Aha, I found answers here: http://seclists.org/oss-sec/2014/q3/650 http://seclists.org/oss-sec/2014/q3/650 Basically, Bash interprets environment variables at

Aha, I found answers here: http://seclists.org/oss-sec/2014/q3/650 http://seclists.org/oss-sec/2014/q3/650 Basically, Bash interprets environment variables at start up as a means for you to pass functions into subshells. Whenever an environment variable's value starts with "() {", it is interpreted as a function, which is named according to the environment variable's name. I guess even without the bug under discussion this feature is a theoretical security flaw. If you set your user agent to "() { ping your.domain.com}", a function named HTTP_USER_AGENT, which pinged your.domain.com would exist in any shellThe name of the function is passed as the Apache spawned. It's not hard to imagine a buggy script accidentally executing it.