Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Affected Build Numbers

Is there any way someone from SolarWinds can provide corresponding build numbers for the affected version descriptions that would match what we can look up in the installer logs? That's the easiest way I can think of to go back through the history of updates and find exactly which version we were running between March and now, but I haven't found any table that shows something like this:

NPM 2019.4 HF2	119.4.8959.0
Orion Core 2019.4 HF4	119.4.20161.5220

That's just one example of a best guess I came up with from reading through the installer logs, but having the build numbers for the affected modules would be very helpful to identify if we were actually running the affected version.

Thank you!

Find more posts tagged with

Accepted answers

squatch

The latest CISA briefing had the information I was looking for. Sharing in case anyone else needed it too.

Currently known affected versions:
• Orion Platform 2019.4 HF5, version 2019.4.5200.9083
• Orion Platform 2020.2 RC1, version 2020.2.100.12219
• Orion Platform 2020.2 RC2, version 2020.2.5200.12394
• Orion Platform 2020.2, 2020.2 HF1, version 2020.2.5300.12432

All comments

neomatrix1217

You can run this query to see what you installed in the past

From the Database Manager

Select * from ConfigWizardLog where module = 'Orion Core Services'

jblankjblank

The SolarWinds Security Advisory has been updated. This also includes a link to a FAQ which should assist with some of these questions. These documents will continue to be updated as we obtain additional information.

squatch

@jblankjblank Thanks for the reply. I am checking the notices and FAQ and while the updated table in the FAQ is nice, more detail would be super helpful as multiple updates have been installed over the last year.

The only ways we have to go back to what was installed at each point in time is to go through the installer logs (current_setup.log.csv and CoreInstaller.msi.log) and thanks to @neomatrix1217 the SQL query. This is the data I've pulled out of the 3 locations I have for a particular patch date and you can see where the actual build numbers would be helpful.

5-13-2020 Patch Install Date

current_setup.log.csv - "CORE";"SolarWinds Orion Core";"Component";"2020.2.5220.27327";"Rc";"0"
CoreInstaller.msi.log - "SolarWinds Orion Core Services 2020.2. Product Version: 120.2.27327.5220"
DB Query - select * from ConfigWizardLog where module = 'Orion Core Services'
- Module - Orion Core Services
- Module Version - 2020.2.5200.12394

We installed updates in May, June, August, and lastly December, so the guidance to check the installed version with the website footer text, or add/remove program version doesn't work since the newest version replaces the historical version. If we had the affected builds in a format we can correlate to the methods above, we could at least have an idea if the files were there at some point.

At this point we'll likely just assume compromise and rebuild the server when a validated build comes out, but it may be helpful information for others.

Thanks again!

squatch

foonly

As of noon CST 12/21/2020, the DHS/CISA Alert Alert (AA20-352A) still confusingly combines versions for 2020.2 and 2020.2 HF1 on the same line.

The FAQ has links to KB articles for checking version and hotfix. Those KBs should be combined into a single KB, and

https://www.solarwinds.com/securityadvisory/faq under What indicators of compromise (IOCs) have you identified? shows Additional Hashes from Hotfix and Buddy drop releases without any HF, Buddy drop, or file references.

That FAQ still points to KB articles for checking versions which require Orion to be running.

Valuable links to Thwack posts or new KB articles should show how to check file and signing hash values. For example, this is a better way to check file hash than in the FAQ:

https://thwack.solarwinds.com/t5/NPM-Discussions/A-slightly-easier-way-to-find-the-hash-values-of-SolarWinds/m-p/613686

Doing a clean install:

https://thwack.solarwinds.com/t5/NPM-Discussions/Clean-Install-of-2020-2-1-HF2/m-p/613270#M151207

Ouberlord's post on how to check version via the SQL DB using SQL Management Studio:

https://thwack.solarwinds.com/t5/NPM-Discussions/Is-it-possible-to-directly-query-the-SQL-database-to-find-the/m-p/605052

Ultimately, I'd like to see a full version matrix showing versions and file hashes for every file in every installer. - with a side of fries, please!