How to test the bash CVE-2014-6271?

Question

Question: How do I know that I am affected or not by the bash CVE-2014-6271?

I just have to simply run a command on the server?

$ env x='() { :;}; echo vulnerable'  bash -c "echo this is a test"
vulnerable
this is a test
$

Not using it via SSH and example using ksh (but bash is installed).

UPDATE: if bash isn't the default shell, wouldn't it be easier to test it with:

bash -c "env x='() { :;}; echo vulnerable' bash -c echo this is a test"

UPDATE#2: the first part doesn't need bash.

Answer 1

Try this code in your bash terminal. If your server is patched and the bug is fixed you got an error.

test="() { echo Hello; }; echo gehackt" bash -c ""