4 December 2001 (SARA-3.5.2)
   o Fixed problem with Agranat-EmWeb server falsely reporting OK in http.sara
   o Test for nqt.php vulnerability (bid 3455)
   o Added tests for Nimda.e evidence
   o Expanded tests for SSH to address falback problems
   o Included a sample plugin
   o Added test for vulnerable Net Commerce servers (cve-2001-0318)
   o Added test for vulnerable sgi_espd program (cve-2001-0319)
   o Updated test for wu-ftpd vulnerabilities
   o Updated to the latest CVE list
   

12 October 2001 (SARA-3.5.1)
   o Fixed ReportWriter to collate tutorials properly.
   o Fixed ftp.sara to not report on certain non-vulnerable servers
   o Updated test for printer to not report for Windows
   o Developed self scanning Web interface
   o Added test for SMB Null Sessions.
   o By Default, SARA will run in SANS Top 20 Mode.  To change, update
     config/sara.cf or use the -s off switch when starting it up.

01 October 2001 (SARA-3.5.0)
   o Updated for SANS Top 20
   o Updated tutorials
   o Added tests for Nimda infection

18 September 2001 (SARA 3.4.9a)
   o Emergency release for Nimda (Concept Validation)
   o Addition of 8 more directory traversal test (http.sara)
   o Fixed problem with ftp.sara.


6 September 2001 (SARA 3.4.9)
   o Added additional directory traversal (command execution) tests
   o Added additional CodeFusion tests
   o Cleaned up the Web tutorials
   o Built interface for SANS/10 R2 (now SANS Top 20)
   o Fixed timing problem with login.sara with localhost
   o Improved green services reporting
   o Added test to look for additional MS IIS backdoors
   o Removed CIM tests (too many false positives)
   o Upgraded printer test to reflect multiple vender printer vulnerabilities

2 August 2001 (SARA 3.4.8)
   o Adjusted timing for multiple IIS buffer overflow tests
   o Improved test for JetAdmin exploit.
   o Improved Index Services (CodeRed) test to eliminate false positives
   o Corrected false positive bug in ftp.sara
   o Added test to determine if compromise detected in IIS testing
   o Added test for BSD telnet vulnerability
   o Added test for SSH V 3.0.0 vulnerability
   o Added facility to associate system administrator to reports (README.NEW)

17 July 2001 (SARA 3.4.7)
   o Added definitive test for IRIX-telnet vulnerability (extreme only)
   o Added time-of-day timer in rules/timing 
   o Fixed several bugs in the CSV generation programs
   o Fixed major bug in ftp.sara.


27 June 2001 (SARA 3.4.6)
   o Updated authoritative test for IIS ISAPI exploit
   o Added authoritative test for IIS Index services exploit
   o Added authoritative test for IIS FrontPage-RAD exploit 
   o Corrected minor bugs in http.sara
   o Corrected minor bugs in configuration management
   o Improved hosttype-ing of Windows 2000

12 June 2001 (SARA 3.4.5)
   o Upgraded to CVE Version 20010507 
   o Fixed problem RED/YELLOW repeats for Vulnerable Web Server
   o Downgraded cim.sara color to yellow due to difficulty in assessing all
     components
   o Added test for iPlanet 4.1 buffer overflow vulnerability
   o Added test for Oracle Application Server buffer overflow
   o Added test for PDG_Cart exploits
   o Added inew tests for remote root backdoors
   o Added test for the Cheese backdoor
   o Added test for rpc.yppasswdd backdoors and vulnerability:
   o Upgraded pop3 test for additional vulnerable QPOP servers
   o Added test for ftp anonymous directory traversal
   o Added test for Mailman Web exploit.

