Although the Microsoft Bluetooth Stack OBEX Directory Traversal reported by Alberto Tablado is interesting, he puts a heavy emphasis on the requirement for pairing before the exploit can work:

There exists a Directory Traversal vulnerability in the OBEX FTP Service in Microsoft Bluetooth Stack implemented in Windows Mobile 5.0 & 6 devices. A remote attacker (who previously owned authentication and authorization rights) can use tools like ObexFTP to traverse to parent directories out of the default Bluetooth shared folder. This means the attacker can browse folders located on a lower level, download files contained in those folders as well as upload files to those folders.

The only requirement is that the attacker must have authentication and authorization privileges over the OBEX FTP service. Pairing up with the remote Windows Mobile device should be enough to get it. In case the attacker succeeded in getting the proper privileges, further actions will be transparent to the user.

That is more than a minor detail. What are the chances you would pair with a device you do not own, know or trust? I mean pairing with an unknown device is giving that device the key to your data…so would you give your key to an unknown device? I have done a fair bit of analysis of this and it’s non-trivial. In other words, the likelihood of the exploit working should be low because establishing a bluetooth pairing with unknown devices tends to be low.