I'm double-mistaken. This is a month old. So, back to the original message. If you are just hearing about it, you really need to update your security news feeds, if you are responsible for any systems that have bash on them.
What would you suggest?
Interestingly, I see many references to 6271 and 7169 but nothing for 6277. Can anyone break this down better?
Deleted comment
Date Entry Created: 20140909
That happened here, the vuln itself is... um, around two weeks old.
Do you know if the more recent patches, {27..30}, are also vulnerable to this CVE?
Your bash is safe if it has a patch level equivalent to bash 4.3-027 (released 27-Sep-2014 22:38). Several distros had the equivalent patch by Florian Weimer already a day earlier. The later bash patches fixed the underlying bugs, but that patch removed the attack surface (but introduced a backwards compatibility problem for the very, very few programs (I don't know of any) that actually create shell functions to be inherited by bash).
http://unix.stackexchange.com/questions/158767/which-debian-...
It looks like Debian may have applied something to make the attack not exploitable, even though it still segfaults. Seems weird to me, but it's the best explanation I have.
As I explained above, the patch for CVE-7169 by Florian Weimer made bash invulnerable to code injection by arbitrary environment variables. The underlying bugs CVE-6277 and CVE-6278 therefore have no known attack vector from outside bash, though they can still be triggered from a shell script or the command line if they are not patched. Theoretically, they could become part of a different attack, so it's wise to patch them, but there's no hurry, since as long as you or Debian have applied the abovementioned patch for CVE-7169, it means there's currently no publicly-known exploit.
Also, Debian uses dash as its version of sh, so the problem can only occur if bash is called explicitly.