I've fixed shellshock bug on my Debian 6 server and while testing on http://shellshock.brandonpotter.com/ I get "No Vulnerabilities Found" and that's OK but they also check other things and in the test log I get:
URL mydomain.net (Root URL) (Header User-Agent exploit attempted with () { :;}; wget)... 200 OK
URL mydomain.net (Root URL) (Header User-Agent exploit attempted with () { :;}; curl)... 200 OK
URL mydomain.net (Root URL) (Header User-Agent exploit attempted with () { :;}; /usr/local/bin/wget)... 200 OK
URL mydomain.net (Root URL) (Header User-Agent exploit attempted with () { :;}; /usr/bin/wget)... 200 OK
URL mydomain.net (Root URL) (Header User-Agent exploit attempted with () { (a)=>' bash -c 'wget)... 200 OK
URL mydomain.net (Root URL) (Header User-Agent exploit attempted with () { (a)=>' bash -c 'curl)... 200 OK
URL mydomain.net (Root URL) (Header User-Agent exploit attempted with () { (a)=>' bash -c '/usr/local/bin/wget)... 200 OK
URL mydomain.net (Root URL) (Header User-Agent exploit attempted with () { (a)=>' bash -c '/usr/bin/wget)... 200 OK
URL mydomain.net (Root URL) (Header Cookie exploit attempted with () { :;}; wget)... 200 OK
URL mydomain.net (Root URL) (Header Cookie exploit attempted with () { :;}; curl)... 200 OK
URL mydomain.net (Root URL) (Header Cookie exploit attempted with () { :;}; /usr/local/bin/wget)... 200 OK
...
...
...
"200 OK" is this ok? 200 means accesable. I've check couple other domains and some of them show also "200 OK" but other show "Error".
Can it stay like this or should I fix this? If yes, how can I do that?