Notice how in my first test, I called sh? Some OSes (these examples were from a MacOS X box) use bash for sh.

You should run the tests and check if you're vulnerable. Don't just think 'oh, it won't happen to me, I'm using ksh', as perl may still send to a vulnerable sh:

sh-3.2$ ksh
$ set -o emacs
$ env x='() { :;}; echo vulnerable' ksh -c "echo this is a test"
this is a test
$ env x='() { :;}; echo vulnerable' perl -e 'system "echo test;"'
vulnerable
test
[download]