Trend Micro has again discovered flaws related to Windows Mobile. Both of the newly found vulnerabilities are flaws in applications that ship by default with Microsoft’s mobile device OS.

One of the said applications is Pictures and Videos, which causes a mobile device to hang for 10-15 minutes when it tries to process a malformed JPEG file. The other flaw is found in Windows Mobile’s Internet Explorer(IE), which when exploited terminates IE and causes the affected mobile device to be unstable.

Both vulnerabilities affect devices running Windows Mobile 5.0 and Windows Mobile 2003/2003SE for Smartphones and PocketPC. As of this writing, Microsoft has already been informed of these flaws but no patches are available as of yet.

The photos that we capture using our digital cameras come in different naming conventions: CIMG{numbers}for Casio, IMG_{numbers}for Canon, DSC{numbers}for Sony, and so on. Thus, receiving a file that follows the format below may puzzle some digital camera hobbyists but is usually not going to bother the majority of users who will likely automatically open the said file:

DC{number} (Without comments).JPG________________________________________
_____________________.exe

Trend Micro detects this malicious file as TROJ_DLOADER.FYX. Similar to TROJ_DLOADER.EXIthat connects to http://www.{BLOCKED}en21.net/images/r_title08.jpg to download a spyware, it also connects to the same Web site to download a file detected by Trend Micro as TSPY_BZUB.HN.

This Trojan arrives via spammed email.