20 December 2000 (SARA 3.3.1)
   o Updated to CVE 20001013
   o Completed correction (i.e., ignore) logic for SARA Reporter
   o Enhanced SARA Reporter (and its still free)
   o Corrected SATAN/SAINT/SARA common problem with URL refreshing
   o Added custom attack level definitions in Configuration Mgt page
   o Enhanced drop logic to record the drop (severity = dropped)
   o Cleaned up the tutorials page
   o Improved multi process support
   o Fixed problem with IP range calculations
   o Fixed problem with IMAIL test for imap
   o Updated "writable ftp" vulnerability to not include Jet Direct
   o Added test for Lotus Mail server vulnerabilities
   o Updated http.sara to detect:
        -  iPlanet server vulnerability
	-  netauth directory traversal (cve-2000-0782)
	-  calendar.pl remote execution (cve-2000-0432)
        -  web+ directory traversal (cve-2000-0282)
   o Added test for MS Terminal Server

22 October 2000 (SARA 3.2.3a)
  o Added http test for vulnerable Apache servers
  o Added http tests for Web Shopper, Shopping Cart, PHP, and PUT
  o Fixed problem with smb.sara while handling very large shares
  o Adding SARA Reporter manual correction facility (see README)
  o Fixed small format problem with Reporter reports generated with "-r"
  o Improved tcp wrapper detection
  o Improved login.sara operation


2 October 2000 (SARA 3.2.2b)
  o Corrected error in Makefile for sunos5
  o Updated tutorials (http-cgi and tacacs)
  o Updated to detect "wrapped" versions of ssh, telnet, ftp
  o Updated testing for Subseven DDOS tool.
  o Added additional "custom" attack modes
  o Fixed problem in configuration management module
  o Added timing options to start SARA (full date)
  o Added -r option to command line to generate SARA Reporter report.
  o Added a Delete option to Data Management
  o Tweaked ftp.sara and tutorial for current threat


18 September 2000 (SARA 3.2.1)
  o Corrected problem in SARA Report filters
  o corrected various Makefile problems
  o Added trinity DDOS (XF Advisory 59)
  o Added test for Web bulletin board (YaBB)
  o Added PhotoAlbum Web vulnerability
  o Added t0rn server Trojan test.
  o Improved mail relay reporting
  o Submitting SARA to industry evaluation
  o Enhanced Report Writer for SARA/SAINT/SATAN
  o Updated to maintian SANS/CVE Certification/Compliance


31 August 2000 (SARA 3.1.8)
  o Improved tutorials for http and smb
  o Added multi tasking support
  o Fixed error reporting date in daemon mode.
  o Fixed errors in html.pl introduced in 3.1.7
  o Added test for IRIX telnetd vulnerability
  o Fixed a problem importing SARA Report data into Office 2000.
  o Fixed problem with get_targets (FW vs non FW)

11 August 2000 (SARA 3.1.7)
  o Fixed false positive on latest ColdFusion
  o Tuned http.sara for JetDirect and other ill-reporting servers
  o Tuned nfs-chk.sara for non-world access
  o Reformatted some of the tutorials
  o Fixed relay.sara to minimize false positives
  o Made minor tweaks on smb.sara (e.g. visible shares and verbose)
  o Fixed sendmail.sara to respond properly to v 8.10.x  (thanks to J. McNair)
  o Expanded services database to reflect new definitions
  o Added test for Answerbook2 vulnerability (Sun Security Bulletin # 00196)
  o Fixed problem with crashing PCDuo servers (default attack level only)
  o Cleaned up configuration management routines
  o Provides a qualified date/time entry in the status file.


31 July 2000 (SARA 3.1.6)
  o Corrected smb.sara to properly target share level vs user level access
  o Added options to smb.sara for standalone and tailored operation
  o Added network.vbs test in smb.sara
  o Fixed a problem in ftp.sara to eliminate false negatives on writable dirs
  o Fixed Configuration Management GUI error.
  o SARA updated for the latest perl (5.6.0) dist. (thanks to A. Pendleton)

21 July 2000 (SARA 3.1.5)
  o Updated IAW with SANS guidance
  o Updated smb.sara to test for null logins
  o Updated rules to 'catch' all smb services
  o Added O'Reilly test to http.sara (BID 1487)
  o Added source.asp test to http.sara (BID 1457)
  o Fixed NFS/Mountd/statd anamolies (BID 1480)
  o Tweaked login.sara for really slow targets


12 July 2000 (SARA 3.1.4)
  o Improved SMB logic for Windows 9X
  o Improved processing for nfs exports for non world access
  o Corrected numerous typos in tutorial links (thanks to Walt Jones)
  o Fixed corrupted udpscan.sara file
  o Fixed more problems with relay.sara
  o Updated tutorials and FAQ.
  o Updated X Server logic to reduce false positives
  o Changed default start-up mode (a typo, really)
  o Added Big Brother test 

