CVE-2016-9244
HighSummary
A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninitialized memory. A remote attacker may exploit this vulnerability to obtain Secure Sockets Layer (SSL) session IDs from other sessions.
Risk Assessment
The organization may be at risk of session ID theft, potentially leading to unauthorized access to user data. The leakage of other data from uninitialized memory may also pose a threat to information confidentiality.
Recommendation
It is recommended to disable the Session Tickets option in Client SSL profiles to minimize the risk of data leakage. Regular updates and monitoring of server configurations will also help secure the system.
Other vulnerabilities in BIG-IP virtual server
Original NVD description (English source)
A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninitialized memory. A remote attacker may exploit this vulnerability to obtain Secure Sockets Layer (SSL) session IDs from other sessions. It is possible that other data from uninitialized memory may be returned as well.