
Updated SAINT 3.1.7 --> 3.1.8: Changes described below

3/26/01  Added check for Lion worm.

3/26/01  Released 3.1.8 beta 1.

3/27/01  Updated check for MDaemon to detect latest
	 DoS vulnerability.

3/27/01  Updated check for icecast to detect the latest
	 vulnerabilities.

3/27/01  Added check for snmpXdmid.

3/30/01  Added check for ILMI community string, an
	 undocumented read/write community string found
	 in Crosscomm/Olicom and some Cisco routers.

Updated SAINT 3.1.6 --> 3.1.7: Changes described below

3/5/01   Added check for base-64 encoded null character
	 vulnerability in PHP Nuke (e.g. bb_smilies.php)

3/5/01   Added check for MERCUR mail servers.

3/9/01   Added check for CUPS.

3/9/01   Added check for post-query.

3/9/01   Added check for WFTP.

3/9/01   Added check for anonymous FTP servers which
	 allow reading of arbitrary files by ../

3/12/01  Added check for SNMP vulnerabilities in
	 Cisco IOS and CatOS.

3/16/01  Added check for Net.Commerce and WebSphere
	 weak encryption and user enumeration vulnerability.

3/16/01  Updated check for Icecast to check for latest
	 buffer overflows.

3/16/01  Updated http_potential_problems for new buffer
	 overflow in Netscape Directory Services per
	 @stake advisory. (Check didn't need to be changed.)

3/16/01  Fixed false alarm in the Oracle iAS check when
	 scanning CUPS servers. (CUPS servers tend to
	 reply 403 Forbidden.)

3/16/01  Added check for Interbase server backdoor.

3/16/01  Released 3.1.7.

Updated SAINT 3.1.5 --> 3.1.6: Changes described below

2/15/01  Fixed minor bug in cim.saint thanks to Alfred
	 James Jan Sr.

2/20/01  Added information about session key recovery
	 vulnerability to SSH tutorial.

2/21/01  Removed "we'd like to hear from you" from the
	 main page. Questions should be reported to
	 saint@wwdsi.com instead.

2/21/01  Fixed rule for OpenBSD ftpd 6.5 in rules/facts.
	 Part of the banner was missing. (This wouldn't
	 necessarily affect the results, but it's good
	 to have precise rulesets.)

2/21/01  Added checks for new vulnerabilities in ProFTP.

2/21/01  Added check for vulnerability in XMail.

2/21/01  Added check for vulnerability in PHP Nuke
	 (opendir.php).

2/21/01  Added check for malformed HTML attachment
	 vulnerability in Lotus Domino mail servers.

2/21/01  Updated candidate CVEs.

2/22/01  Added hex-encoded space (%20) source code exposure
	 vulnerability to Netscape tutorial and Website Pro
	 tutorial.

2/22/01  Added check for Cold Fusion denial of service
	 vulnerability in startstop.html.

2/22/01  Added check for SCO OpenServer calserver.

2/23/01  Added "\../" variation to http server read
	 access check in http.saint and updated tutorial. 
	 Also changed test file from boot.ini to
	 winnt/win.ini because boot.ini isn't on all
	 systems.

2/23/01  Added reference to FreeBSD Security Advisory 01:25
	 to the Kerberos tutorial.

2/23/01  Added check for vulnerable VShell versions.

2/26/01  Added new yellow severity level for privilege
	 elevation (ype).

2/26/01  Rewrote imap.saint (formerly imap.sara) into
	 PERL, including a check for the lsub vulnerability.

2/27/01  Added check for multiple vulnerabilities in Zope.

2/27/01  Added check for man-cgi.

2/27/01  Released 3.1.6.

Updated SAINT 3.1.4 --> 3.1.5: Changes described below

1/29/01  Added check for LPRng.

1/29/01  Removed extraneous http header on cookie leak
	 warning page.

1/29/01  Added check for new BIND problems (CA-2001-02).

1/29/01  Modified get_target to use fwping instead of
	 fping when dont_use_ping is set.

1/31/01  Released 3.1.5 beta 1, primarily for updated
	 BIND check.

2/6/01   Added check for new variation on the //WEB-INF
	 vulnerability in JRun.

2/7/01   Added check for PlanetIntra (/cgi-bin/pi).

