CB Response: Is Solr vulnerable to CVE-2017-3164?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Is Solr vulnerable to CVE-2017-3164 fixed in Solr 7.7?

Environment

CB Response Server: All Versions

Resolution

With IP tables set correctly this is not a vulnerability with the product. If you are not using CBR to manage iptables, ensure that the solr port 8080 is only accessible by the master and minions to master (if clustered). Solr admin console should be locked down to only IP's that need access.

Additional Information

Two product enhancements have been created to address this within the product. CB-26353 and CB-26354