CVE-2016-9244

A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninitialized…

published February 9, 2017

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.5th percentile for exploit probability.

CVSS
—
EPSS
74%
Percentile
99.5
In the wild
Unconfirmed
What it is

A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninitialized memory. A remote attacker may exploit this vulnerability to obtain Secure Sockets Layer (SSL) session IDs from other sessions. It is possible that other data from uninitialized memory may be returned as well.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.74000 · 99.5th percentile
Published
2017-02-09T15:00Z
EPSS history
Timeline
  • 22 SEP 03:13Z
    EPSS moved 74% → 63%
    epss
  • 06 SEP 03:09Z
    EPSS moved 74% → 63%
    epss
  • 30 AUG 15:36Z
    EPSS moved 63% → 74%
    epss
  • 29 AUG 04:15Z
    EPSS moved 74% → 63%
    epss
  • 09 FEB 15:00Z
    A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninitialized…
    cvelistv5