Seems to me that there is a need to remain online, esp. for business users and that even when this is corrected, there will be a need to go back online to get the Apple patch. e.g. Is removing bash a viable workaround to remain secure for the moment.
Business users can mitigate their risk using their perimeter IPS protection (or palo alto nextgen firewalls) for CVE-2014-6271 but need to wait for released protection on the related CVE-2014-7219 over the next 24 hours.
Source (in my case palo alto): https://securityadvisories.paloaltonetworks.com/
Here ia a basic set of pretty simple rules for an end user:
The purpose is to remove any remote access to a shell, may it be directly
/bin/bash or any other shell which may let switch to
/bin/bash and use it to escalate priviledge.
The patch for the bug is available here:
It is possible to Airdrop connect to another device, transfer the patch DMG from that device and then install the patch - all without connecting the target machine to the internet.