debian-derived distros are not affected

gistfile1.txt

TL;DR if you're running a modern Debian-derived distro, /bin/sh is linked to dash,
and so your applications are probably not vulnerable to the bashbug. Anything which
explicitly calls /bin/bash is vulnerable until you update.


user@computer:~$ env x='() { :;}; echo vulnerable' bash -c echo 1
vulnerable

user@computer:~$ env x='() { :;}; echo vulnerable' dash -c echo 1

user@computer:~$ env x='() { :;}; echo vulnerable' python
Python 2.7.6 |Anaconda 1.9.2 (64-bit)| (default, Jan 17 2014, 10:13:17) 
[GCC 4.1.2 20080704 (Red Hat 4.1.2-54)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import subprocess
>>> subprocess.Popen(['whoami'])
<subprocess.Popen object at 0x7f2b40a9ee50>
>>> user

>>> subprocess.Popen('whoami', shell=True)
<subprocess.Popen object at 0x7f2b40a9ee90>
>>> user

>>> subprocess.Popen('echo $x', shell=True)
<subprocess.Popen object at 0x7f2b40a9eed0>
>>> () { :;}; echo vulnerable


The reason this doesn't work is that it's calling /bin/sh, which on Ubuntu 
and Debian-derived distros is linked to dash:
user@computer:~$ ls -l /bin/sh
lrwxrwxrwx 1 root root 4 Feb 19  2014 /bin/sh -> dash

user@computer:~$ env x='() { :;}; echo vulnerable' /bin/sh -c echo 1

user@computer:~$ 

dash is not affected, so your /bin/sh is not affected, so your http/cgi/whatever else is not affected.