CVE-2016-9244 - NVD | ByteOS Network

NVD Vulnerability Details :

CVE-2016-9244

Modified

More Info Official Page

Source-f5sirt@f5.com

Published At-09 Feb, 2017 | 15:59

Updated At-13 May, 2026 | 00:24

A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninitialized memory. A remote attacker may exploit this vulnerability to obtain Secure Sockets Layer (SSL) session IDs from other sessions. It is possible that other data from uninitialized memory may be returned as well.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	7.5	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary	2.0	5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N

Type: Primary

Version: 3.0

Base score: 7.5

Base severity: HIGH

Vector:

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Type: Primary

Version: 2.0

Base score: 5.0

Base severity: MEDIUM

Vector:

AV:N/AC:L/Au:N/C:P/I:N/A:N

CPE Matches

>>big-ip_local_traffic_manager>>11.4.0

cpe:2.3:a:f5:big-ip_local_traffic_manager:11.4.0:*:*:*:*:*:*:*

>>big-ip_local_traffic_manager>>11.4.1

cpe:2.3:a:f5:big-ip_local_traffic_manager:11.4.1:*:*:*:*:*:*:*

>>big-ip_local_traffic_manager>>11.5.0

cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.0:*:*:*:*:*:*:*

>>big-ip_local_traffic_manager>>11.5.1

cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.1:*:*:*:*:*:*:*

>>big-ip_local_traffic_manager>>11.5.2

cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.2:*:*:*:*:*:*:*

>>big-ip_local_traffic_manager>>11.5.3

cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.3:*:*:*:*:*:*:*

>>big-ip_local_traffic_manager>>11.5.4

cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.4:*:*:*:*:*:*:*

>>big-ip_local_traffic_manager>>11.6.0

cpe:2.3:a:f5:big-ip_local_traffic_manager:11.6.0:*:*:*:*:*:*:*

>>big-ip_local_traffic_manager>>11.6.1

cpe:2.3:a:f5:big-ip_local_traffic_manager:11.6.1:*:*:*:*:*:*:*

>>big-ip_local_traffic_manager>>12.0.0

cpe:2.3:a:f5:big-ip_local_traffic_manager:12.0.0:*:*:*:*:*:*:*

>>big-ip_local_traffic_manager>>12.1.0

cpe:2.3:a:f5:big-ip_local_traffic_manager:12.1.0:*:*:*:*:*:*:*

>>big-ip_local_traffic_manager>>12.1.1

cpe:2.3:a:f5:big-ip_local_traffic_manager:12.1.1:*:*:*:*:*:*:*

>>big-ip_local_traffic_manager>>12.1.2

cpe:2.3:a:f5:big-ip_local_traffic_manager:12.1.2:*:*:*:*:*:*:*

>>big-ip_application_acceleration_manager>>11.4.0

cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.4.0:*:*:*:*:*:*:*

>>big-ip_application_acceleration_manager>>11.4.1

cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.4.1:*:*:*:*:*:*:*

>>big-ip_application_acceleration_manager>>11.5.0

cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.0:*:*:*:*:*:*:*

>>big-ip_application_acceleration_manager>>11.5.1

cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.1:*:*:*:*:*:*:*

>>big-ip_application_acceleration_manager>>11.5.2

cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.2:*:*:*:*:*:*:*

>>big-ip_application_acceleration_manager>>11.5.3

cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.3:*:*:*:*:*:*:*

>>big-ip_application_acceleration_manager>>11.5.4

cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.4:*:*:*:*:*:*:*

>>big-ip_application_acceleration_manager>>11.6.0

cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.6.0:*:*:*:*:*:*:*

>>big-ip_application_acceleration_manager>>11.6.1

cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.6.1:*:*:*:*:*:*:*

>>big-ip_application_acceleration_manager>>12.0.0

cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.0.0:*:*:*:*:*:*:*

>>big-ip_application_acceleration_manager>>12.1.0

cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.1.0:*:*:*:*:*:*:*

>>big-ip_application_acceleration_manager>>12.1.1

cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.1.1:*:*:*:*:*:*:*

>>big-ip_application_acceleration_manager>>12.1.2

cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.1.2:*:*:*:*:*:*:*

>>big-ip_advanced_firewall_manager>>11.4.0

cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.4.0:*:*:*:*:*:*:*

>>big-ip_advanced_firewall_manager>>11.4.1

cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.4.1:*:*:*:*:*:*:*

>>big-ip_advanced_firewall_manager>>11.5.0

cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.5.0:*:*:*:*:*:*:*

>>big-ip_advanced_firewall_manager>>11.5.1

cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.5.1:*:*:*:*:*:*:*

>>big-ip_advanced_firewall_manager>>11.5.2

cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.5.2:*:*:*:*:*:*:*

>>big-ip_advanced_firewall_manager>>11.5.3

cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.5.3:*:*:*:*:*:*:*

>>big-ip_advanced_firewall_manager>>11.5.4

cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.5.4:*:*:*:*:*:*:*

>>big-ip_advanced_firewall_manager>>11.6.0

cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.6.0:*:*:*:*:*:*:*

>>big-ip_advanced_firewall_manager>>11.6.1

cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.6.1:*:*:*:*:*:*:*

>>big-ip_advanced_firewall_manager>>12.0.0

cpe:2.3:a:f5:big-ip_advanced_firewall_manager:12.0.0:*:*:*:*:*:*:*

>>big-ip_advanced_firewall_manager>>12.1.0

cpe:2.3:a:f5:big-ip_advanced_firewall_manager:12.1.0:*:*:*:*:*:*:*

>>big-ip_advanced_firewall_manager>>12.1.1

cpe:2.3:a:f5:big-ip_advanced_firewall_manager:12.1.1:*:*:*:*:*:*:*

>>big-ip_advanced_firewall_manager>>12.1.2

cpe:2.3:a:f5:big-ip_advanced_firewall_manager:12.1.2:*:*:*:*:*:*:*

>>big-ip_analytics>>11.4.0

cpe:2.3:a:f5:big-ip_analytics:11.4.0:*:*:*:*:*:*:*

>>big-ip_analytics>>11.4.1

cpe:2.3:a:f5:big-ip_analytics:11.4.1:*:*:*:*:*:*:*

>>big-ip_analytics>>11.5.0

cpe:2.3:a:f5:big-ip_analytics:11.5.0:*:*:*:*:*:*:*

>>big-ip_analytics>>11.5.1

cpe:2.3:a:f5:big-ip_analytics:11.5.1:*:*:*:*:*:*:*

>>big-ip_analytics>>11.5.2

cpe:2.3:a:f5:big-ip_analytics:11.5.2:*:*:*:*:*:*:*

>>big-ip_analytics>>11.5.3

cpe:2.3:a:f5:big-ip_analytics:11.5.3:*:*:*:*:*:*:*

>>big-ip_analytics>>11.5.4

cpe:2.3:a:f5:big-ip_analytics:11.5.4:*:*:*:*:*:*:*

>>big-ip_analytics>>11.6.0

cpe:2.3:a:f5:big-ip_analytics:11.6.0:*:*:*:*:*:*:*

>>big-ip_analytics>>11.6.1

cpe:2.3:a:f5:big-ip_analytics:11.6.1:*:*:*:*:*:*:*

>>big-ip_analytics>>12.0.0

cpe:2.3:a:f5:big-ip_analytics:12.0.0:*:*:*:*:*:*:*

>>big-ip_analytics>>12.1.0

cpe:2.3:a:f5:big-ip_analytics:12.1.0:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-200	Primary	nvd@nist.gov

CWE ID: CWE-200

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://packetstormsecurity.com/files/141017/Ticketbleed-F5-TLS-Information-Disclosure.html	f5sirt@f5.com	N/A
http://www.securityfocus.com/bid/96143	f5sirt@f5.com	N/A
http://www.securitytracker.com/id/1037800	f5sirt@f5.com	Third Party Advisory VDB Entry
https://blog.filippo.io/finding-ticketbleed/	f5sirt@f5.com	N/A
https://filippo.io/Ticketbleed/	f5sirt@f5.com	N/A
https://github.com/0x00string/oldays/blob/master/CVE-2016-9244.py	f5sirt@f5.com	N/A
https://support.f5.com/csp/article/K05121675	f5sirt@f5.com	Mitigation Vendor Advisory
https://www.exploit-db.com/exploits/41298/	f5sirt@f5.com	N/A
http://packetstormsecurity.com/files/141017/Ticketbleed-F5-TLS-Information-Disclosure.html	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.securityfocus.com/bid/96143	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.securitytracker.com/id/1037800	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory VDB Entry
https://blog.filippo.io/finding-ticketbleed/	af854a3a-2127-422b-91ae-364da2661108	N/A
https://filippo.io/Ticketbleed/	af854a3a-2127-422b-91ae-364da2661108	N/A
https://github.com/0x00string/oldays/blob/master/CVE-2016-9244.py	af854a3a-2127-422b-91ae-364da2661108	N/A
https://support.f5.com/csp/article/K05121675	af854a3a-2127-422b-91ae-364da2661108	Mitigation Vendor Advisory
https://www.exploit-db.com/exploits/41298/	af854a3a-2127-422b-91ae-364da2661108	N/A

Hyperlink: http://packetstormsecurity.com/files/141017/Ticketbleed-F5-TLS-Information-Disclosure.html

Source: f5sirt@f5.com

Resource: N/A

Hyperlink: http://www.securityfocus.com/bid/96143

Source: f5sirt@f5.com

Resource: N/A

Hyperlink: http://www.securitytracker.com/id/1037800

Source: f5sirt@f5.com

Resource:

Third Party Advisory

VDB Entry

Hyperlink: https://blog.filippo.io/finding-ticketbleed/

Source: f5sirt@f5.com

Resource: N/A

Hyperlink: https://filippo.io/Ticketbleed/

Source: f5sirt@f5.com

Resource: N/A

Hyperlink: https://github.com/0x00string/oldays/blob/master/CVE-2016-9244.py

Source: f5sirt@f5.com

Resource: N/A

Hyperlink: https://support.f5.com/csp/article/K05121675

Source: f5sirt@f5.com

Resource:

Mitigation

Vendor Advisory

Hyperlink: https://www.exploit-db.com/exploits/41298/

Source: f5sirt@f5.com

Resource: N/A

Hyperlink: http://packetstormsecurity.com/files/141017/Ticketbleed-F5-TLS-Information-Disclosure.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://www.securityfocus.com/bid/96143

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://www.securitytracker.com/id/1037800

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

VDB Entry

Hyperlink: https://blog.filippo.io/finding-ticketbleed/

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: https://filippo.io/Ticketbleed/

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: https://github.com/0x00string/oldays/blob/master/CVE-2016-9244.py

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: https://support.f5.com/csp/article/K05121675

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Mitigation

Vendor Advisory

Hyperlink: https://www.exploit-db.com/exploits/41298/

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A