News for hackers. Stuff that matters.

A comment on Cisco Adaptive Security Appliance SNMP Remote Code Execution Vulnerability. Parent comment

Re:Cisco Adaptive Security Appliance SNMP Remote Code Execut... by tptacek on Wednesday August 17, 2016 @04:30PM (#12308200)
No, I'm saying you can't do that with this bug; that's what I mean by "not a pivot bug". It's a way of persisting inside access you got some other way. Because, again, people don't listen to SNMP on the outside interface.
[ Parent | on HN ]
Re:Cisco Adaptive Security Appliance SNMP Remote Code Execut... by throwaway5676 on Wednesday August 17, 2016 @05:18PM (#12308555)
And that is what the parent is saying. The "other way" is through the web server that is exposed to the internet and can reach the internal ASA.
[ Parent | on HN ]
Re:Cisco Adaptive Security Appliance SNMP Remote Code Execut... by tptacek on Wednesday August 17, 2016 @05:24PM (#12308596)
Reaching "the internal ASA" isn't giving you access the webserver didn't already have, hence, persisting, not pivoting.
[ Parent | on HN ]