The new patch "bash-X.X-env-inject2.patch" is actually http://seclists.org/oss-sec/2014/q3/att-690/eol-pushback.patch http://seclists.org/oss-sec/2014/q3/att-69

The new patch "bash-X.X-env-inject2.patch" is actually http://seclists.org/oss-sec/2014/q3/att-690/eol-pushback.patch http://seclists.org/oss-sec/2014/q3/att-690/eol-pushback.pat... which doesn't work in bash-3.2 from CentOS 5: $ bash --version GNU bash, version 3.2.25(1)-release (i686-redhat-linux-gnu) Copyright (C) 2005 Free Software Foundation, Inc. $ env -i X='() { (a)=<\' bash -c '/etc/crontab cat' bash: X: line 1: syntax error near unexpected token `=' bash: X: line 1: `' bash: error importing function definition for `X' SHELL=/bin/bash PATH=/sbin:/bin:/usr/sbin:/usr/bin MAILTO=root HOME=/ # run-parts 01 * * * * root run-parts /etc/cron.hourly 02 4 * * * root run-parts /etc/cron.daily 22 4 * * 0 root run-parts /etc/cron.weekly 42 4 1 * * root run-parts /etc/cron.monthly for reference, thats how other shell behaves: busybox$ env -i X='() { (a)=<\' ./busybox hush -c '/etc/crontab cat' hush: can't execute '/etc/crontab': Permission denied