RULE（RULE ID：321884）

Rule General Information
Release Date: 2019-06-20
Rule Name: Apache httpd FilesMatch Policy Bypass Vulnerability (CVE-2017-15715)
Severity:
CVE ID:
Rule Protection Details
Description: In Apache httpd 2.4.0 to 2.4.29, the expression specified in could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the trailing portion of the filename.
Impact: An attacker can take advantage of the vulnerability to bypass the security policy implemented by the software administrator, and perform unauthorized actions to the target system.
Affected OS: Windows, Linux, FreeBSD, Solaris, Other Unix, Network Device, Mac OS, iOS, Android, Others
Reference: SecurityFocusBID:103525
http://www.openwall.com/lists/oss-security/2018/03/24/6
SecurityTrackerID:1040570
https://access.redhat.com/errata/RHSA-2018:3558
Solutions
The vendors have released upgrade patches to fix vulnerabilities, please visit:
https://httpd.apache.org/security/vulnerabilities_24.html