5 July 2000 (SARA 3.1.3)
  o Incorporated SANS recommended additions to SARA Top 10 (2,7,8,10)
  o Fixed distclean to delete all swap files
  o Corrected typo in http.sara
  o Test for vulnerability in wu-ftpd 2.6.0(1) and derivitives
  o Corrected false negative problem with relay.sara

16 June 2000 (SARA 3.1.2)
  o Added switch to slow the scan to minimize impact to slower networks
  o Added custom and multiple hosts on GUI (Target Mgt)
  o Added test for INN 2.x.x vulnerability
  o Improved JetAdmin logic in http.sara
  o Improved the Custom attack level (see config/sara.cf)
  o Improved printer logic in depends.sara
  o Fixed ftp.sara to properly report MS FTP status
  o Fixed Documents to properly display CVE

12 June 2000 (SARA 3.1.1)
  o Fixed FrontPage test IAW CIAC recommendations
  o Changed sara.cf to avoid NCD X- terminal lock ups
  o Removed DNS checking in data management mode (improves performance)
  o Added more rpc program checking
  o Added test for tacacs server
  o Added test for Sub 7 backdoor
  o Added test for JetAdmin directory traversal (thanks to Steven Lodin)
  o Added test for QPOP 3.53 vulnerability.
  o Added test for Cisco Catalyst Vulnerability (CVE 2000-0267)
  o Added test for Suse imap server (CVE 2000-0233)
  o Updated SARA's CVE Compliance Matrix to version 20000602.

31 May 2000 (SARA 3.1.0)
  o Included SARAPRO report writer into SARA
  o Provided report writer to SATAN and SAINT users
  o Added SANS-10 top vulnerability filter to report writer
  o Correct tutorial problem with pcanywhere and kerberos
  o Fixed man page to include the "-n" option.

24 May 2000 (SARA and SARAPRO 3.0.5)
  o Addded depends.sara to minimize OS oriented false positives
  o Fixed login.sara to minimize false positives with JetDirect
  o Fixed multiple subnet scanning in firewall mode
  o Mitigated lockups in SARA daemon mode
  o Added new mode (vulnerabilities) to SARA Search
  o Updated http.sara to minimize FrontPage vulnerabilities
  o Added eight new tests to http.sara
  o Added test for kerberos

16 May 2000 (SARA and SARAPRO 3.0.4)
  o Added a range argument to target spec (e,g, 192.168.0.11-192.168.0.223)
  o Incorporated target specs in interactive mode (e.g., supernets and range)
  o Added test for SunOS netpr vulnerability (BugTraq)
  o Added test for counter vulnerability (BugTraq)

11 May 2000 (SARA and SARAPRO 3.0.3)
  o Fixed mstream test (PONG vs pong)
  o Added test for timbuktu
  o Added tutorial for pcanywhere and timbuktu
  o Incorporated Steve Rader's new relay.sara (many more tests)

1 May 2000 (SARA and SARAPRO 3.0.2)

  o Added pirahna test (password vulnerability in Linux Web server)
  o Updated http.sara to reduce false alarms on non 404 servers
  o updated sara.cf to avoid answerbook2 inadvertent denial of service
  o Added test for pcanywhere 
  o Added test for mstream DDOS agents
  o Need to do tutorials for pirahna and pcanywhere

25 April 2000 (SARA and SARAPRO 3.0.1)

  o Added CVE compliance matrix to documents and tutorials
  o Added Search to SARA (was only in SARAPRO)
  o Added sgi_pmcd vulnerability test
  o Added Solaris nisd vulnerability test
  o Added Compaq CIM server vulnerability test (thanks to Steve Lodin)
  o Improved tutorial reporting in SARAPRO report writer
  o Added numerous new cgi vulnerability tests
  o Corrected bugs


10 April 2000 (SARAPRO 2.4.13 and SARA 2.1.13)

  o Added daemon mode of SARA! (thanks to Adam Pendleton of VGS)
  o Improved SMB analysis (fewer false positives)
  o Need to do documentation on visable SMB shares
  o Added basic Shaft DDoS detection
  o Improved http.sara (fewer false positives on php and FP)
  o Fixed makefile problem with IRIX and swp files (Thanks Adam P.)
  o Added test for IRIX 5.x - 6.2 objectserver exploit
  o Need to do documentation on objectserver

22 March 2000 (SARAPRO 2.4.12 and SARA 2.1.12)

  o Added test for Subseven backdoor
  o Fixed new CUI/GUI problem with Analysis Reporting
  o Supporting older Linux releases (thanks to Sam Kline)
  o Added the SARA Search capability (SARA Pro)

17 March 2000 (SARAPRO 2.4.11 and SARA 2.1.11)

  o Fixed CUI/GUI problem with Lynx and Netscape 4.72
  o Fixed problem with multiple reports with SNMP
  o Updated hosttyping database
  o Still adding SARA Search capability


