For those who still have Debian Squeeze and wonder where to find the fixed Bash Debian package for the dangerous bash bug (http://www.bbc.co.uk/news/technology-29361794)you can find it here:
64 Bit:
ftp://ftp.fr.debian.org/debian/pool/main/b/bash/bash_4.1-3+deb6u2_amd64.deb
32 Bit:
ftp://ftp.fr.debian.org/debian/pool/main/b/bash/bash_4.1-3+deb6u2_i386.deb
Want to test your Bash to see if it is fixed? Run the command:
test="() { echo Hello; }; echo Buggy" bash -c ""
Nothing should appear as result if it’s fixed,
and the word ‘Buggy’ will appear if bash is not yet fixed.
For Debian Wheezy the upgrade is simple:
apt-get update && apt-get install bash
In case for some obscure reason you are still running Debian Lenny (Not recommended) and want to fix bash then use the lastest Squeeze compiled version which has all its libraries compiled with it,. It is called bash-static and it is found at:
ftp://ftp.fr.debian.org/debian/pool/main/b/bash/bash-static_4.1-3+deb6u2_amd64.deb