
Updated SAINT 2.0.1 --> 2.0.2: Changes described below

4/18/00:  Fixed bug in WWDSI's Telnet.pm modifications that was
	  causing false alarms on account names containing "new".
	  Thanks to Michael Ellison for finding the bug.

4/20/00:  Added the date to the output in status_file.

4/20/00:  Improved documentation for command-line interface.

4/21/00:  Added check for IRIX Performance Copilot vulnerability.

4/21/00:  Added check for Visual Interdev Link View vulnerability.

4/24/00:  Updated to CVE 20000418.

4/24/00:  Added check for UnixWare i2odialogd vulnerability.

4/25/00:  All severity 'g' facts are now added from perl/services.pl,
	  instead of being scattered around. This will make the 'g'
	  facts (used for command-line output and WebSaint) consistent
	  with the services listed in Data Analysis.

4/25/00:  Added "other services" class to services ruleset, to catch
	  all services that don't have a specific rule.

4/26/00:  Added "other services" output to saint_info_host.pl. Output
	  will be optional for long lists of other services.

4/26/00:  Added check for rpc.nisd.

4/26/00:  Released 2.0.2 beta 1.

4/28/00:  Re-named Linux targets to "linux-old" and "linux-new"
	  in Makefile to avoid confusion.

4/28/00:  Took port 8888 out of tcpscan for heavy SAINT scan.
	  Scanning this port has a bad effect on answerbook2 servers.
	  (Thanks to ARC for this solution.)

4/28/00:  Added check for the Piranha backdoor password vulnerability.

5/2/00:   Added check for Win32 E-commerce shopping cart (Cart32)
	  backdoor vulnerability.

5/2/00:   Added check for mstream distributed denial-of-service tool.

5/2/00:   Released 2.0.2 beta 2.

5/3/00:   Added target for UnixWare 7.1.1 with UDK development kit.
	  Courtesy of SCO.

5/8/00:   Added ddos_scan written by Marcus Ranum and
	  Dave Dittrich. Added ddos.saint which calls it.
	  Removed UDP port checks for ddos vulnerabilities from
	  rules/facts since they are now detected by ddos_scan,
	  and they were causing false alarms.

5/8/00:   Removed objectserver vulnerability check from rules/facts
	  and added it to the new irix.saint module.  It was
	  causing false alarms on non-IRIX hosts.

5/9/00:   Added necessary casts to showmount.c to get rid of warnings.

5/10/00:  Revised sendmail checks.  All Sendmail banners are now
	  checked from rules/facts instead of sendmail.saint.
	  "SMI-" and other formats are now recognized.  All versions
	  prior to 8.8.5 are now reported as vulnerable. Tutorial
	  has been revised. All current Sendmail CVEs have been added.

5/10/00:  Released 2.0.2 beta 3.

5/12/00:  Added "+" as a possible field separator in &match_host
	  in policy-engine.pl, because space appears as "+" in HTML
	  form data.

5/16/00:  Released 2.0.2.

Updated SAINT 2.0 --> 2.0.1: Changes described below

3/20/00:  Made ostype.saint even more gentle. nmap will only
	  scan ports that don't run through inetd, except
	  in heavyplus scans.

3/21/00:  Fixed bug in processing POSTs in perl/html.pl. SAINT
	  now looks at the Content-length field in the http
	  header to know how much data to read. Released
	  patch 1 for SAINT 2.0.

3/22/00:  Added showmount source code for Linux because some modern
	  Linuxes do not include it by default. Developed by
	  University of California at Berkeley and its contributors.

3/22/00:  Added &flush_http_input to html.pl before calling
	  &cookie_leak_warning. This is to fix the "broken pipe"
	  errors given by Netscape when server does not finish
	  reading the POST data.

3/27/00:  Added check for Shaft distributed denial-of-service tool.

3/27/00:  Added check for the Netscape Enterprise Server
	  wp tags vulnerability.

3/27/00:  Updated CVEs using version 20000322.

3/27/00:  Released 2.0.1 beta 1.

3/30/00:  Fixed conflicting definition for xdr_exports in
	  showmount.c. Re-arranged Makefile slightly for Linux targets.
	  Thanks to Anthony Ehrhardt for testing the fix.

4/3/00:   Added check for IRIX objectserver.

4/3/00:   Miscellaneous fixes and improvements thanks to Stefan Rapp:
	  FTP/WWW/Gopher on non-standard port now tells you which port.
	  Common UDP ports are scanned first.
	  fix_hostname now translates everything to lower-case before comparing.
	  ostype.saint now recognizes the plural "guesses" output
	  from new nmap versions.
	  Removed extraneous split from rusers.saint and ignore unnecessary
	  lines.

4/4/00:   Modified open_limit.c to work on bsdi4. Thanks to Faisal
	  Hamid for testing the changes.

4/4/00:   Released 2.0.1 beta 2.

4/5/00:   Made three changes to help make smb checks more robust:
	  Set output buffer size to 1 in smb.saint so output will
	  not be lost if there's a timeout.  Added -d 1 flag to nmblookup
	  to make sure we get the desired information. (In older versions
	  of samba this won't override what's in smb.conf, so you'll
	  still have to remove "debug level = 0" there.) Changed todo
	  ruleset so smb.saint is run if ANY netbios service is running,
	  so the check will still run even if port 139 times out.

