I don't think either you or the author are correct. hobbes@media:~$ env X='() { (a)=>\' sh -c "echo date"; cat echo date cat: echo: No such file or

I don't think either you or the author are correct. hobbes@media:~$ env X='() { (a)=>\' sh -c "echo date"; cat echo date cat: echo: No such file or directory hobbes@media:~$ uname -a Linux media 3.13-1-686-pae #1 SMP Debian 3.13.5-1 hobbes@media:~$ echo $BASH_VERSION 4.3.25(1)-release It looks to me like we're setting X in the environment, calling `sh -c "echo date"`, passing that X in to it, nothing happens, then we're cat'ing a file named echo, which does not get created in the first place, at least not on my machine. I played with the original test a bit. You can break it into two lines to see what is happening. For example: 1. hobbes@media:~$ export badvar='() { :;}; echo vulnerable' 2. hobbes@media:~$ bash -c "echo I am an innocent sub process in '$BASH_VERSION'" 3. bash: warning: badvar: ignoring function definition attempt 4. bash: error importing function definition for `badvar' 5. I am an innocent sub process in 4.3.25(1)-release 1. Create a specially crafted environment variable. Ok, it's done. But, nothing has happened! 2. Create an innocent sub process. Bash in this case. During initialization... 3. ...bash spots the specially formed variable (named badvar), prints a warning, 4. ...and apparently doesn't define the function at all? 5. But other than that, the child bash runs as expected. 1. hobbes@metal:~$ export badvar='() { :;}; echo vulnerable' 2. hobbes@metal:~$ bash -c "echo I am an innocent sub process in '$BASH_VERSION'" 3. vulnerable 4. I am an innocent sub process in 4.3.22(1)-release 1. Create a specially crafted environment variable. Ok, it's done. But, nothing has happened! 2. Create an innocent sub process. Bash in this case. During initialization... 3. ...bash accidentally EXECUTES a snippet that was inside the variable named 'badvar'?! 4. But other than that, the child bash runs as expected. Wow, I should update that machine. :)