{"id":"CVE-2016-9244","published":"2017-02-09T15:00:00Z","modified":"2024-08-06T02:42:11Z","title":"A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled…","vendor":"F5 Networks","product":"F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, PEM, PSM","tier":"core","eol":null,"affectedVersions":[{"vendor":"F5 Networks","product":"F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, PEM, PSM","versions":["11.6.1 before 11.6.1 HF1 and 12.1.x before 12.1.2"]}],"description":{"text":"A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninitialized memory. A remote attacker may exploit this vulnerability to obtain Secure Sockets Layer (SSL) session IDs from other sessions. It is possible that other data from uninitialized memory may be returned as well.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is in the Client SSL profile handling of F5 BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, PEM, PSM), specifically on virtual servers where the non-default Session Tickets option is enabled, which can leak up to 31 bytes of uninitialized memory. A remote attacker can exploit this to obtain SSL session IDs from other sessions, and potentially other uninitialized memory data.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:14:50Z"},"cvss":null,"epss":{"score":0.74,"percentile":0.9948,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":4,"pulses":[{"name":"SCANID: S-KhOoOrXsco8: Thor Lite Linux 64 - Sample Lab Device 2 - incomplete (not enriched)","url":"https://otx.alienvault.com/pulse/67c6bb5aa601e91b1314ff44","created":"2025-03-04"},{"name":"Python: OVSAgentServer Document (autofilled name)","url":"https://otx.alienvault.com/pulse/6660c1268a1f430e17236b55","created":"2024-06-05"},{"name":"Thor Lite Scan - 10.7.15 - Ubuntu Scan on Archived Files","url":"https://otx.alienvault.com/pulse/664cc3c1938ed0b9abf026a2","created":"2024-05-21"},{"name":"Proof Point Emerging Exploit list","url":"https://otx.alienvault.com/pulse/6399fdc966948f6b537b9762","created":"2022-12-14"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://support.f5.com/csp/article/K05121675","tags":["x_refsource_CONFIRM"]},{"url":"https://www.exploit-db.com/exploits/41298/","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"https://filippo.io/Ticketbleed/","tags":["x_refsource_MISC"]},{"url":"http://www.securityfocus.com/bid/96143","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://blog.filippo.io/finding-ticketbleed/","tags":["x_refsource_MISC"]},{"url":"http://www.securitytracker.com/id/1037800","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://packetstormsecurity.com/files/141017/Ticketbleed-F5-TLS-Information-Disclosure.html","tags":["x_refsource_MISC"]},{"url":"https://github.com/0x00string/oldays/blob/master/CVE-2016-9244.py","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2016-10055","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2016-10055","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":41298,"url":"https://www.exploit-db.com/exploits/41298","title":"F5 BIG-IP SSL Virtual Server - 'Ticketbleed' Memory Disclosure","type":"remote","platform":"hardware","date":"2017-02-10","verified":false,"provenance":"source"},{"id":44446,"url":"https://www.exploit-db.com/exploits/44446","title":"F5 BIG-IP 11.6 SSL Virtual Server - 'Ticketbleed' Memory Disclosure","type":"remote","platform":"hardware","date":"2017-02-14","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2017-02-10"},"pocGithub":{"count":2,"skipped":0,"earliest":"2017-02-10","earliestUrl":"https://github.com/EgeBalci/Ticketbleed","repos":[{"name":"EgeBalci/Ticketbleed","url":"https://github.com/EgeBalci/Ticketbleed","stars":30,"created":"2017-02-10"},{"name":"glestel/minion-ticket-bleed-plugin","url":"https://github.com/glestel/minion-ticket-bleed-plugin","stars":0,"created":"2017-02-10"}]},"first":{"date":"2017-02-10","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/41298"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/41298/","http://packetstormsecurity.com/files/141017/Ticketbleed-F5-TLS-Information-Disclosure.html"],"flow":[],"timeline":[{"date":"2017-02-09","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2016-9244","provenance":"source"},{"date":"2017-02-10","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-41298); later: PoC-in-GitHub 2017-02-10","url":"https://www.exploit-db.com/exploits/41298","provenance":"source"}],"speed":{"daysToPublicExploit":1,"firstExploitFrom":"Exploit-DB","daysToKev":null},"priority":{"score":26.5,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.9,"detail":"percentile 0.9948"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 2 Exploit-DB entries; 1 NVD exploit link; 2 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":1.59,"detail":"4 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}