The shell escaping fix in map_yp_alias (CVE-2009-1579) was incomplete.
Thanks Michal Hlavinka for noticing this. [CVE-2009-1381]