Code Compromise - Why is guidance from SolarWinds different than that of DHS and SANS?

As of this morning 12/15/20202, SolarWinds is still saying the latest product with hotfix 1 is safe:

"We recommend taking the following steps related to your use of the SolarWinds Orion Platform:

SolarWinds asks customers with any of the below products listed as known affected for Orion Platform v2020.2 with no hotfix or 2020.2 HF 1 to upgrade to Orion Platform version 2020.2.1 HF 1 as soon as possible to ensure the security of your environment."

However DHS and SANS say, “affected versions are 2019.4 through 2020.2.1 HF1”.

Hopefully DHS and the security community are just being overly-cautious. If 2020.2.1 HF1 is compromised and SolarWinds is leading customers to believe it is safe then their PR problems are going to be compounded.

Find more posts tagged with

Accepted answers

jason.carrier

We're in the process of working with DHS and SANS to get their pages updated.

This article provides steps to address the vulnerability and the SolarWinds Security Advisory describes it in more detail.

All comments

jason.carrier

We're in the process of working with DHS and SANS to get their pages updated.

This article provides steps to address the vulnerability and the SolarWinds Security Advisory describes it in more detail.

christopher.t.jones123

@jason.carrier The article with the versions affected is great. Thanks for providing that.

fakeusername

Hi Jason,

Can you share with us how this happened and how you can assure us that it will not happen again? From what I am hearing from SANS, the code was there from March through June and was not obfuscated in any way.

We upgraded to 2020.2.1 HF1 last night and then shut our systems down until further notice.

Thanks!

jason.carrier

The investigation is still active/ongoing and we'll share more details as we have them.

fakeusername

Thanks for the quick response.

fakeusername

Hi Jason,

I have been told that I can bring my systems back up as soon as I install HF2. Can you share when it will be available? I am assuming today, but I am wondering how close it is.

Thanks!

nato

Was it a poorly secured FTP server?