Published: 09/02/2017 Updated: 06/06/2019

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 536

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Subscribe to Big-ip Local Traffic Manager

A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninitialized memory. A remote attacker may exploit this vulnerability to obtain Secure Sockets Layer (SSL) session IDs from other sessions. It is possible that other data from uninitialized memory may be returned as well.

Vulnerable Product	Search on Vulmon	Subscribe to Product
f5 big-ip local traffic manager 12.1.0
f5 big-ip local traffic manager 12.1.2
f5 big-ip local traffic manager 11.5.2
f5 big-ip local traffic manager 11.5.1
f5 big-ip local traffic manager 11.6.1
f5 big-ip local traffic manager 12.0.0
f5 big-ip local traffic manager 11.5.0
f5 big-ip local traffic manager 11.4.1
f5 big-ip local traffic manager 11.6.0
f5 big-ip local traffic manager 12.1.1
f5 big-ip local traffic manager 11.4.0
f5 big-ip local traffic manager 11.5.4
f5 big-ip local traffic manager 11.5.3
f5 big-ip application acceleration manager 11.6.1
f5 big-ip application acceleration manager 11.4.0
f5 big-ip application acceleration manager 12.0.0
f5 big-ip application acceleration manager 12.1.1
f5 big-ip application acceleration manager 11.4.1
f5 big-ip application acceleration manager 11.5.0
f5 big-ip application acceleration manager 11.5.1
f5 big-ip application acceleration manager 11.5.2
f5 big-ip application acceleration manager 11.5.3
f5 big-ip application acceleration manager 12.1.0
f5 big-ip application acceleration manager 12.1.2
f5 big-ip application acceleration manager 11.5.4
f5 big-ip application acceleration manager 11.6.0
f5 big-ip advanced firewall manager 11.5.0
f5 big-ip advanced firewall manager 11.5.1
f5 big-ip advanced firewall manager 12.1.0
f5 big-ip advanced firewall manager 11.5.2
f5 big-ip advanced firewall manager 11.5.3
f5 big-ip advanced firewall manager 12.1.2
f5 big-ip advanced firewall manager 11.6.1
f5 big-ip advanced firewall manager 11.5.4
f5 big-ip advanced firewall manager 11.6.0
f5 big-ip advanced firewall manager 11.4.0
f5 big-ip advanced firewall manager 11.4.1
f5 big-ip advanced firewall manager 12.0.0
f5 big-ip advanced firewall manager 12.1.1
f5 big-ip analytics 12.1.2
f5 big-ip analytics 11.5.4
f5 big-ip analytics 11.6.0
f5 big-ip analytics 11.6.1
f5 big-ip analytics 11.4.0
f5 big-ip analytics 11.4.1
f5 big-ip analytics 12.0.0
f5 big-ip analytics 12.1.0
f5 big-ip analytics 11.5.0
f5 big-ip analytics 11.5.1
f5 big-ip analytics 12.1.1
f5 big-ip analytics 11.5.2
f5 big-ip analytics 11.5.3
f5 big-ip access policy manager 11.6.1
f5 big-ip access policy manager 11.4.0
f5 big-ip access policy manager 11.6.0
f5 big-ip access policy manager 12.0.0
f5 big-ip access policy manager 11.4.1
f5 big-ip access policy manager 11.5.0
f5 big-ip access policy manager 12.1.1
f5 big-ip access policy manager 11.5.1
f5 big-ip access policy manager 11.5.2
f5 big-ip access policy manager 12.1.0
f5 big-ip access policy manager 12.1.2
f5 big-ip access policy manager 11.5.3
f5 big-ip access policy manager 11.5.4
f5 big-ip application security manager 11.5.0
f5 big-ip application security manager 11.5.1
f5 big-ip application security manager 12.1.0
f5 big-ip application security manager 11.5.2
f5 big-ip application security manager 11.5.3
f5 big-ip application security manager 12.1.2
f5 big-ip application security manager 11.6.1
f5 big-ip application security manager 11.5.4
f5 big-ip application security manager 11.6.0
f5 big-ip application security manager 11.4.0
f5 big-ip application security manager 11.4.1
f5 big-ip application security manager 12.0.0
f5 big-ip application security manager 12.1.1
f5 big-ip global traffic manager 11.6.1
f5 big-ip global traffic manager 11.5.4
f5 big-ip global traffic manager 11.6.0
f5 big-ip global traffic manager 11.4.0
f5 big-ip global traffic manager 11.4.1
f5 big-ip global traffic manager 11.5.0
f5 big-ip global traffic manager 11.5.1
f5 big-ip global traffic manager 11.5.2
f5 big-ip global traffic manager 11.5.3
f5 big-ip link controller 11.5.1
f5 big-ip link controller 11.5.2
f5 big-ip link controller 12.1.0
f5 big-ip link controller 12.1.2
f5 big-ip link controller 11.5.3
f5 big-ip link controller 11.5.4
f5 big-ip link controller 11.6.1
f5 big-ip link controller 11.4.0
f5 big-ip link controller 11.6.0
f5 big-ip link controller 12.0.0
f5 big-ip link controller 11.4.1
f5 big-ip link controller 11.5.0
f5 big-ip link controller 12.1.1
f5 big-ip policy enforcement manager 12.1.0
f5 big-ip policy enforcement manager 12.1.2
f5 big-ip policy enforcement manager 11.5.4
f5 big-ip policy enforcement manager 11.6.0
f5 big-ip policy enforcement manager 11.6.1
f5 big-ip policy enforcement manager 11.4.0
f5 big-ip policy enforcement manager 12.0.0
f5 big-ip policy enforcement manager 12.1.1
f5 big-ip policy enforcement manager 11.4.1
f5 big-ip policy enforcement manager 11.5.0
f5 big-ip policy enforcement manager 11.5.1
f5 big-ip policy enforcement manager 11.5.2
f5 big-ip policy enforcement manager 11.5.3
f5 big-ip protocol security module 11.4.1
f5 big-ip protocol security module 11.4.0

