Vulnerability Details : CVE-2016-9244
Potential exploit
A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninitialized memory. A remote attacker may exploit this vulnerability to obtain Secure Sockets Layer (SSL) session IDs from other sessions. It is possible that other data from uninitialized memory may be returned as well.
Vulnerability category: Information leak
Products affected by CVE-2016-9244
- cpe:2.3:a:f5:big-ip_local_traffic_manager:11.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_local_traffic_manager:11.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_local_traffic_manager:11.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_local_traffic_manager:12.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.4:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_local_traffic_manager:11.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_local_traffic_manager:12.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_local_traffic_manager:12.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_local_traffic_manager:12.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_global_traffic_manager:11.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_global_traffic_manager:11.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_global_traffic_manager:11.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_global_traffic_manager:11.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_global_traffic_manager:11.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_global_traffic_manager:11.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_global_traffic_manager:11.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_global_traffic_manager:11.5.4:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_global_traffic_manager:11.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_security_manager:11.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_security_manager:11.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_security_manager:11.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_security_manager:11.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_security_manager:11.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_security_manager:11.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_security_manager:12.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_security_manager:11.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_security_manager:11.5.4:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_security_manager:11.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_security_manager:12.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_security_manager:12.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_security_manager:12.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_access_policy_manager:11.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_access_policy_manager:11.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_access_policy_manager:11.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_access_policy_manager:12.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.4:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_access_policy_manager:11.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_protocol_security_module:11.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_protocol_security_module:11.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_link_controller:11.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_link_controller:11.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_link_controller:11.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_link_controller:11.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_link_controller:11.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_link_controller:11.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_link_controller:12.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_link_controller:11.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_link_controller:11.5.4:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_link_controller:11.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_link_controller:12.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_link_controller:12.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_link_controller:12.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_analytics:11.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_analytics:11.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_analytics:11.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_analytics:11.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_analytics:11.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_analytics:11.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_analytics:12.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_analytics:11.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_analytics:11.5.4:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_analytics:11.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_analytics:12.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_analytics:12.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_analytics:12.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.4:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_advanced_firewall_manager:12.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.5.4:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_advanced_firewall_manager:12.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_advanced_firewall_manager:12.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_advanced_firewall_manager:12.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_policy_enforcement_manager:12.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.5.4:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_policy_enforcement_manager:12.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_policy_enforcement_manager:12.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_policy_enforcement_manager:12.1.2:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-9244
69.79%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 99 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-9244
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
10.0
|
2.9
|
NIST | |
|
7.5
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2016-9244
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-9244
-
http://www.securitytracker.com/id/1037800
F5 BIG-IP Flaw in Session Ticket Response Lets Remote Users Obtain Potentially Sensitive Information from System Memory - SecurityTrackerThird Party Advisory;VDB Entry
-
http://www.securityfocus.com/bid/96143
Multiple F5 BIG-IP Products CVE-2016-9244 Information Disclosure Vulnerability
-
https://blog.filippo.io/finding-ticketbleed/
Finding Ticketbleed
-
https://github.com/0x00string/oldays/blob/master/CVE-2016-9244.py
oldays/CVE-2016-9244.py at master · 0x00string/oldays · GitHub
-
https://support.f5.com/csp/article/K05121675
Mitigation;Vendor Advisory
-
https://www.exploit-db.com/exploits/41298/
F5 BIG-IP SSL Virtual Server - 'Ticketbleed' Memory Disclosure
-
https://filippo.io/Ticketbleed/
Ticketbleed (CVE-2016-9244)
-
http://packetstormsecurity.com/files/141017/Ticketbleed-F5-TLS-Information-Disclosure.html
Ticketbleed F5 TLS Information Disclosure ≈ Packet Storm
Jump to