16 May 2001 (SARA 3.4.3b)
   o Developed test for latest IIS Directory Traversal (15 May Announcement)
   o Developed test for IIS password backdoor (15 May announcement)
   o Developed reliable test for buffer overflow (IIS/WIN 2K)
   o Upgraded CIM test for latest exploits
   o Tweaked tcp_scan for better performance.
   o Added test for bugzilla vulnerabilities
   o fixed bug in rlogin.sara
   o Updated Web tutorials
   o Clarified reporting  for "directory traversal (command execution)"
   o Improved test for the IIS 5.0/Windows 2000 vulnerability
   o Tightened up NAI FTP vulnerability test
   o Fixed a JavaScript error
   o Fixed printing error
   o Generic test for NAI identified vulnerable FTP services
   o Fixed false positive on http showcode
   o Improved detection of command execution via directory traversal
   o Downgraded many RED's to YELLOW's to minimize false alarms in
     the current environment
   o Fixed problem with detection of duplicate ssh daemons.
   o Upgraded fping to handle 'number of bytes sent' for worms.sara
   o Combined worms.sara and ddosscan.sara into backdoor.sara

29 April 2001 (SARA 3.4.1)
   o Added plugin facility for proprietary testing and reporting
   o Released US Government only Adore worm detector to public domain
   o Improved tests for rsh, rlogin, netstat, and systat
   o Upgraded sendmail tests
   o Upgraded dns tests to check for zone transfers
   o Added tests for doubtful rpc services
   o Added test for poor pre-login banners for telnet.
   o Added facility to modify SARA menu subsystem (perl/menu.pl)
   o Added JavaScript to menu subsystem.
   o Provided additional documentation for report correction and fact drop.
   o Removed port scans that caused Oracle listener to terminate.
   o Minimized Windows XX false alarms to backdoors


24 March 2001 (SARA 3.3.5)
   o Added tests for Linux Lion worm 
   o Added test for snmpXdmid vulnerability in SunOS
   o Updated SSH testing for new vulnerabilities
   o Included OpenSSH signature to SSH testing  
   o Fixed Lynx problem in html.pl (Thanks to Martin Tomasek)
   o Improved telnet login performance and expanded to non telnet ports
   o Improved performance for multiple instances of SARA
   o Still free, open and current. 
   
31 January 2001 (SARA 3.3.4)
   o Updated to CVE Version 20010122
   o Rewrote cim.sara to detect new CIM vulnerabilities
   o Tests for new DNS vulnerabilities
   o Fixed an induced error in reconfig
   o Corrected problem and added filter to CSV reporting
   o Fixed code associated with CSV
   o Added tutorial for MS Terminal Server
   o Still free, open, and current.  No three month waits!

22 January 2001 (SARA 3.3.3)
   o Fixed two small format errors in ReportWriter
   o Corrected some typos in tutorials
   o Fixed tutorial build process
   o Fixed multiple vulnerability reporting of mail relay [relay.sara]
   o Reduced RDS false positive by incorporating rfp_msadc.pl 
     [http.sara, perl/contrib/rfp_msadc.pl, reconfig]
   o Added test for LPRng vulnerability [depends.sara]
   o Changed severity codes for possible false positive readings [depends.sara]
   o Added check for Interbase database backdoor [rules/facts]
   o Configured attack level 6 [custom 3] for the Ramen signature [sara.cf 
     and http.sara]
   o Added csv (comma delimited) format for the ReportWriter
   o Added false reporting notation in all ReportWriter products
   o Dropped writable ftp vulnerabilities on Lexmark printers

3 January 2001 (SARA 3.3.2)
   o Added  two ReportWriter formats (by subnet and  by vulnerability)
   o Improved network connectivity to client
   o Fixed problems with custom configuration management
   o Added minor FTP and Web checks
   o Added sendmail EXPN/VRFY tests IAW with Network Computing report
   o Added sendmail DECODE/DEBUG tests
   o Added test for writable ftp/pub directory IAW NC guidelines
   o Added http.sara tests for more IIS samples and coldfusion IAW NC
   o Added additional tests for ColdFusion in accordance with NC

