puppetlabs/puppetlabs-cve20113872 — Issue #69: pe_step1 remediation fails when incrementing "idx"
Author: djm68
Created: 2011-10-24 21:03:53+00:00
State: open

pe_step1_enable_intermediate_dns_name fails on all Debs and newer Centos systems when incrementing the "idx" counter from 0 to 1-=> returns 1. Oddly, when incrementing from 1 to 2, return code of 0 results, as expected. Spurious bash behavior to be sure -- this runs fine on Centos 5.5. Since the remediation scripts run with "set -e", any non zero status halts the script.

# Make sure certdnsnames are off. This will prevent the master from issuing
# additional agent certificates that may be used to impersonate the master.
idx=0
echo -n "Making sure certdnsnames are turned off (${puppetconf}) ..." >&2
ruby -p -l -i.backup.${timestamp}.${idx} -e \
'gsub(/^(\s*)(certdnsnames\b.*$)/) { "#{$1}# Disabled to mitigate CVE-2011-3872\n#{$1}# #{$2}" }' \
"${puppetconf}"
((idx++))

root@ubnt-1004-64-1:/etc/puppetlabs/puppet/modules/cve20113872/bin# idx=0
root@ubnt-1004-64-1:/etc/puppetlabs/puppet/modules/cve20113872/bin# (( idx++ )); echo $?; echo $idx
1
1
root@ubnt-1004-64-1:/etc/puppetlabs/puppet/modules/cve20113872/bin# (( idx++ )); echo $?; echo $idx
0
2