Is this really relevant for OS X?
I mean, how many OS X users run services over the network that can spawn bash to service requests?
I guess the mainstream Mac user base does not know what a service is, and for them "bash" is something related to violence. For the remaining small set of developers and techies using Macs, this is likely also not very relevant: no one with a midge of computer knowledge leaves unnecessary services running, much less those that allow remote bash execution.
Not an Apple fan, by the way. But this bash bug is already being exposed out of proportion. Yes, Linux servers running software old enough to fork bash to do something can be affected. Yes, perhaps there are some appliances our there not using BusyBox that are affected. Rest of the machines, better look out for Linux infected machines trying to serve some malware, there's very little else you can/should do about it.