I've posted what I did (as best as I can recall) here: https://gist.github.com/anonymous/56afdedbf92ea98ba237

It's entirely possible I forgot something. I haven't built an RPM in years and didn't do it often in the first place. I almost didn't bother now except I can't entirely exclude the possibility that two RHEL3 servers that aren't going anywhere might have an attack vector hidden in them somewhere.

Edit: Changed link to fixed gist.

If that version is no longer supported by RedHat, you can compile the patched bash yourself, but you should really try to upgrade as there are probably other vulnerabilities in other components.