Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Same compromised thumbprint after update to 2020.2.1 HF2 SolarWinds.Orion.Core.BusinessLayer.dll

Hello Everyone,

We've upgraded to 2020.2.1 HF2 using the offline installer.
We checked SolarWinds.Orion.Core.BusinessLayer.dll and it still had the old timestamp (the xml file however was updated) with the compromised thumbprint

We've downloaded the 2020.2.1 HF2 Hotfix as well and ran it but it said all was updated.

Does anyone have this as well? How do we fix it? Thanks!

Best Regards,

Find more posts tagged with

Accepted answers

danielleh

Hash for BL of 2020.2.1 HF2 is CC870C07EEB672AB33B6C2BE51B173AD5564AF5D98BFC02DA02367A9E349A76F.

All comments

stevenstadel

If you want to confirm manually you don't have the affected DLL try the info at https://www.solarwinds.com/securityadvisory/faq

Check under "I want to manually check my version of the SolarWinds.Orion.Core.BusinessLayer.dll for the vulnerability. Do you know a way to do that?"

Look at the file hash with PowerShell

Get-FileHash "C:\Program Files (x86)\SolarWinds\Orion\SolarWinds.Orion.Core.BusinessLayer.dll"

Looks like the new hash with 2020.2.1 HF 2 version of SolarWinds.Orion.Core.BusinessLayer.dll is CC870C07EEB672AB33B6C2BE51B173AD5564AF5D98BFC02DA02367A9E349A76F

The affected versions of the DLL are listed in that FAQ

neomatrix1217

So two options

1. Install the full application as highlighted below not the hotfix

2. You can also click on the Orion Deployment and then "Make a Plan" if using the Orion Web Console. after selecting make a plan you will see the updates then click start downloading.

danielleh

This just reflects the fact that we used a new certificate to sign it.

kneel23

Could you clarify this? The thumbprint is the same as the one that was considered compromised (and given to everyone by Solarwinds). its not new. If a new certificate was used to sign it, wouldn't the thumbprint and timestamp change?

In addition, the FAQ identifies SHA256 hashes of affected vulnerable versions but we have not seen official confirmation of the "fixed" versions' hash of CC870C07EEB672AB33B6C2BE51B173AD5564AF5D98BFC02DA02367A9E349A76F

allen

Thank you for the response @danielleh

Can we confirm that solarwinds wants us to have and the uncompromised SolarWinds.Orion.Core.BusinessLayer.dll has these?

Hash: CC870C07EEB672AB33B6C2BE51B173AD5564AF5D98BFC02DA02367A9E349A76F
Thumbprint/signerhash: 47d92d49e6f7f296260da1af355f941eb25360c4

Best Regards,

danielleh

Hash for BL of 2020.2.1 HF2 is CC870C07EEB672AB33B6C2BE51B173AD5564AF5D98BFC02DA02367A9E349A76F.

allen

Thank you @danielleh !