vulnwire
7.5high

CVE-2016-9244in critical feed2 exploits

A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 byte…

Published 9 y ago · modified 4 mo ago · JSON

CVSS
7.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
74.0%
percentile 99%
Public exploits
2
Exploit-DB

A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninitialized memory. A remote attacker may exploit this vulnerability to obtain Secure Sockets Layer (SSL) session IDs from other sessions. It is possible that other data from uninitialized memory may be returned as well.

Exploit prediction (EPSS)

74.00% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.

Exploits and detections

  • EDB-44446 F5 BIG-IP 11.6 SSL Virtual Server - 'Ticketbleed' Memory Disclosure · remote · 2017-02-14
  • EDB-41298 F5 BIG-IP SSL Virtual Server - 'Ticketbleed' Memory Disclosure · remote · 2017-02-10

CVSS scores

Assigned byVersionScoreVector
NVD3.07.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD2.05.0AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

  • F5 Networks F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, PEM, PSM

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

  • support.f5.com /csp/article/K05121675 · x_refsource_CONFIRM, x_transferred
  • exploit-db.com /exploits/41298/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • filippo.io /Ticketbleed/ · x_refsource_MISC, x_transferred
  • securityfocus.com /bid/96143 · vdb-entry, x_refsource_BID, x_transferred
  • blog.filippo.io /finding-ticketbleed/ · x_refsource_MISC, x_transferred
  • securitytracker.com /id/1037800 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • packetstormsecurity.com /files/141017/Ticketbleed-F5-TLS-Information-Disclosure.html · x_refsource_MISC, x_transferred
  • github.com /0x00string/oldays/blob/master/CVE-2016-9244.py · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.