http://seclists.org/oss-sec/2014/q3/650
https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/
Any plans for a hotfix for bash on Solaris 10?
$env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
vulnerable
this is a test
SunOS hostname 5.10 Generic_150401-13 i86pc i386 i86pc
$bash -version
GNU bash, version 3.2.51(1)-release (i386-pc-solaris2.10)
Copyright (C) 2007 Free Software Foundation, Inc.
$pkginfo -l SUNWbash
PKGINST: SUNWbash
NAME: GNU Bourne-Again shell (bash)
CATEGORY: system
ARCH: i386
VERSION: 11.10.0,REV=2005.01.08.01.09
BASEDIR: /
VENDOR: Oracle Corporation
DESC: GNU Bourne-Again shell (bash) version 3.2
PSTAMP: sfw10-patch-x20120813130538
INSTDATE: Aug 19 2014 07:23
HOTLINE: Please contact your local service provider
STATUS: completely installed
FILES: 4 installed pathnames
2 shared pathnames
2 directories
1 executables
1250 blocks used (approx)