[admin@firefry ~]$ cat bashfilter.pl
#!/bin/env perl

# bashfilter.pl 
#
# This removes all environment variables beginning with "() {", which effectively disables bash's 'export -f' feature.
# As a side effect of disabling function exporting, attempts to exploit CVE-2014-6271 are blocked.
#
# To install, rename bash to bash.unsafe and link or move this script into place in its place.
# Be sure to have an account with an alternate shell available, and test before exiting your current shell.

use strict;
use warnings;
use diagnostics;

use Sys::Syslog;

my $UNSAFE_BASH;

$UNSAFE_BASH=$0 . ".unsafe" unless $UNSAFE_BASH;

foreach my $var (keys %ENV) {
        my $value=$ENV{$var};
        if ($value =~ /^\(\) {/) {
                delete $ENV{$var};
                openlog('bashfilter','ndelay,nofatal,perror','local0');
                syslog('warning',
                  "Blocked potential CVE-2014-6271 exploit attempt: var '%s' with value '%s' removed from environment.", $var, $value);
                closelog();
        }
}

exec { $UNSAFE_BASH } $0, @ARGV or die("Could not exec unsafe bash: $!");

[admin@firefry ~]$ ln -sf ./bashfilter.pl bash
[admin@firefry ~]$ ln -sf $(which bash) bash.unsafe
[admin@firefry ~]$ export BADVAR='() { x; } ; echo Gotcha!'
[admin@firefry ~]$ bash -c true
Gotcha!
[admin@firefry ~]$ ./bash -c true
[admin@firefry ~]$ sudo tail -n 1 /var/log/messages
Sep 26 10:32:31 firefry bashfilter: Blocked potential CVE-2014-6271 exploit attempt: var 'BADVAR' with value '() { x; } ; echo Gotcha!' removed from environment.
[admin@firefry ~]$

bash-4.3$ bash -c "f() { x() { _;}; x() { _;} <<a; }" 2>/dev/null || echo vulnerable
Segmentation fault
vulnerable
bash-4.3$