a http based file transfer application. It allows users to transfer files in a FTP server like way but using HTTP. The program can also be used as a webserver.
The author’s website is unknown but the software can be found on Handango.com"

Airscanner Mobile Security Advisory #05081203:
vxTftpSrv 1.7.0 Remote Code Execution Buffer Overflow Vulnerability

"Product:
vxTftpSrv 1.7.0

Platform:
Tested on Windows Mobile Pocket PC 2003

Requirements:
Mobile device running Windows Mobile Pocket PC with vxTFTPSrv installed and running.

August 12 2005

Risk Level:
High. Remote attacker can execute code.

Summary:
vxTftpSrv is a simple, easy to use, Trivial File Transfer Protocol Server (TFTP) program which can be used to transfer files to and from routers, switches, hubs and other network devices. vxTftpSrv is typically used by Network Administrators to configure such equipment. Due to a improperly checked strcat call, it is possible to injection and execute code remotely via a buffer overflow."

Airscanner Mobile Security Advisory #05081101:
vxWeb v.1.1.4 Denial of Service Vulnerability

"Product:
vxWeb v1.1.4

Platform:
Tested on Windows Mobile Pocket PC 2003

Requirements:
Mobile device running Windows Mobile Pocket PC with vxWeb v1.1.4 installed and running.

August 11 2005

Risk Level:
Low

Summary:
vxWeb is a complete multi-threaded web server for Windows CE-based devices. However, it is vulnerable to a stack based buffer overflow that results in an instant crash of the web server."

Airscanner Mobile Security Advisory #05081102:
vxFtpSrv 0.9.7 Remote Code Execution Buffer Overflow Vulnerability

"Product:
vxFtpSrv 0.9.7

Platform:
Tested on Windows Mobile Pocket PC 2003

Requirements:
Mobile device running Windows Mobile Pocket PC with vxFtpSrv 0.9.7 installed and running.

August 12 2005

Risk Level:
High. Remote attacker can execute code.

Summary:
vxFtpSrv is a complete multi-threaded FTP server for Windows CE-based Handheld Pro, Pocket PC, Pocket PC 2002 and Windows Mobile 2003 devices. If an excessively long user name is provided, a buffer overflow will occur, thus causing either an instant crash of the program or code execution."