Rule History

SID: 2039618 • Source: et/open

Versions (4)

Version DetailsCurrent

Rev: 1 • Nov 1, 2022, 12:00 PM

Message:

ET EXPLOIT Possible OpenSSL Punycode Email Address Buffer Overflow Attempt Inbound (CVE-2022-3602)

Rule:

alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible OpenSSL Punycode Email Address Buffer Overflow Attempt Inbound (CVE-2022-3602)"; flow:established,to_client; tls.certs; content:"|06 03 55 1d 1e|"; content:"xn--"; fast_pattern; within:30; byte_test:2,>,513,-6,relative; reference:url,www.openssl.org/news/secadv/20221101.txt; reference:cve,2022-3602; classtype:attempted-admin; sid:2039618; rev:1; metadata:attack_target Server, created_at 2022_11_01, cve CVE_2022_3602, deployment Perimeter, performance_impact Significant, confidence Low, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_11_02;)

Created:

Nov 1, 2022, 12:00 PM

Updated:

Nov 2, 2022, 12:00 PM

DB Created:

Nov 2, 2022, 2:00 AM

DB Updated:

Aug 28, 2025, 9:34 PM

Filename:

rules/emerging-exploit.rules