[comex]

Doesn't Ubuntu ship dash as /bin/sh already? dash isn't ksh, but it is minimalist (and not vulnerable to this).

[kag]

Yeah, it does. I meant Debian, but it looks like Debian changed too. My bad. My point was that changing /bin/sh from the distro-chosen one to something else could cause problems.