CVEvulnerability

CVE-2016-9244

7.5 HIGH Published 2017-02-09 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-02-09
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-200

Description

A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninitialized memory. A remote attacker may exploit this vulnerability to obtain Secure Sockets Layer (SSL) session IDs from other sessions. It is possible that other data from uninitialized memory may be returned as well.

Affected configurations

• f5 big-ip local traffic manager 11.4.0 • f5 big-ip local traffic manager 11.4.1 • f5 big-ip local traffic manager 11.5.0 • f5 big-ip local traffic manager 11.5.1 • f5 big-ip local traffic manager 11.5.2 • f5 big-ip local traffic manager 11.5.3 • f5 big-ip local traffic manager 11.5.4 • f5 big-ip local traffic manager 11.6.0 • f5 big-ip local traffic manager 11.6.1 • f5 big-ip local traffic manager 12.0.0 • f5 big-ip local traffic manager 12.1.0 • f5 big-ip local traffic manager 12.1.1 • f5 big-ip local traffic manager 12.1.2 • f5 big-ip application acceleration manager 11.4.0 • f5 big-ip application acceleration manager 11.4.1 • f5 big-ip application acceleration manager 11.5.0 • f5 big-ip application acceleration manager 11.5.1 • f5 big-ip application acceleration manager 11.5.2 • f5 big-ip application acceleration manager 11.5.3 • f5 big-ip application acceleration manager 11.5.4 • f5 big-ip application acceleration manager 11.6.0 • f5 big-ip application acceleration manager 11.6.1 • f5 big-ip application acceleration manager 12.0.0 • f5 big-ip application acceleration manager 12.1.0 • f5 big-ip application acceleration manager 12.1.1 • f5 big-ip application acceleration manager 12.1.2 • f5 big-ip advanced firewall manager 11.4.0 • f5 big-ip advanced firewall manager 11.4.1 • f5 big-ip advanced firewall manager 11.5.0 • f5 big-ip advanced firewall manager 11.5.1 • f5 big-ip advanced firewall manager 11.5.2 • f5 big-ip advanced firewall manager 11.5.3 • f5 big-ip advanced firewall manager 11.5.4 • f5 big-ip advanced firewall manager 11.6.0 • f5 big-ip advanced firewall manager 11.6.1 • f5 big-ip advanced firewall manager 12.0.0 • f5 big-ip advanced firewall manager 12.1.0 • f5 big-ip advanced firewall manager 12.1.1 • f5 big-ip advanced firewall manager 12.1.2 • f5 big-ip analytics 11.4.0 • f5 big-ip analytics 11.4.1 • f5 big-ip analytics 11.5.0 • f5 big-ip analytics 11.5.1 • f5 big-ip analytics 11.5.2 • f5 big-ip analytics 11.5.3 • f5 big-ip analytics 11.5.4 • f5 big-ip analytics 11.6.0 • f5 big-ip analytics 11.6.1 • f5 big-ip analytics 12.0.0 • f5 big-ip analytics 12.1.0 • f5 big-ip analytics 12.1.1 • f5 big-ip analytics 12.1.2 • f5 big-ip access policy manager 11.4.0 • f5 big-ip access policy manager 11.4.1 • f5 big-ip access policy manager 11.5.0 • f5 big-ip access policy manager 11.5.1 • f5 big-ip access policy manager 11.5.2 • f5 big-ip access policy manager 11.5.3 • f5 big-ip access policy manager 11.5.4 • f5 big-ip access policy manager 11.6.0 … and 55 more

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References