News for hackers. Stuff that matters.

A comment on Cisco Adaptive Security Appliance SNMP Remote Code Execution Vulnerability. Parent comment

Re:Cisco Adaptive Security Appliance SNMP Remote Code Execut... by revelation on Wednesday August 17, 2016 @04:28PM (#12308186)
That's what I was trying to say, you have access to a machine like a webserver that had internet-facing services you could exploit and now you want to go deeper into the network.

Or do they usually only speak SNMP on a management port?

[ Parent | on HN ]
Re:Cisco Adaptive Security Appliance SNMP Remote Code Execut... by tptacek on Wednesday August 17, 2016 @04:30PM (#12308200)
No, I'm saying you can't do that with this bug; that's what I mean by "not a pivot bug". It's a way of persisting inside access you got some other way. Because, again, people don't listen to SNMP on the outside interface.
[ Parent | on HN ]
Re:Cisco Adaptive Security Appliance SNMP Remote Code Execut... by throwaway5676 on Wednesday August 17, 2016 @05:18PM (#12308555)
And that is what the parent is saying. The "other way" is through the web server that is exposed to the internet and can reach the internal ASA.
[ Parent | on HN ]
Re:Cisco Adaptive Security Appliance SNMP Remote Code Execut... by tptacek on Wednesday August 17, 2016 @05:24PM (#12308596)
Reaching "the internal ASA" isn't giving you access the webserver didn't already have, hence, persisting, not pivoting.
[ Parent | on HN ]