Note that Apple has not provided updates for older systems. If you have an older system and wish to patch, I have been keeping my blog post [1] updated along with the canonical StackExchange answer [2].

Note that the patch from Apple allows bash functions to be escaped, albeit with a BASH_FUNC prefix - but you can get around this by using:

$ env '__BASH_FUNC<ls>()'="() { echo Game Over; }" bash -c ls

Game Over

[1] http://alblue.bandlem.com/2014/09/bash-remote-vulnerability....

[2] http://apple.stackexchange.com/questions/146849/