7.5

CVE-2016-9244

EPSS 74%
Veröffentlicht 09.02.2017 15:59:01
Zuletzt bearbeitet 13.05.2026 00:24:29
Erkennungen
Login

A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninitialized memory. A remote attacker may exploit this vulnerability to obtain Secure Sockets Layer (SSL) session IDs from other sessions. It is possible that other data from uninitialized memory may be returned as well.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 11

NVD 115 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

F5 ≫ Big-ip Local Traffic Manager Version 11.4.0

F5 ≫ Big-ip Local Traffic Manager Version 11.4.1

F5 ≫ Big-ip Local Traffic Manager Version 11.5.0

F5 ≫ Big-ip Local Traffic Manager Version 11.5.1

F5 ≫ Big-ip Local Traffic Manager Version 11.5.2

F5 ≫ Big-ip Local Traffic Manager Version 11.5.3

F5 ≫ Big-ip Local Traffic Manager Version 11.5.4

F5 ≫ Big-ip Local Traffic Manager Version 11.6.0

F5 ≫ Big-ip Local Traffic Manager Version 11.6.1

F5 ≫ Big-ip Local Traffic Manager Version 12.0.0

F5 ≫ Big-ip Local Traffic Manager Version 12.1.0

F5 ≫ Big-ip Local Traffic Manager Version 12.1.1

F5 ≫ Big-ip Local Traffic Manager Version 12.1.2

F5 ≫ Big-ip Application Acceleration Manager Version 11.4.0

F5 ≫ Big-ip Application Acceleration Manager Version 11.4.1

F5 ≫ Big-ip Application Acceleration Manager Version 11.5.0

F5 ≫ Big-ip Application Acceleration Manager Version 11.5.1

F5 ≫ Big-ip Application Acceleration Manager Version 11.5.2

F5 ≫ Big-ip Application Acceleration Manager Version 11.5.3

F5 ≫ Big-ip Application Acceleration Manager Version 11.5.4

F5 ≫ Big-ip Application Acceleration Manager Version 11.6.0

F5 ≫ Big-ip Application Acceleration Manager Version 11.6.1

F5 ≫ Big-ip Application Acceleration Manager Version 12.0.0

F5 ≫ Big-ip Application Acceleration Manager Version 12.1.0

F5 ≫ Big-ip Application Acceleration Manager Version 12.1.1

F5 ≫ Big-ip Application Acceleration Manager Version 12.1.2

F5 ≫ Big-ip Advanced Firewall Manager Version 11.4.0

F5 ≫ Big-ip Advanced Firewall Manager Version 11.4.1

F5 ≫ Big-ip Advanced Firewall Manager Version 11.5.0

F5 ≫ Big-ip Advanced Firewall Manager Version 11.5.1

F5 ≫ Big-ip Advanced Firewall Manager Version 11.5.2

F5 ≫ Big-ip Advanced Firewall Manager Version 11.5.3

F5 ≫ Big-ip Advanced Firewall Manager Version 11.5.4

F5 ≫ Big-ip Advanced Firewall Manager Version 11.6.0

F5 ≫ Big-ip Advanced Firewall Manager Version 11.6.1

F5 ≫ Big-ip Advanced Firewall Manager Version 12.0.0

F5 ≫ Big-ip Advanced Firewall Manager Version 12.1.0

F5 ≫ Big-ip Advanced Firewall Manager Version 12.1.1

F5 ≫ Big-ip Advanced Firewall Manager Version 12.1.2

F5 ≫ Big-ip Analytics Version 11.4.0

F5 ≫ Big-ip Analytics Version 11.4.1

F5 ≫ Big-ip Analytics Version 11.5.0

F5 ≫ Big-ip Analytics Version 11.5.1

F5 ≫ Big-ip Analytics Version 11.5.2

F5 ≫ Big-ip Analytics Version 11.5.3

F5 ≫ Big-ip Analytics Version 11.5.4

F5 ≫ Big-ip Analytics Version 11.6.0

F5 ≫ Big-ip Analytics Version 11.6.1

F5 ≫ Big-ip Analytics Version 12.0.0

F5 ≫ Big-ip Analytics Version 12.1.0

F5 ≫ Big-ip Analytics Version 12.1.1

F5 ≫ Big-ip Analytics Version 12.1.2

F5 ≫ Big-ip Access Policy Manager Version 11.4.0

F5 ≫ Big-ip Access Policy Manager Version 11.4.1

F5 ≫ Big-ip Access Policy Manager Version 11.5.0

F5 ≫ Big-ip Access Policy Manager Version 11.5.1

F5 ≫ Big-ip Access Policy Manager Version 11.5.2

F5 ≫ Big-ip Access Policy Manager Version 11.5.3

F5 ≫ Big-ip Access Policy Manager Version 11.5.4

F5 ≫ Big-ip Access Policy Manager Version 11.6.0

F5 ≫ Big-ip Access Policy Manager Version 11.6.1

F5 ≫ Big-ip Access Policy Manager Version 12.0.0

