LD_PRELOAD trick to neuter the Shellshock bug CVE-2014-6271 if for some reason you can't patch bash.

gistfile1.c

// gcc -Wall -fPIC -shared -Wl,-init,anti_shellshock_init -o preload.so preload.c
// env EXPLOIT_CVE_2014_6271='() { :;}; echo WE ARE VULNERABLE' bash -c id
// env EXPLOIT_CVE_2014_6271='() { :;}; echo WE ARE VULNERABLE' LD_PRELOAD=$PWD/preload.so bash -c id

#include <stdio.h>
#include <string.h>

extern char **environ;

void anti_shellshock_init()
{
  //printf("Anti-Shellshock\n");

  char **envp = environ;
  for (; *envp; envp++) {
    if (strstr(*envp, "()")) { // this test needs hardening
      printf("REMOVING SHELLSHOCK VARIABLE: %s\n", *envp);
      char *eq = index(*envp, '=');
      if (eq)
        eq[1] = '\0';
    }
  }
}

The check for () is of course very rudimentary and should be replaced with a robust regexp or some such.
The printf isn't needed; it could be turned on with a test for e.g. ANTI_SHELLSHOCK_VERBOSE=1
The search for = should probably happen ahead of the previous check. (Is it possible to have *environ strings not contain an =? Probably not.)