NOTE: Oracle continue to release official patches as they become available. If you have access to the support repository, a pkg update will install the latest official version.
UPDATE: The Bash version and method to patch has been updated. If /opt is on a different filesystem to /usr the fix below may not be suitable.
The actual bash and bashbug binaries can be downloaded from http://www.solarismultimedia.com/files/bash.tar.gz. You can use these binaries if you only want to replace /usr/bin/bash and /usr/bin/bashbug. Below is the alternative fix that should be used if you're running Solaris 11.
The binary is version 4.1.17(2) which includes all known Shellshock patches as of posting (09 Oct 2014).
Please note that I have only done limited testing. Ensure that you install the official updates from Oracle as they become available.
All steps below need to be done by a user with elevated privileges.
If you've already added my repository to your Solaris 11 installation the following command will install Bash 4.1.17(2).