2/7/01   Added port 8888 back into TCP portscan. It is
	 needed to detect vulnerable tinyproxy servers.
	 It was originally removed to avoid crashing
	 Answerbook servers.

2/7/01   Added check for tinyproxy.

2/8/01   Updated cve.html with new candidates.

2/8/01   Added checks for Cold Fusion snippets, syntax
	 checker, and sourcewindow. Also re-enabled
	 check for expeval openfile.cfm. (Probably deleted
	 because it was thought to be redundant with
	 exprcalc.cfm, but exprcalc.cfm can be deleted.)

2/9/01   Added some new checks for web servers that allow
	 arbitrary file reading by ../, .../, or ..\

2/13/01  Added check for new vulnerability in ssh1,
	 OpenSSH, and OSSH. Renamed ssh.sara to ssh.saint
	 since WWDSI has made many changes from the
	 original ARC code.

2/13/01  Added rule to run http check on all ports
	 8[0128]{3}, i.e. assume 8000, 8001, 8080,
	 8181, 8888, etc. are running http. Useful
	 for detecting tinyproxy.

2/13/01  Released 3.1.5.

Updated SAINT 3.1.3 --> 3.1.4: Changes described below

1/16/01  Added new report header options to SAINTwriter
	 GUI.

1/16/01  Fixed bug where *.foo wasn't getting deleted. The
	 argument to "unlink" needed quotes in ftp.saint.

1/16/01  Modified "design goals" documentation, and moved
	 information on SAINT's SNMP probe from
	 vulnerability tutorials to FAQ.

1/16/01  Re-worded parts of tutorials to get rid of all
	 occurrences of the word SAINT (except from
	 "SAINT password disclosure"), so SAINTwriter
	 reports will be more general.

1/17/01  Added "where can I read more about this" section
	 to "hacker program found" tutorial.

1/18/01  Fixed bug in tcp_scan.c which caused many false
	 alarms on Linux 2.4. Needed to check the return
	 value of "write" in do_send_string(). Also
	 had to move the ECONNRESET and EPIPE checks
	 from report_and_drop_socket to elsewhere in
	 the code, or else the fix would have caused
	 false alarms on other platforms.

1/22/01  Updated Oracle tutorial with new patch information.

1/22/01  Added check for statsconfig.pl.

1/22/01  Updated check for Compaq Insight Manager in light
	 of new buffer overflow problem.

1/22/01  Added check for Linux Ramen worm.

1/23/01  Added ability to save SAINTwriter report types
	 other than the six pre-configured reports.

1/25/01  Added check for icecast.

1/25/01  Updated to CVE version 20010122.

1/25/01  Added check for Lotus Domino SMTP buffer overflow
	 in policy feature.

1/25/01  Added check for Netscape INDEX vulnerability.

1/26/01  Added check for wwwwais.

1/26/01  Fixed false alarm on http PUT check reported
	 by Adam Pendleton.

1/26/01  Modified rules/services to classify saint as
	 its own service rather than WWW on non-standard
	 port. Based on suggestion by Adam Pendleton.

1/26/01  Added proper response codes (RFC 1945)
	 to all HTTP responses in html.pl.

1/26/01  Changed perl/passwd.pl to send password prompt
	 to standard error, so that they will still appear
	 if someone wants to redirect standard output.
	 (Useful in verbose mode.)

1/26/01  Moved newlines from @cgi_red_1 to the code
	 further down in http.saint to be consistent
	 with the other checks. Changed to proper format
	 (GET ... HTTP/1.0\n\n) to avoid hanging certain
	 services (e.g. icecast). Removed extraneous
	 newline from RDS check (also for icecast check).

1/26/01  Released 3.1.4.

Updated SAINT 3.1.2 --> 3.1.3: Changes described below

12/27/00 Fixed links to TCP wrappers in tutorials.

12/27/00 Added check for Sun Cluster monitor service.

12/27/00 Added check for vulnerabilities in bftpd.

12/27/00 Added check for new vulnerability in BEA WebLogic.

12/27/00 Added check for MDaemon vulnerabilities.

12/28/00 Modified some files under include/netinet to
	 work with Powermac. (Thanks to Brent Ware for
	 testing the changes.)

12/28/00 Modified tcp_scan.c to recognize "broken pipe"
	 as an open port, to detect SSH2 from Red Hat 7.

12/29/00 Added check for Oracle Internet Application Server.

