Address the SolarWinds.Orion.Core.BusinessLayer.dll security vulnerability in Orion Platform

12/15/2020 9:14 AM

2/17/2022 11:31 PM

This article addresses the disclosed security vulnerability with SolarWinds.Orion.Core.BusinessLayer.dll in Orion Platform 2019.4 Hotfix 5, Orion Platform 2020.2, and Orion Platform 2020.2 Hotfix 1. Follow the steps below to determine if your version was affected and, if so, how to proceed.

See SolarWinds Security Advisory and also FAQ: Security Advisory for details about the vulnerability. 

Orion Platform

 

Identify which Orion Platform version you're currently using

Log in to the Orion Web Console and examine the footer, as shown below. You can also find version details in the SolarWinds Orion Installer or Windows Control Panel; see Determine which version of a SolarWinds Orion product I have installed.

Determine if you need to update your installation

If you use Orion Platform 2019.2 or earlier, your version was not affected.

If you use Orion Platform 2019.4, check the version number in the footer of the Orion Web Console.

• If you use Orion Platform 2019.4 with Hotfix 1, 2, 3, or 4, your version was not affected.

• If you use Orion Platform 2019.4 with Hotfix 5 with active maintenance, apply the Orion Platform 2019.4 Hotfix 6. To determine if you have active maintenance, check the SolarWinds Customer Portal.

  

• If you use Orion Platform 2019.4 with Hotfix 5 without active maintenance, apply the Orion Platform 2019.4 Hotfix 5 Security Fix.

  

  Important: If you use Orion Platform 2019.4 and you do not want to upgrade to a later version, download the relevant hotfix from the SolarWinds Customer Portal and install it. If you want to upgrade to the latest version, perform a centralized upgrade from within the Orion Web Console.

If you use Orion Platform 2020.2 with or without hotfixes, you'll need to:

1. Upgrade to Orion Platform 2020.2.1.

2. Apply Orion Platform 2020.2.1 Hotfix 2.

   

If you use Orion Platform 2020.2.1 with or without Hotfix 1, your version was not affected. However, SolarWinds recommends applying Orion Platform 2020.2.1 Hotfix 2.

FAQs

Why does our antivirus software tag the hotfix and SolarWinds.Orion.CoreBusinesslayer.dll files as being infected? Make sure your virus definitions are up-to-date. If the issue occurs in future scans, please submit a Support ticket that includes the antivirus product name, version, and name of the file(s).

I installed updates and the latest product versions appear in the footer of the Orion Web Console. When I examine products in the Apps & features area of Windows Settings, why does version 2020.2 still appear? That's a Known Issue for VMAN, SRM, VOIP, UDT, NCM, Engineer's Toolset for the Web, and DPAIM. The version displayed in the bottom of the Orion Web Console is accurate.

What is "active maintenance"? When you purchase an Orion Platform product, SolarWinds automatically includes one year of maintenance, which includes product updates and 24/7 support for a full year without an additional charge. After the first year, your annual renewal preserves your access to SolarWinds software updates, support, and virtual instructor-led product training. Click here for details. To determine if your license includes active maintenance, check the SolarWinds Customer Portal.

I'm upgrading from Orion Platform 2020.2. When I run the SolarWinds Orion Installer after downloading a hotfix, why does it say "No updates available"? You probably downloaded the hotfix for 2020.2.1, but you need to upgrade from 2020.2 to 2020.2.1 first. Then you'll be able to install Orion Platform 2020.2.1 Hotfix 2.

We have Orion Platform 2020.2.1 with Hotfix 1. How do I check for the latest updates? Click Settings > My Orion Deployment in the Orion Web Console. Switch to the Updates & Evaluations tab. Under "What Do You Want To Do Today," click Make a Plan.