I've been reading about the CVE-2014-6271 bug on lots of pages, but I'm still not able to understand how exactly is it possible to exploit it over ssh.
From all I've read, I couldn't find an example that executes a piece of code without being authenticated. I'm just trying to understand the bug better, no hacking involved.
An attacker can provide specially-crafted environment variables containing arbitrary commands that will be executed on vulnerable systems under certain conditions. The new issue has been assigned CVE-2014-7169.