12/29/00 Added check for DoS in IMail SMTP server.

12/29/00 Released 3.1.3 beta 1.

1/9/01   Modified ftp.saint to check for writable /pub
	 directory as well as writable home directory.

1/9/01   Rewrote relay.saint. Added more checks based upon
	 telnet mail-abuse.org checks.

1/12/01  Added documentation for "bo", "i", and "g" severity
	 codes.

1/12/01  Added check for /.nsf vulnerability in Lotus
	 Domino http server.

1/12/01  Added check for bbs_forum.cgi.

1/15/01  Released 3.1.3.

Updated SAINT 3.1.1 --> 3.1.2: Changes described below

12/15/00 Updated tutorial on Kerberos vulnerabilities to
	 include new vulnerabilities in KTH versions.

12/19/00 Added documentation on unpacking SAINT, for
	 Windows users who are unfamiliar with Unix.

12/20/00 Fixed bug in rpcgen which was causing the .x
	 files to be misinterpreted.

12/20/00 Added check for OpenBSD and NetBSD ftpd
	 replydirname buffer overflow.

12/21/00 Modified configure script to detect missing
	 /usr/include/asm link.

12/21/00 Updated CVE cross-reference list with latest
	 Candidates.

12/21/00 Released SAINT 3.1.2.

Updated SAINT 3.1 --> 3.1.1: Changes described below

11/6/00  Fixed bug in imap.sara by labelling IMail servers
	 okay. Thanks to Charles Clarke.

11/6/00  Fixed Cold Fusion check not to false alarm on
	 the security warning message. Thanks to Charles
	 Clarke.

11/6/00  Added check for web interface vulnerability
	 in Cisco Catalyst 3500 XL.

11/6/00  Added check for iPlanet 4.0-4.1 servers which
	 could be vulnerable to buffer overflow in
	 server side parsing.

11/7/00  Added check for Lotus Domino mail server
	 ENVID vulnerability.

11/8/00  Changed smb.saint to better infer unpassworded
	 accounts.

11/8/00  Released 3.1.1 beta 1.

11/14/00 Changed &AF_INET to &_AF_INET and &SOCK_STREAM
	 to &_SOCK_STREAM to avoid conflict which SAINT
	 express which uses the standard socket libraries.

11/15/00 Changed http.saint not to false alarm on web
	 servers that respond 200 OK to any query.

11/15/00 Updated dns-chk.saint to detect new DoS problems.

11/15/00 Added check for Microsoft Terminal Server.

11/15/00 Modified ssh.sara to drop trailing \n from version.

11/15/00 Added show_url option to SAINTwriter GUI and
	 configuration files.

11/17/00 Updated Cisco Catalyst tutorial based on new
	 fix information.

11/17/00 Added check for vulnerability in YaBB's search.pl.

11/17/00 Added FD_SETSIZE=4096 to Makefile for tcp_scan
	 and udp_scan to fix core dumps on FreeBSD and
	 possibly others. (Thanks to Peter Haight.)

11/21/00 Now todo.pl expects to find BEGIN at the top
	 of the output from probes, so it will know after
	 a timeout whether the probe ran at all. If it
	 didn't, it will be run alone. This is because
	 multitasking was apparently causing some probes
	 to starve on some platforms.

11/22/00 Added check for buffer overflow in phf.
	 (Previously only the input validation vulnerability
	 was checked.)

11/24/00 Added check for some instances of the filename
	 inspection vulnerability in IIS.

11/24/00 Released 3.1.1 beta 2.

11/27/00 Added new banner graphic for SAINTwriter GUI.

11/29/00 Fixed ftp-scan.c and dds.c to compile on non-ANSI
	 C compilers. Thanks to Tim Schaefer for reporting
	 the problem and testing the fix.

12/4/00  Added DOS vulnerabiity in RCPT TO, etc. to
	 Lotus Domino tutorial.

12/4/00  Updated CVE cross-reference list with latest
	 Candidate CVEs.

12/5/00  Added check for Microsoft PhoneBook Server.

12/6/00  Fixed todo.pl to handle re-run probes as
	 non-multitasked.

12/6/00  Added check for Serv-U FTP server vulnerabilities.

12/7/00  Fixed set_host_time not to create a new host entry
	 for non-existent hosts (i.e. broadcast addresses)

12/8/00  Added check for MailMan.

