==================================================================== CERT-Renater Note d'Information No. 2021/VULN078 _____________________________________________________________________ DATE : 05/02/2021 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running Orion Platform versions prior to 2020.2.4. ===================================================================== https://documentation.solarwinds.com/en/Success_Center/orionplatform/Content/release_notes/Orion_Platform_2020-2-4_release_notes.htm _____________________________________________________________________ Orion Platform 2020.2.4 Release Notes Release date: January 2021 These release notes describe the new features, improvements, and fixed issues in Orion Platform 2020.2.4. They also provide information about upgrades and describe workarounds for known issues. Learn more For information on latest hotfixes, see Orion Platform Hotfixes. For release notes for previous Orion Platform versions, see Previous Version documentation. For information about requirements, see Orion Platform 2020.2 system requirements. For information about working with the Orion Platform, see Orion Platform 2020.2 Administrator Guide. New features and improvements in Orion Platform Orion Platform 2020.2.4 offers new features and improvements compared to previous releases of Orion Platform. Orion Platform products are signed with a new digital code-signing certificate. New customer installation For information about installing Orion Platform, see the SolarWinds Orion Installer. How to upgrade If you are upgrading from Orion Platform 2015.1.3 or later, use the SolarWinds Orion Installer to simultaneously upgrade your entire Orion deployment (all Orion Platform products and any scalability engines) to the current versions. If you are upgrading from Orion Platform 2019.2, you can upgrade your entire Orion deployment from the My Orion Deployment page. Click Settings > My Orion Deployment > Updates & Evaluations. Downloading the Orion Installer is no longer necessary. If you are upgrading from an earlier Orion Platform version, use this topic to plan and implement an upgrade to the current version of Orion Platform. Fixed issues Orion Platform 2020.2.4 fixes the following issues. Case Number Description 346321, 442757, 484875, 492195, 504183, 564207, 574774, 581221, 584681, 601796, 615204, 622851, 628217, 633590, 636738, 639679, 641535, 643288, 647339, 652345, 654076, 655684, 668976 The issue where active Orion Agents were spamming Agent Management with connections was addressed. The consequences of this included High CPU usage, agents down, in incorrect states, or not being able to connect to the Orion Platform. 640028 The issue where volume status on WMI nodes was not updated when WMI polls timed out was addressed. 685480 The issue where alert and report actions that require writing to files stopped working after the upgrade was addressed. SolarWinds would like to thank our Security Researchers below for reporting on the issue in a responsible manner and working with our security, product, and engineering teams to fix the vulnerability. CVE-ID Description Severity Credit Authenticated Pending Improper Access Control Privilege Escalation Critical Trend Micro, Zero Day Initiative Yes CVE-2021-25274 MSMQ Remote Code Execution Critical Martin Rakhmanov, Trustwave No CVE-2021-25275 Unprivileged Users can get DBO owner Access High Martin Rakhmanov, Trustwave Yes Deprecation notices In Orion Platform 2020.2, the following platforms and features are deprecated. Deprecated platforms and features are still supported in the current release. However, they will be unsupported in a future release. Plan on upgrading deprecated platforms, and avoid using deprecated features. Customizations applied to a deprecated feature might not be migrated if a new feature replaces the deprecated one. For information about supported version of SolarWinds products, see Currently supported software versions. Type Details Legacy Orion Report Writer Starting with Orion Platform 2019.4, all out-of-the-box reports are web-based. In Orion Platform 2020.2, the Report Writer is only available in the ReadOnly mode. Migrate your custom reports to the web. You can no longer add new Report from Orion Report Writer widgets to your views. Existing Orion Report Writer widgets in views will remain in place. Network Atlas Network Atlas is deprecated as of this release and will be removed in a future release. SolarWinds recommends that you start using Orion Maps in the Orion Web Console to display maps of physical and logical relationships between entities monitored by the Orion Platform products you have installed. Legal notices © 2021 SolarWinds Worldwide, LLC. All rights reserved. This document may not be reproduced by any means nor modified, decompiled, disassembled, published or distributed, in whole or in part, or translated to any electronic medium or other means without the prior written consent of SolarWinds. All right, title, and interest in and to the software, services, and documentation are and shall remain the exclusive property of SolarWinds, its affiliates, and/or its respective licensors. SOLARWINDS DISCLAIMS ALL WARRANTIES, CONDITIONS, OR OTHER TERMS, EXPRESS OR IMPLIED, STATUTORY OR OTHERWISE, ON THE DOCUMENTATION, INCLUDING WITHOUT LIMITATION NONINFRINGEMENT, ACCURACY, COMPLETENESS, OR USEFULNESS OF ANY INFORMATION CONTAINED HEREIN. IN NO EVENT SHALL SOLARWINDS, ITS SUPPLIERS, NOR ITS LICENSORS BE LIABLE FOR ANY DAMAGES, WHETHER ARISING IN TORT, CONTRACT OR ANY OTHER LEGAL THEORY, EVEN IF SOLARWINDS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. The SolarWinds, SolarWinds & Design, Orion, and THWACK trademarks are the exclusive property of SolarWinds Worldwide, LLC or its affiliates, are registered with the U.S. Patent and Trademark Office, and may be registered or pending registration in other countries. All other SolarWinds trademarks, service marks, and logos may be common law marks or are registered or pending registration. All other trademarks mentioned herein are used for identification purposes only and are trademarks of (and may be registered trademarks) of their respective companies. ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================