The shell escaping fix in map_yp_alias (CVE-2009-1579) was incomplete.