12/8/00  Changed saint_custom_action.pl to link back to
	 either Configuration Management or Target Selection,
	 depending on which one referred to it.

12/8/00  Added a random parameter to some links in html/running
	 and html/admin to make sure form gets refreshed.

12/8/00  Released 3.1.1.

Updated SAINT 3.0 --> 3.1: Changes described below

10/16/00 Added check for web servers which allow
	 hex-encoded ../ in URLs. (e.g. BOA)

10/17/00 Added check for folder traversal vulnerability
	 in IIS 4.0 and 5.0.

10/17/00 Released 3.0.1 beta 1.

10/20/00 Added check for webplus dot-dot-slash vulnerability.
	 (Not the same as the ::$DATA vulnerability added
	 10/6.)

10/20/00 Added new Big Brother vulnerability to
	 http_potential_problems. (The check was already
	 there.) Moved one of the existing vulnerabilities to
	 http_potential_problems also because it was brown.

10/20/00 Updated to CVE 20001013.

10/23/00 Fixed bug in drop_fact.pl, and improved documentation
	 on using rules/drop to ignore false alarms.

10/23/00 Added check for http PUT.

10/24/00 saintwriter_action.pl now outputs its own HTTP
	 headers, so it can output either HTML or text
	 depending on the report format

10/24/00 Modified policy-engine.pl to ignore proximity
	 descent for special scan levels (i.e. top-10).
	 Otherwise it could descend to a higher level.

10/25/00 Made finger.saint non-conditional at top-10
	 scan level.

10/25/00 Added new scan level for custom scans and GUI
	 support for editing the custom scan level.

10/26/00 Added #include <arpa/inet.h> to boot.c to fix
	 compilation problem on BSDI. (Thanks to Lex.)

10/30/00 Fixed incorrect vulnerability description for
	 POP vulnerability to read "2.53 or older", etc.
	 Fixed tutorial.

10/30/00 Added check for three vulnerabilities in
	 Allaire JRun server.

10/31/00 Made miscellaneous improvements and bug fixes
	 to the scripts supporting custom scans.

11/1/00  Added CVE logo to start page.

11/1/00  Revised web server ../ check to include servers
	 running on NT. Added reference to iPlanet
	 vulnerability to tutorial.

11/1/00  Added check for buffer overflow vulnerability
	 in iPlanet Directory Server and Certificate 
	 Management System.

11/1/00  Released 3.1.

Updated SAINT 2.2 --> 3.0: Changes described below

9/6/00   Changed RDS vulnerability back to red severity
	 due to user feedback. Changed RDS check to
	 that used by ARC.

9/6/00   Changed the first line of each perl script
	 to /usr/bin/perl, the standard path for Linux,
	 so RPMs will work. The path gets replaced
	 by reconfig anyway.

9/7/00   Added saint.1 man page.

9/7/00   Added GNU autoconf-generated "configure" script
	 and "Makefile.in" template. Moved original
	 Makefile to "old". Modified README to reflect
	 new compilation procedure.

9/7/00   Modified reconfig to make output more like that
	 of the configure script, since it gets called
	 from the configure script now.

9/8/00   Updated the ntop check and tutorial to reflect
	 the newly announced buffer overflow condition.

9/13/00  Added check for the Qaz trojan/worm contributed
	 by Tom Payerle.

9/13/00  Added check for 9704/TCP and ingreslock backdoors.

9/13/00  Increased timeout value for http.saint and smb.saint.
	 Slightly increased timeout for tcpscan and udpscan.
	 Set all the special timeouts to $long_timeout instead
	 of static values. Increased $long_timeout to 60.

9/14/00  Added check for YaBB.

9/14/00  Increased timeout value for snmp.saint.

9/14/00  Added supporting scripts for SAINTwriter.

9/18/00  Added check for scohelphttp vulnerability.

9/18/00  Added check for MultiHTML and Mobius DocumentDirect.

9/18/00  Released 3.0 beta 1.

9/20/00  Put linux/limits.h check before sys_errlist check
	 in configure script to fix a problem on RedHat 6.2.
	 Thanks to Sheila Franklin for providing config.log.

9/20/00  Added more includes to the netinet check in
	 configure in an attempt to make it work on SunOS 4.
	 Thanks to James Bys for providing config.log.

