{"vulnerability": "CVE-2019-5436", "sightings": [{"uuid": "21a5042c-8684-4dde-9af5-df0c5d3a725e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5436", "type": "published-proof-of-concept", "source": "https://t.me/critical_bug/616", "content": "https://hackerone.com/reports/684603\n\n\u0414\u0430\u043d\u043d\u044b\u0439 \u0440\u0435\u043f\u043e\u0440\u0442 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 curl. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 TFTP \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0435 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 OACK (\u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0435 \u043e\u043f\u0446\u0438\u0439), \u0430 \u0441\u0440\u0430\u0437\u0443 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u0431\u043b\u043e\u043a \u0441 \u0440\u0430\u0437\u043c\u0435\u0440\u043e\u043c \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e (512 \u0431\u0430\u0439\u0442), \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430 curl \u043d\u0435 \u0443\u0447\u0438\u0442\u044b\u0432\u0430\u0435\u0442 \u044d\u0442\u043e\u0442 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0439 \u0440\u0430\u0437\u043c\u0435\u0440 \u0431\u043b\u043e\u043a\u0430 \u0438 \u0432\u043c\u0435\u0441\u0442\u043e \u044d\u0442\u043e\u0433\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u0435\u0442 \u043a\u043e\u043d\u0435\u0446 \u0444\u0430\u0439\u043b\u0430. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442\u0441\u044f \u043e\u0431\u0440\u0435\u0437\u0430\u043d\u043d\u044b\u0439 \u0444\u0430\u0439\u043b \u0434\u043b\u0438\u043d\u043e\u0439 512 \u0431\u0430\u0439\u0442 \u0431\u0435\u0437 \u043a\u043e\u0434\u0430 \u043e\u0448\u0438\u0431\u043a\u0438. \n\n\u041f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u0432\u0435\u0440\u043d\u0443\u0442\u044c \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0432 \u043a\u043e\u0434\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0431\u044b\u043b\u0438 \u0432\u043d\u0435\u0441\u0435\u043d\u044b \u0440\u0430\u043d\u0435\u0435 \u0432 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2019-5436. \u0418\u043b\u0438 \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043c\u0435\u043d\u0438\u0442\u044c \u0442\u0435\u043a\u0443\u0449\u0443\u044e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 malloc \u0434\u043b\u044f \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438\u0435\u043c\u0430 \u043d\u0430 \u0431\u0443\u0444\u0435\u0440 \u0440\u0430\u0437\u043c\u0435\u0440\u043e\u043c \u043d\u0435 \u043c\u0435\u043d\u044c\u0448\u0435 512 \u0431\u0430\u0439\u0442 \u0438\u043b\u0438 \u0436\u0435 \u043d\u0430 \u0431\u0443\u0444\u0435\u0440, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u044b\u043b \u0437\u0430\u043f\u0440\u043e\u0448\u0435\u043d \u0434\u0440\u0443\u0433\u0438\u043c \u0440\u0430\u0437\u043c\u0435\u0440\u043e\u043c \u0431\u043b\u043e\u043a\u0430. \n\n\u0414\u043b\u044f \u0432\u043e\u0441\u043f\u0440\u043e\u0438\u0437\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0448\u0438\u0431\u043a\u0438 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0448\u0430\u0433\u0438:\n\n1. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c TFTP \u0441\u0435\u0440\u0432\u0435\u0440, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0435 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 OACK \u0432 \u043e\u0442\u0432\u0435\u0442 \u043d\u0430 \u0437\u0430\u043f\u0440\u043e\u0441 \u0431\u043b\u043e\u043a\u0430 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0440\u0430\u0437\u043c\u0435\u0440\u0430, \u0430 \u0432\u043c\u0435\u0441\u0442\u043e \u044d\u0442\u043e\u0433\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u043f\u0435\u0440\u0432\u044b\u0439 \u0431\u043b\u043e\u043a \u0440\u0430\u0437\u043c\u0435\u0440\u043e\u043c \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e (512 \u0431\u0430\u0439\u0442).  \n2. \u0417\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c curl \u0441 \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u0435\u043c \u0440\u0430\u0437\u043c\u0435\u0440\u0430 \u0431\u043b\u043e\u043a\u0430 \u0431\u043e\u043b\u044c\u0448\u0435\u0433\u043e, \u0447\u0435\u043c 512 \u0431\u0430\u0439\u0442. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440: \n```\ncurl --tftp-blksize 8192 tftp://9.1.9.1/data.bin --output data.bin\n ```\n3. \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c, \u0447\u0442\u043e \u043a\u043e\u0434 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0440\u0430\u0432\u0435\u043d 0, \u043d\u043e \u0440\u0430\u0437\u043c\u0435\u0440 \u0444\u0430\u0439\u043b\u0430 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 512 \u0431\u0430\u0439\u0442.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043e\u0431\u0440\u0435\u0437\u0430\u043d\u0438\u044e \u0444\u0430\u0439\u043b\u043e\u0432 \u0431\u0435\u0437 \u043a\u043e\u0434\u0430 \u043e\u0448\u0438\u0431\u043a\u0438.", "creation_timestamp": "2023-04-22T21:55:42.000000Z"}, {"uuid": "61a500f1-3da6-48b0-8efc-0ecc2234750d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5436", "type": "seen", "source": "https://t.me/hacking_Attack/142015", "content": "Need help by.\nhttps://www.reddit.com/r/Pentesting/comments/1f9w70a/need_help_by/\n\nHello everyone, I'm a student currently learning pentesting, and I've come across a website that is vulnerable to CVE-2019-5436. To better understand the vulnerability, I set up a VM that's also vulnerable to this issue. However, I'm currently stuck trying to develop an exploit for it. My goal isn't for someone to just hand me the exploit (although I wouldn\u2019t mind it!), but rather to get guidance on how to approach building it. I\u2019d appreciate advice on how the exploit should work, as well as recommendations on which programming language would be best suited for this task. Any help or pointers would be greatly appreciated! Thanks in advance!    submitted by    /u/AirlineCurious3456  (https://www.reddit.com/user/AirlineCurious3456) \n [link] (https://www.reddit.com/r/Pentesting/comments/1f9w70a/need_help_by/)   [comments] (https://www.reddit.com/r/Pentesting/comments/1f9w70a/need_help_by/)", "creation_timestamp": "2026-09-01T20:00:31.148614Z"}, {"uuid": "5052e35a-58a2-4ab7-b842-ab59c1e78b37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5436", "type": "seen", "source": "https://t.me/hacking_Attack/142015", "content": "Need help by.\nhttps://www.reddit.com/r/Pentesting/comments/1f9w70a/need_help_by/\n\nHello everyone, I'm a student currently learning pentesting, and I've come across a website that is vulnerable to CVE-2019-5436. To better understand the vulnerability, I set up a VM that's also vulnerable to this issue. However, I'm currently stuck trying to develop an exploit for it. My goal isn't for someone to just hand me the exploit (although I wouldn\u2019t mind it!), but rather to get guidance on how to approach building it. I\u2019d appreciate advice on how the exploit should work, as well as recommendations on which programming language would be best suited for this task. Any help or pointers would be greatly appreciated! Thanks in advance!    submitted by    /u/AirlineCurious3456  (https://www.reddit.com/user/AirlineCurious3456) \n [link] (https://www.reddit.com/r/Pentesting/comments/1f9w70a/need_help_by/)   [comments] (https://www.reddit.com/r/Pentesting/comments/1f9w70a/need_help_by/)", "creation_timestamp": "2026-09-02T01:00:49.092488Z"}]}