12 March 2000 (SARAPRO 2.4.10 and SARA 2.1.10)

  o Added yet more http vulernability testing incl infosrch
  o Fixed Netscape buffer overflow detection
  o Fixed some of the GUI interfaces
  o Adding SARA Search capability 
  o Added Napster detection

03 March 2000 (SARAPRO 2.4.9 and SARA 2.1.9)

  o Added test for the sgi_fam buffer overflow vulnerability
  o Added the trojan_trinoo DDOS test
  o Fixed false alarms from Web cache manager
  o Updated snmp reporting

23 February 2000 (SARAPRO 2.4.8 and SARA 2.1.8)

  o Added Corporate template insertion into SARA Pro reports.
  o Added "time to start" parameter in command line.
  o Administrative release.  Credit given where credit due.
  o Corrected minor bugs on the SARA menu

15 February 2000 (SARAPRO 2.4.7 and SARA 2.1.7)

  o Added Dave Dittrich's Distributed DOS test
  o fixed typo in http.sara and sample.sara.ext
  o Added a new tutorial for possible wuftpd vulnerability
  o Added a line in the Makefile for Suse
  o Added Linux include/ansi to update the old rpc libraries
  o Added Linux include/netinet to make available older net files
  o Added trusted-solaris make option (thanks to Ward Ponn)

1 February 2000 (SARAPRO 2.4.6 and SARA 2.1.6)

  o Tweaked the documentation
  o Fixed problem with mimetyping
  o Documented fact that doesn't work with Lynx 2.8
  o Added SARA extensions to SARA (offered in SARA Pro 2.4.1)

21 January 2000 (SARAPRO 2.4.5)

  o Made major fixes to report writer
  o Added SARA Protutorial under "Documentation"
  o Cleaned up documentation pages
  o Added Bar Chart generation
  o Included all updates from SARA 2.1.5

21 January 2000 (SARA 2.1.5)

  o Updated backdoor list (including rules from SAINT)
  o Made minor fixes in analysis reporting
  o Refined tutorials to remove Red/Yellow duplication
  o Corrected problem with login.sara


28 December 1999 (SARA 2.1.4)

  o Fixed trailing blank problem in -F filename
  o Fixed bug in firewall enabling logic

15 December 1999 (SARA 2.1.3)

  o Added test for trinoo
  o Added test for sadmind exploit
  o Added test for Hack a Tack
  o Corrected pop3 to find obscure Qualcomm configurations
  o Added a post analysis filter, ammends (SARA-Pro only)

30 November 1999 (SARA 2.1.2)

  o Added "-F hostfile" to scan a list of hosts (not subnets)
  o Added custom attack level (level=4)
  o Added submask control for subnet scanning (command line only)
  o Added test for /tmp/bob exploit (ingreslock and pcserver)
  o Added test for DRAT exploit
  o Added test for vulnerable DNS Servers (NXT records)
  o Added many CGI vulnerability tests
  o Added subnet mask to command line arguments (/16 through /32)
  o Made NMAP non-default (problems with most OSs)

 
7 November 1999 (SARA 2.0.10)

   o Attempt at getting a single makefile for linux
   o Corrected sendmail.sara for false positive on Sun 

20 September 1999 (SARA 2.0.9)

   o Upgraded tooltalk and calendar manager to RED
   o Corrected problem in login.sara 
   o Corrected problem in relay.sara
   o Updated sendmail.saara
   o Updated ftp.sara

7 July 1999 (SARA 2.0.8)

   o Added test for calendar manager (rpc.cmsd)[bin/rpc.sara, rules/facts]
   o fixed ssh.sara where we get not response
   o Added tutorials for tooltalk and rpc.cmsd
   o Added check for open administrator account on smb [partial]
   o Fixed login.sara to minimize false positives

15 June 1999 (SARA 2.0.7)

   o Corrected (linux) for newer versions of Linux
   o Created new entry for older versions of Linux (olderlinux)

30 May 1999 (SARA 2.0.6)

   o Fixed NMAP and SAMBA detection
   o Fixed GREEN FTP when there re vulnerabilities
   o Fixed false alarm on relay.sara for certain Sun systems

19 May 1999 (SARA 2.0.5)

   o Fixed to compile under Red Hat 6.0
   o Fixed bug in login.sara

18 May 1999 (SARA 2.0.4)

   o Added ftp bounce test
   o Addedd mail relay test
   o Improved login.sara
   o Improved timeouts for various tests
   o improved http.sara tests

5 May 1999 (SARA 2.0.3)

   o Updated ftp.sara to detect corrected versions of wu-ftpd.  We
     assume that all wu-ftpd servers made in 1999 or later are OK.

   o Updated http.sara to detect certain IIS and ColdFusion exploits.
     This is experimental code.  Any problems should be reported to
     sara@arc.com

   o Updated "cgi access" tutorial to address FrontPage, IIS, and
     ColdFusion exploits.

   o Added "snmpd" tutorial to address SNMP warnings.


