If this is how passing functions is supposed to work in bash, then why do I get different results, depending on which system I'm on? I've been madly patching m

If this is how passing functions is supposed to work in bash, then why do I get different results, depending on which system I'm on? I've been madly patching my systems since yesterday and on a RHEL 6.5 system I get a different result than from an Ubuntu 12.04 system: [RHEL-6.5 tmp]$ uname -a Linux hostname1 2.6.32-431.23.3.el6.x86_64 #1 SMP Wed Jul 16 06:12:23 EDT 2014 x86_64 x86_64 x86_64 GNU/Linux [RHEL-6.5 tmp]$ bash --version GNU bash, version 4.1.2(1)-release (x86_64-redhat-linux-gnu) [RHEL-6.5 tmp]$ ls file1 file2 file3 [RHEL-6.5 tmp]$ env ls='() { echo vulnerable; }' bash -c ls file1 file2 file3 Linux hostname2 3.8.0-44-generic #66~precise1-Ubuntu SMP Tue Jul 15 04:01:04 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux Ubuntu 12.04:~/tmp$ bash --version GNU bash, version 4.2.25(1)-release (x86_64-pc-linux-gnu) Ubuntu 12.04:~/tmp$ ls file1 file2 file3 Ubuntu 12.04:~/tmp$ env ls='() { echo vulnerable; }' bash -c ls vulnerable Is this a basic difference in the feature sets of Bash 4.1 and Bash 4.2? Like several posters, I was unaware of this feature and have certainly never used it. Perhaps it should be off by defaults? How big of a mess would that make? I would also like to see more distributions use something other than bash as /bin/sh, but that's another discussion, I guess.