9/20/00  Changed tcp_scan.c to recognize "connection reset
	 by peer" (ECONNRESET) as a successful connection.
	 This is sometimes needed to catch SSH.

9/20/00  Changed run-saint.pl to check that the fqdn actually
	 resolves back to the original target. This fixes
	 situations where non-matching forward and reverse DNS
	 cause the wrong host to be scanned.

9/21/00  Changed html.pl so $my_address takes priority over
	 getfqdn() when setting $THIS_HOST. Updated FAQ.

9/25/00  Removed check for open shares when guest/administrator
	 password is null, since this always results in
	 false alarms.

9/25/00  Added port 23 to top-10 scanlevel so it will check
	 for unpassworded root accounts when telnet is open.

9/26/00  Updated cmsd.saint to detect cmsd on Solaris 2.6 and 7.

10/2/00  Modified http.saint to detect cgi shells which return
	 500 Internal Server Error.

10/2/00  Added check for Net Tools PKI Server.

10/2/00  Updated the CVE Candidates list.

10/2/00  Added check for IBM Net.data db2www.

10/2/00  Changed snmp.saint. Community string guesses are
	 now kept in a list instead of a hash, so we can
	 control the order and put the common ones first.

10/2/00  Released 3.0 beta 2.

10/3/00  make install will now create the man page directory
	 if it doesn't exist

10/4/00  Added check for SubSeven on 27374/TCP.

10/4/00  On RedHat 7 arpa/inet.h replaces u_int32_t with
	 in_addr_t, which is undefined. Included older inet.h
	 in include/glibc21/arpa to fix the problem.

10/5/00  Fixed problem in socket compatibility check
	 in configure script (affects sunos5).

10/6/00  Added checks for format string vulnerability
	 in scohelphttp and file read vulnerability
	 in FreeBSD 4.1.1 fingerd.

10/6/00  Added check for thttpd ssi vulnerability and
	 Web+.

10/10/00 Added check for SubSeven backdoor on port 16959.
	 Added check for CFEngine (5308/TCP).
	 Added check for CyberOffice shopping cart database
	 download vulnerability.

10/10/00 Raised http.saint timeout to 90.

10/11/00 Released 3.0.

Updated SAINT 2.1.3 --> 2.2: Changes described below

8/21/00  Updated rpc_statd tutorial to reference new
	 CERT advisory 2000-17.

8/21/00  Added check for Specialized Header vulnerability
	 in Microsoft web servers.

8/22/00  Added check for Smurf and Fraggle. Relabeled
	 the chargen vulnerable to, more appropriately,
	 UDP bomb, now that we're really checking for Fraggle.
	 (NMAP required for this check.)

8/23/00  Added -n option for $target_netmask (needed
	 for smurf.saint.) Modified shell.pl to allow
	 quoted arguments, and todo.pl to allow targets
	 which are network addresses (indicated by a
	 trailing slash) if subnet expansion is on.

8/23/00  Added check for ntop vulnerability.

8/23/00  Modified linux-new target to include headers
	 in /usr/src/linux/include for broken RedHat 6.2 systems.
	 (Thanks to Allan Clark.)

8/23/00  More changes in support of smurf.saint.
	 Modified drop_old_facts and drop_old_todos to drop
	 records for target's associated network/broadcast addresses.

8/23/00  Released 2.2 beta 1.

8/24/00  Made changes to http.saint, tcpscan.saint,
	 and rules/services for ntop check to work.
	 Released patch 1.

8/25/00  Added check for netauth.cgi and htgrep.

8/25/00  Added check for bboard vulnerability in
	 SUN Java Web Server.

8/25/00  Fixed sunos5/solaris bug in nfs-chk by
	 linking to rpcsvc and rpcsoc libraries.
	 Thanks to Stefan Rapp.

8/31/00  Changed cgi-bin/perl from http_cgi_info (brown)
	 to http_cgi_shells (red). Changed ODBC RDS
	 to brown.

8/31/00  Added todo rule to check root account for
	 empty password whenever telnet is open, and
	 to check every account for trust using rsh.

8/31/00  Modified smb.saint to check for unpassworded
	 guest and administrator accounts and to
	 distinguish between readable and writable shares.

9/5/00   Added check for Trinity.

9/5/00   Released SAINT 2.2.

For previous changes see READMEs/CHANGES-2.1
