CVE-2016-9244

EPSS 74.0%

Vexday Risk Score

47Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Proof of concept

Popular PoC on GitHub (30 stars) — exploitation code widely available.

CVSS —EPSS 74.0%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

09 Feb 2017Published on NVD

10 Feb 2017Public PoC

Weaponization speed

same dayto first PoC

Weaponized quickly — attackers prioritized this vulnerability. Patch urgently.

Recommendation: Plan a near-term fix — a public PoC already exists.

A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninitialized memory. A remote attacker may exploit this vulnerability to obtain Secure Sockets Layer (SSL) session IDs from other sessions. It is possible that other data from uninitialized memory may be returned as well.

Affected products

F5 Networks · F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, PEM, PSM

public PoCs found — 6

githubgithub.com/EgeBalci/Ticketbleed★ 30 githubgithub.com/glestel/minion-ticket-bleed-plugin★ 0 cve_referencepacketstormsecurity.com/files/141017/Ticketbleed-F5-TLS-Information-Disclosure.htmlunverified cve_referencewww.exploit-db.com/exploits/41298/unverified exploitdbwww.exploit-db.com/exploits/44446unverified exploitdbwww.exploit-db.com/exploits/41298unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/141017/Ticketbleed-F5-TLS-Information-Disclosure.html https://blog.filippo.io/finding-ticketbleed/https://filippo.io/Ticketbleed/https://github.com/0x00string/oldays/blob/master/CVE-2016-9244.py https://support.f5.com/csp/article/K05121675 https://www.exploit-db.com/exploits/41298/http://www.securityfocus.com/bid/96143 http://www.securitytracker.com/id/1037800