NetSight
IP …
high7.5Public exploit code

CVE-2016-9244

A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninitialized m…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninitialized memory. A remote attacker may exploit this vulnerability to obtain Secure Sockets Layer (SSL) session IDs from other sessions. It is possible that other data from uninitialized memory may be returned as well.

Affected products

VendorProductAffected versions
F5Big-Ip Local Traffic Manager
Versions 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.2, 11.5.3
F5Big-Ip Application Acceleration Manager
Versions 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.2, 11.5.3
F5Big-Ip Advanced Firewall Manager
Versions 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.2, 11.5.3
F5Big-Ip Analytics
Versions 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.2, 11.5.3
F5Big-Ip Access Policy Manager
Versions 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.2, 11.5.3
F5Big-Ip Application Security Manager
Versions 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.2, 11.5.3
F5Big-Ip Global Traffic Manager
Versions 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.2, 11.5.3
F5Big-Ip Link Controller
Versions 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.2, 11.5.3
F5Big-Ip Policy Enforcement Manager
Versions 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.2, 11.5.3
F5Big-Ip Protocol Security Module
Versions 11.4.0, 11.4.1

Weakness classification

CWE-200

References