alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"ET WEB_SERVER OptionsBleed (CVE-2017-9798)"; flow:established,to_client; http.header; header_lowercase; content:"allow|3a 20|"; pcre:"/^[^\n]+(?:[^ -~\x0d\x0a]|,\x20*,)/R"; reference:cve,CVE-2017-9798; classtype:misc-activity; sid:2024760; rev:6; metadata:affected_product Apache_HTTP_server, attack_target Server, created_at 2017_09_19, deployment Datacenter, performance_impact Significant, signature_severity Minor, updated_at 2024_04_20;)