/* # Exploit Title: [Ticketbleed (CVE-2016-9244) F5 BIG-IP SSL virtual server Memory Leakage] # Date: [10022017] # Exploit Author: [Ege BalcÄ±] # Vendor Homepage: [f5com/] # Version: [1200 - 1212 && 1140 - 1161] # Tested on: [Multiple] # CVE : [CVE-2016-9244] BUILD: go get githubcom/EgeBalci/Ticketbleed go build ...

Detects whether a server is vulnerable to the F5 Ticketbleed bug (CVE-2016-9244).

nmap -p 443 --script tls-ticketbleed <target>

| tls-ticketbleed:
|   VULNERABLE:
|   Ticketbleed is a serious issue in products manufactured by F5, a popular
vendor of TLS load-balancers. The issue allows for stealing information from
the load balancer
|     State: VULNERABLE (Exploitable)
|     Risk factor: High
|       Ticketbleed is vulnerability in the implementation of the TLS
SessionTicket extension found in some F5 products. It allows the leakage
("bleeding") of up to 31 bytes of data from uninitialized memory. This is
caused by the TLS stack padding a Session ID, passed from the client, with
data to make it 32-bits long.
|     Exploit results:
|       2ab2ea6a4c167fbe8bf0b36c7d9ed6d3
|       *..jL......l}...
|     References:
|       https://filippo.io/Ticketbleed/
|       https://blog.filippo.io/finding-ticketbleed/
|_      https://support.f5.com/csp/article/K05121675

Detects whether a server is vulnerable to the F5 Ticketbleed bug (CVE-2016-9244).

nmap -p 443 --script tls-ticketbleed <target>

| tls-ticketbleed:
|   VULNERABLE:
|   Ticketbleed is a serious issue in products manufactured by F5, a popular
vendor of TLS load-balancers. The issue allows for stealing information from
the load balancer
|     State: VULNERABLE (Exploitable)
|     Risk factor: High
|       Ticketbleed is vulnerability in the implementation of the TLS
SessionTicket extension found in some F5 products. It allows the leakage
("bleeding") of up to 31 bytes of data from uninitialized memory. This is
caused by the TLS stack padding a Session ID, passed from the client, with
data to make it 32-bits long.
|     Exploit results:
|       2ab2ea6a4c167fbe8bf0b36c7d9ed6d3
|       *..jL......l}...
|     References:
|       https://filippo.io/Ticketbleed/
|       https://blog.filippo.io/finding-ticketbleed/
|_      https://support.f5.com/csp/article/K05121675

This is a tool for exploiting Ticketbleed (CVE-2016-9244) vulnerability.

Ticketbleed This tool is for exploiting Ticketbleed (CVE-2016-9244) vulnerability, the Ticketbleed library inside src folder is a modified version of go's crypto/tls, it has few changes inside handshake_clientgo, tlsgo, commongo files but it is almost same BUILD cd Ticketbleed mv Ticketbleedgotmp Ticketbleedgo go get githubcom/EgeBalci/Ticketbleed go buil

Minion plugin for checking Ticketbleed (CVE-2016-9244)

Minion Ticketbleed Plugin This is a plugin for Minion that run a check for Ticketbleed (CVE-2016-9244) vulnerability on F5 TLS layer The test can either runs as a go script or an linux binary The script is improved from [filippoio/Ticketbleed/](this site) Installation Clone the project with git clone githubcom/glestel/minion-ticket-bleed-plugingit Then in t

Домашнее задание к занятию "21 Системы контроля версий" В каталоге terraform будут проигнорированы файлы: все файлы и каталоги в каталоге terraform файлы, содержащие tfstate файлы с именем crashlog файлы с расширени�

CWE-200 https://support.f5.com/csp/article/K05121675 http://www.securitytracker.com/id/1037800 https://www.exploit-db.com/exploits/41298/https://filippo.io/Ticketbleed/https://blog.filippo.io/finding-ticketbleed/http://packetstormsecurity.com/files/141017/Ticketbleed-F5-TLS-Information-Disclosure.html https://github.com/0x00string/oldays/blob/master/CVE-2016-9244.py http://www.securityfocus.com/bid/96143 https://nvd.nist.gov https://github.com/EgeBalci/Ticketbleed https://www.exploit-db.com/exploits/41298/

Get Started

CVE-2016-9244

Vulnerability Summary

Vulnerability Trend

Exploits

Nmap Scripts

Github Repositories

References

Vulmon Search

About

Products

Connect