[lastofus]

Someone is responsible for maintaining/patching your servers. Either you are, or you are paying someone to do it.

If you are paying a company to do it, send 'em an email. If you are responsible, look into what it takes to install a bash upgrade. I was able to patch my own Ubuntu VMs in about shell 3 commands manually through SSH (yay apt-get). Took all of 10 mins reading up on documentation, logging in, hitting yes to prompts...

In all seriousness, the patching process shouldn't be too much more involved than patching your desktop OS for a small shop not worried about 100s of servers, load balancers/failover mechanisms, SLAs, etc...

[fifthesteight]

Thank you, too. The patching process wasnt as much my concern as the other widespread, clever exploits that really experienced bash dudes are finding.

Like we discussed, my concern is client sites hosted on a server I pay to be maintained... I did email the provider, and at the time was satisfied with their response so thats good.

So I really apprecuate all the input. I feel okay, though some funny behavior on old, stable sites makes me worry.

Thank you for your time.

I give myself a C- and will reevaluate.p