F5 ≫ Big-ip Access Policy Manager Version 12.1.0

F5 ≫ Big-ip Access Policy Manager Version 12.1.1

F5 ≫ Big-ip Access Policy Manager Version 12.1.2

F5 ≫ Big-ip Application Security Manager Version 11.4.0

F5 ≫ Big-ip Application Security Manager Version 11.4.1

F5 ≫ Big-ip Application Security Manager Version 11.5.0

F5 ≫ Big-ip Application Security Manager Version 11.5.1

F5 ≫ Big-ip Application Security Manager Version 11.5.2

F5 ≫ Big-ip Application Security Manager Version 11.5.3

F5 ≫ Big-ip Application Security Manager Version 11.5.4

F5 ≫ Big-ip Application Security Manager Version 11.6.0

F5 ≫ Big-ip Application Security Manager Version 11.6.1

F5 ≫ Big-ip Application Security Manager Version 12.0.0

F5 ≫ Big-ip Application Security Manager Version 12.1.0

F5 ≫ Big-ip Application Security Manager Version 12.1.1

F5 ≫ Big-ip Application Security Manager Version 12.1.2

F5 ≫ Big-ip Global Traffic Manager Version 11.4.0

F5 ≫ Big-ip Global Traffic Manager Version 11.4.1

F5 ≫ Big-ip Global Traffic Manager Version 11.5.0

F5 ≫ Big-ip Global Traffic Manager Version 11.5.1

F5 ≫ Big-ip Global Traffic Manager Version 11.5.2

F5 ≫ Big-ip Global Traffic Manager Version 11.5.3

F5 ≫ Big-ip Global Traffic Manager Version 11.5.4

F5 ≫ Big-ip Global Traffic Manager Version 11.6.0

F5 ≫ Big-ip Global Traffic Manager Version 11.6.1

F5 ≫ Big-ip Link Controller Version 11.4.0

F5 ≫ Big-ip Link Controller Version 11.4.1

F5 ≫ Big-ip Link Controller Version 11.5.0

F5 ≫ Big-ip Link Controller Version 11.5.1

F5 ≫ Big-ip Link Controller Version 11.5.2

F5 ≫ Big-ip Link Controller Version 11.5.3

F5 ≫ Big-ip Link Controller Version 11.5.4

F5 ≫ Big-ip Link Controller Version 11.6.0

F5 ≫ Big-ip Link Controller Version 11.6.1

F5 ≫ Big-ip Link Controller Version 12.0.0

F5 ≫ Big-ip Link Controller Version 12.1.0

F5 ≫ Big-ip Link Controller Version 12.1.1

F5 ≫ Big-ip Link Controller Version 12.1.2

F5 ≫ Big-ip Policy Enforcement Manager Version 11.4.0

F5 ≫ Big-ip Policy Enforcement Manager Version 11.4.1

F5 ≫ Big-ip Policy Enforcement Manager Version 11.5.0

F5 ≫ Big-ip Policy Enforcement Manager Version 11.5.1

F5 ≫ Big-ip Policy Enforcement Manager Version 11.5.2

F5 ≫ Big-ip Policy Enforcement Manager Version 11.5.3

F5 ≫ Big-ip Policy Enforcement Manager Version 11.5.4

F5 ≫ Big-ip Policy Enforcement Manager Version 11.6.0

F5 ≫ Big-ip Policy Enforcement Manager Version 11.6.1

F5 ≫ Big-ip Policy Enforcement Manager Version 12.0.0

F5 ≫ Big-ip Policy Enforcement Manager Version 12.1.0

F5 ≫ Big-ip Policy Enforcement Manager Version 12.1.1

F5 ≫ Big-ip Policy Enforcement Manager Version 12.1.2

F5 ≫ Big-ip Protocol Security Module Version 11.4.0

F5 ≫ Big-ip Protocol Security Module Version 11.4.1

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	74%	0.994

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	7.5	3.9	3.6	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NIST	5	10	2.9	AV:N/AC:L/Au:N/C:P/I:N/A:N

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

http://packetstormsecurity.com/files/141017/Ticketbleed-F5-TLS-Information-Disclosure.html

http://www.securityfocus.com/bid/96143

http://www.securitytracker.com/id/1037800

Third Party Advisory

VDB Entry

https://blog.filippo.io/finding-ticketbleed/

https://filippo.io/Ticketbleed/

https://github.com/0x00string/oldays/blob/master/CVE-2016-9244.py

https://support.f5.com/csp/article/K05121675

Vendor Advisory

Mitigation

https://www.exploit-db.com/exploits/41298/

https://nvd.nist.gov/vuln/detail/CVE-2016-9244

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2016-9244

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2016-9244

EUVD