4/5/00:   Added %nb_name to &process_facts to store netbios names.
	  Added netbios name output to saint_info_host.pl.

4/12/00:  Added check for Compaq Insight Manager vulnerability
	  courtesy of Steven Lodin

4/17/00:  Removed the (as $text) part from the SMB line in rules/services.
	  It was causing funny output on machines without samba
	  utilities, and the netbios names now show up in saint_info_host
	  anyway.

4/17/00:  Released SAINT 2.0.1.

Updated SAINT 1.5 --> 2.0: Changes described below.

2/2/00:   Now SAINT will return a list of vulnerabilities when
	  run from the command line. -q suppresses output.

2/7/00:   Fixed a number of broken links in html pages thanks
	  to Michael Ellison.

2/9/00:   Completed revisions to documentation.

2/11/00:  Added rule to rules/hosttype to recognize single-field
	  host types identified by NMAP (i.e. Win95, Win98)

2/16/00:  Fixed reconfig to recognize newer versions of PERL.
	  Thanks to LCF for reporting this bug.

2/16/00:  Added NetBus back to rules/facts so it will be found
	  on non-standard ports not checked by backdoors.saint

2/16/00:  Eliminated NMAP host class. Hosts identified by NMAP
	  will now fall under their regular classes. Made
	  other miscellaneous updates to rules/hosttype.

2/16/00:  Added openbsd target to Makefile thanks to Jason Taylor.

2/17/00:  Modified VRFY and EXPN checks in sendmail.saint to
	  eliminate false alarms. Took out EHLO check.

2/21/00:  Added check for Site Wizard Input Validation vulnerability
	  in Site Server to http.saint.

2/22/00:  Modified Telnet.pm to indicate successful login when
	  you get an immediate command prompt or a "choose new
	  password" message instead of a password prompt.
	  Changed rules/todo to use login.saint instead of rsh.saint
	  to check for open accounts.

2/22/00:  Added snmp.saint, developed by Tom Payerle using
	  libraries by Simon Leinen.

2/25/00:  Took extraneous space out of FTP line in rules/services.
	  It was causing FTP service to be missed.

2/25/00:  Now SAINT will run login.saint to guess passwords to
          accounts found by rusers and finger. Added new configuration
	  variable $password_guesses (command line -g)
	  to limit the number of guesses.

2/28/00:  Fixed rules/facts to catch Sendmail versions less
	  than or equal to 5.60.

2/28/00:  Added CVE to output from saint_info_hosts.pl and
	  saint_results_danger.pl.  Added rules/cve to map text
	  field to CVE numbers, and added perl/cve.pl to handle CVE.

2/28/00:  Fixed check for view-source (dash, not underscore)
	  and put into @cgi_red_1 in http.saint.

2/29/00:  Added check for trinoo for Windows.

2/29/00:  Added CVE links to vulnerability tutorials.

3/1/00:   Began changing graphical layout.

3/1/00:   Released SAINT 2.0 BETA 1.

3/2/00:   Modified Makefile for sunos4 to compile ftp-scan.c
	  without stdarg.h, which isn't on SunOS. Thanks to Jim Houser.

3/2/00:   Added target for hpux11 thanks to Andrew Mossberg.
	  (posted to sara-l)

3/6/00:   Fixed bug in html/reporting/sort_hosts.pl by adding
	  %printed=(); thanks to Stefan Rapp.  Fixed a number
	  of modules that weren't handling FW and .PLUS arguments.

3/6/00:   Added check for SGI fam vulnerability.

3/6/00:   Added 1 second delay before sending password in
	  Telnet.pm.  It was sending password too fast for
	  server to handle, especially when scanning localhost.

3/6/00:   Changed ostype.saint to use half-open scan with nmap.
	  This will be less likely to crash remote services.

3/6/00:   Added check for htdig CGI vulnerability.

3/6/00:   Added check for MMDF.

3/7/00:   Added more CVE numbers to rules/cve and tutorials.

3/8/00:   Added check for vulnerabilities in Netscape Enterprise
	  Server and Netscape FastTrack server.

3/8/00:   Converted scripts in html/reporting to the new layout.
	  Added WWDSI logo and link to WWDSI Home to the new layout.

3/8/00:   Released BETA 2.

3/9/00:   Removed rcmd test from rexec.saint because it duplicated
	  the test in rsh.saint.

3/10/00:  Fixed two bugs in Netscape Enterprise Server check.
	  Thanks to Adam Pendleton.

3/10/00:  Added check for infosrch.cgi.

3/10/00:  Fixed up the rsh/rlogin/rexec checks and tutorials.

3/14/00:  Renamed the "Possible DoS (fraggle) problem" tutorial
	  to eliminate the parenthesis.  They were causing problems
	  in some scripts.

3/15/00:  Fixed rusers.saint and finger.saint to report yellow
	  vulnerability and indentified users in all cases.

3/15/00:  Fixed a number of minor bugs in the HTML interface.

3/15/00:  Fixed bug in rsh.saint that was causing "remote
	  shell on Internet" vulnerability to be missed.

3/15/00:  Modified text-output.pl to output the host type instead
	  of "used nmap".

3/16/00:  Released SAINT 2.0.

For previous changes see READMEs/CHANGES-1.3.6-1.5.
