F5 TLS Session Ticket Implementation Remote Memory Disclosure (Ticketbleed) (uncredentialed check)

Medium Nessus Plugin ID 97191


The remote device is affected by an information disclosure vulnerability.


Based on its response to a resumed TLS connection, the remote service appears to be affected by an information disclosure vulnerability, known as Ticketbeed, in the TLS Session Ticket implementation. The issue is due to the server incorrectly echoing back 32 bytes of memory, even if the Session ID was shorter. A remote attacker can exploit this vulnerability, by providing a 1-byte Session ID, to disclose up to 31 bytes of uninitialized memory which may contain sensitive information such as private keys, passwords, and other sensitive data.

Note that this vulnerability is only exploitable if the non-default Session Tickets option enabled.


Upgrade to a fixed version according to the vendor advisory (K05121675). Alternatively, disable the Session Ticket option on the affected Client SSL profile.

See Also




Plugin Details

Severity: Medium

ID: 97191

File Name: f5_session_id_mem_disclosure.nasl

Version: 1.14

Type: remote

Family: General

Published: 2017/02/15

Updated: 2020/06/12

Dependencies: 56984

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 5

Temporal Score: 3.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Temporal Vector: CVSS2#E:POC/RL:OF/RC:C

CVSS v3.0

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:f5:big-ip_access_policy_manager, cpe:/a:f5:big-ip_advanced_firewall_manager, cpe:/a:f5:big-ip_application_acceleration_manager, cpe:/a:f5:big-ip_application_security_manager, cpe:/a:f5:big-ip_application_visibility_and_reporting, cpe:/a:f5:big-ip_global_traffic_manager, cpe:/a:f5:big-ip_link_controller, cpe:/a:f5:big-ip_local_traffic_manager, cpe:/a:f5:big-ip_policy_enforcement_manager, cpe:/a:f5:big-ip_analytics, cpe:/h:f5:big-ip, cpe:/h:f5:big-ip_protocol_security_manager

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2017/02/09

Vulnerability Publication Date: 2017/02/09

Reference Information

CVE: CVE-2016-9244

EDB-ID: 41298