CVE-2016-9244: f5 networks f5 big-ip ltm, aam, afm, analytics, apm, asm, gtm, link controller, pem, psm
Vulnerability summary
CVE-2016-9244 is a high (CVSS 7.5) vulnerability in f5 networks f5 big-ip ltm, aam, afm, analytics, apm, asm, gtm, link controller, pem, psm. EPSS estimates a 74.00% chance of exploitation in the next 30 days, higher than 99.4% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 09-02-2017PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninitialized memory. A remote attacker may exploit this vulnerability to obtain Secure Sockets Layer (SSL) session IDs from other sessions. It is possible that other data from uninitialized memory may be returned as well.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
74.00%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 74.00% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundF5 BIG-IP 11.6 SSL Virtual Server - 'Ticketbleed' Memory Disclosure
Maturity: poc
F5 BIG-IP SSL Virtual Server - 'Ticketbleed' Memory Disclosure
Maturity: poc
Weaknesses
CWE · root causeAffected systems
F510 products
- big-ip_access_policy_manager11.4.0 | 11.4.1 | 11.5.0 | 11.5.1 | 11.5.2 | 11.5.3 | 11.5.4 | 11.6.0 | 11.6.1 | 12.0.0 | 12.1.0 | 12.1.1 | 12.1.2
- big-ip_advanced_firewall_manager11.4.0 | 11.4.1 | 11.5.0 | 11.5.1 | 11.5.2 | 11.5.3 | 11.5.4 | 11.6.0 | 11.6.1 | 12.0.0 | 12.1.0 | 12.1.1 | 12.1.2
- big-ip_analytics11.4.0 | 11.4.1 | 11.5.0 | 11.5.1 | 11.5.2 | 11.5.3 | 11.5.4 | 11.6.0 | 11.6.1 | 12.0.0 | 12.1.0 | 12.1.1 | 12.1.2
- big-ip_application_acceleration_manager11.4.0 | 11.4.1 | 11.5.0 | 11.5.1 | 11.5.2 | 11.5.3 | 11.5.4 | 11.6.0 | 11.6.1 | 12.0.0 | 12.1.0 | 12.1.1 | 12.1.2
- big-ip_application_security_manager11.4.0 | 11.4.1 | 11.5.0 | 11.5.1 | 11.5.2 | 11.5.3 | 11.5.4 | 11.6.0 | 11.6.1 | 12.0.0 | 12.1.0 | 12.1.1 | 12.1.2
F5 networks1 product
- f5 big-ip ltm, aam, afm, analytics, apm, asm, gtm, link controller, pem, psm11.6.1 before 11.6.1 HF1 and 12.1.x before 12.1.2
2 vendors · 11 products
References
8 links- filippo.io/Ticketbleed/X Refsource MISC
- blog.filippo.io/finding-ticketbleed/X Refsource MISC
- github.com/0x00string/oldays/blob/master/CVE-2016-9244.pyX Refsource MISC