ET EXPLOIT FREAK Weak Export Suite From Server (CVE-2015-0204)

alert tcp any [21,25,110,143,443,465,587,636,989:995,5061,5222] -> $HOME_NET any (
    msg:"ET EXPLOIT FREAK Weak Export Suite From Server (CVE-2015-0204)";
    flow:established,from_server;
    content:"|16 03|"; depth:2;
    byte_test:1,<,4,0,relative;
    content:"|02|"; distance:3; within:1;
    byte_jump:1,37,relative;
    content:"|00 19|"; within:2; fast_pattern;
    threshold:type limit,track by_dst,count 1,seconds 1200;
    reference:url,blog.cryptographyengineering.com/2015/03/attack-of-week-freak-or-factoring-nsa.html;
    reference:cve,2015-0204;
    reference:cve,2015-1637;
    classtype:bad-unknown;
    sid:2020661; rev:3;
    metadata:created_at 2015_03_11, cve CVE_2015_0204, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;
)