Bash vulnerability in Solaris 10

Question

http://seclists.org/oss-sec/2014/q3/650
https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/
Any plans for a hotfix for bash on Solaris 10?
$env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
vulnerable
this is a test
SunOS hostname 5.10 Generic_150401-13 i86pc i386 i86pc
$bash -version
GNU bash, version 3.2.51(1)-release (i386-pc-solaris2.10)
Copyright (C) 2007 Free Software Foundation, Inc.
$pkginfo -l SUNWbash
   PKGINST:  SUNWbash
      NAME:  GNU Bourne-Again shell (bash)
  CATEGORY:  system
      ARCH:  i386
   VERSION:  11.10.0,REV=2005.01.08.01.09
   BASEDIR:  /
    VENDOR:  Oracle Corporation
      DESC:  GNU Bourne-Again shell (bash) version 3.2
    PSTAMP:  sfw10-patch-x20120813130538
  INSTDATE:  Aug 19 2014 07:23
   HOTLINE:  Please contact your local service provider
    STATUS:  completely installed
     FILES:        4 installed pathnames
                   2 shared pathnames
                   2 directories
                   1 executables
                1250 blocks used (approx)

Answer 1

Hard to say whether it's safer to wait or safer to patch it yourself in the meantime but, if like me you'd rather not wait an indefinite period of time for a patch, here is a patching process that's working for me:
Found the newest GNU patch compiled for Solaris on Open CSW: bash - Solaris package
To install, you'll want the CSW package utility. Here are some instructions, but I'll also go over it below: Getting started — OpenCSW 0.2014.04 documentation
You may already have the CSW package utilities installed, check under "/opt/csw/bin" for "pkgutil". If it's not there, issue
pkgadd -d http://get.opencsw.org/now
Then, I like to add a symbolic link into /usr/bin to make it easier:
sudo ln -s /opt/csw/bin/pkgutil /usr/bin/pkgutil
Now we can do the install -- pkgutil is going to handle all the heavy lifting, dependency building etc., and place the new bash binary into "/opt/csw/bin"
sudo pkgutil -U
sudo pkgutil -a bash
sudo pkgutil -i bash
Follow the prompts, and then look under /opt/csw/bin for bash:
ls /opt/csw/bin | grep bash
If you see it listed there w/ a Sep 25th date (or later, if you're following these instructions in my future), then you're ready for the final step -- replacing the old bash binary with the new.
We're going to replace /usr/bin/bash with a link to /opt/csw/bin/bash. I was worried this step would crash running processes and applications (weblogic, BI, db instances), but so far no issues -- that said, PLEASE be careful and shutdown anything you can first! I can't be sure this step will work w/o any hiccups every time.
cd /usr/bin
sudo cp bash bash-old
sudo ln -f /opt/csw/bin/bash /usr/bin/bash
You can see we backed up the old bash install (4.1), in case something goes wrong. When finished, issue that command and you should see an error message now:
env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
this is a test
Again, BE CAREFUL -- while I was figuring this out, I did take down a couple zones to the point where I couldn't SSH back into them.
That said, the steps above are working flawlessly for me -- BUT I can't guarantee you'll have the same experience!