title: Can someone explain how this "Shellshock" code works in shell
body: <p>I read in the news that <a href="https://en.wikipedia.org/wiki/Shellshock_%28software_bug%29" rel="nofollow">Shellshock</a> is another bigger vulnerability after <a href="https://en.wikipedia.org/wiki/Heartbleed" rel="nofollow">Heartbleed</a>.
  The code to test if our <a href="http://en.wikipedia.org/wiki/Bash_%28Unix_shell%29" rel="nofollow">Bash</a> shell is vulnerable or not is:</p>
  
  <pre><code>env X="() { :;} ; echo shellshock" /bin/sh -c "echo completed"
  </code></pre>
  
  <p>In detail, how does this code exactly work? What does the code <code>env X="() { :;} ;</code> do? </p>
  
  <p>How is it vulnerable and can it be exploited if I am hosting a website in a Linux environment where the shell is vulnerable?</p>