<?xml version="1.0" encoding="utf-8"?>
<report xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" tool_name="Veracode SecurityReview" tool_version="n/a">
	<!--
		Report for "dovecot" with evaluations by SATE analysts
		Date: Wed, 22 Sep 2010 16:53:32 GMT
		SATE 2010
	-->
	<weakness id="1" tool_specific_id="101" uid="53313" selected="yes">
		<name cweid="331">Insufficient Entropy</name>
		<location id="0" path="dovecot-2.0.beta6/src/lib/file-dotlock.c" line="201"/>
		<grade severity="3"/>
		<output>
			<textoutput><![CDATA[Standard random number generators do not provide a sufficient amount of entropy when used for security purposes. Attackers can brute force the output of pseudorandom number generators such as rand().  If this random number is used where security is a concern, such as generating a session key or session identifier, use a trusted cryptographic random number generator instead. These can be found on the Windows platform in the CryptoAPI or in an open source library such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient entropy.  References:  CWE (http://cwe.mitre.org/data/definitions/331.html)  
]]></textoutput>
		</output>
		<evaluation correctness="insignificant">
			<comments><![CDATA[<ol><li>usleep function was called by using the random generated time.  Don&rsquo;t see how this can be vulnerable. </li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="2" tool_specific_id="105" uid="53314" selected="yes">
		<name cweid="331">Insufficient Entropy</name>
		<location id="0" path="dovecot-2.0.beta6/src/lib/file-dotlock.c" line="446"/>
		<grade severity="3"/>
		<output>
			<textoutput><![CDATA[Standard random number generators do not provide a sufficient amount of entropy when used for security purposes. Attackers can brute force the output of pseudorandom number generators such as rand().  If this random number is used where security is a concern, such as generating a session key or session identifier, use a trusted cryptographic random number generator instead. These can be found on the Windows platform in the CryptoAPI or in an open source library such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient entropy.  References:  CWE (http://cwe.mitre.org/data/definitions/331.html)  
]]></textoutput>
		</output>
		<evaluation correctness="insignificant">
			<comments><![CDATA[<ol><li>usleep function was called by using the random generated time.  Don&rsquo;t see how this can be vulnerable. </li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="3" tool_specific_id="83" uid="53315" selected="yes">
		<name cweid="331">Insufficient Entropy</name>
		<location id="0" path="dovecot-2.0.beta6/src/lib/ioloop-epoll.c" line="24"/>
		<grade severity="3"/>
		<output>
			<textoutput><![CDATA[Standard random number generators do not provide a sufficient amount of entropy when used for security purposes. Attackers can brute force the output of pseudorandom number generators such as rand().  If this random number is used where security is a concern, such as generating a session key or session identifier, use a trusted cryptographic random number generator instead. These can be found on the Windows platform in the CryptoAPI or in an open source library such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient entropy.  References:  CWE (http://cwe.mitre.org/data/definitions/331.html)  
]]></textoutput>
		</output>
		<evaluation correctness="false">
			<comments><![CDATA[<ol><li>Could not seeing any code that used any type of random number generator around reported lines.</li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="4" tool_specific_id="29" uid="53316" selected="yes">
		<name cweid="331">Insufficient Entropy</name>
		<location id="0" path="dovecot-2.0.beta6/src/lib/lib.c" line="24"/>
		<grade severity="3"/>
		<output>
			<textoutput><![CDATA[Standard random number generators do not provide a sufficient amount of entropy when used for security purposes. Attackers can brute force the output of pseudorandom number generators such as rand().  If this random number is used where security is a concern, such as generating a session key or session identifier, use a trusted cryptographic random number generator instead. These can be found on the Windows platform in the CryptoAPI or in an open source library such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient entropy.  References:  CWE (http://cwe.mitre.org/data/definitions/331.html)  
]]></textoutput>
		</output>
		<evaluation correctness="unknown">
			<comments><![CDATA[<ol><li>Without having the info of the caller program, it&rsquo;s hard to determine if this code is vulnerable or not.</li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="5" tool_specific_id="73" uid="53317" selected="yes">
		<name cweid="331">Insufficient Entropy</name>
		<location id="0" path="dovecot-2.0.beta6/src/lib/network.c" line="292"/>
		<grade severity="3"/>
		<output>
			<textoutput><![CDATA[Standard random number generators do not provide a sufficient amount of entropy when used for security purposes. Attackers can brute force the output of pseudorandom number generators such as rand().  If this random number is used where security is a concern, such as generating a session key or session identifier, use a trusted cryptographic random number generator instead. These can be found on the Windows platform in the CryptoAPI or in an open source library such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient entropy.  References:  CWE (http://cwe.mitre.org/data/definitions/331.html)  
]]></textoutput>
		</output>
		<evaluation correctness="insignificant">
			<comments><![CDATA[<ol><li>usleep function was called by using the random generated time.  Don&rsquo;t see how this can be vulnerable. </li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="6" tool_specific_id="247" uid="53318" selected="yes">
		<name cweid="331">Insufficient Entropy</name>
		<location id="0" path="dovecot-2.0.beta6/src/lib/randgen.c" line="56"/>
		<grade severity="3"/>
		<output>
			<textoutput><![CDATA[Standard random number generators do not provide a sufficient amount of entropy when used for security purposes. Attackers can brute force the output of pseudorandom number generators such as rand().  If this random number is used where security is a concern, such as generating a session key or session identifier, use a trusted cryptographic random number generator instead. These can be found on the Windows platform in the CryptoAPI or in an open source library such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient entropy.  References:  CWE (http://cwe.mitre.org/data/definitions/331.html)  
]]></textoutput>
		</output>
		<evaluation correctness="unknown">
			<comments><![CDATA[<ol><li>Without having the info of the caller program, it&rsquo;s hard to determine if this code is vulnerable or not.</li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="7" tool_specific_id="110" uid="53319" selected="yes">
		<name cweid="331">Insufficient Entropy</name>
		<location id="0" path="dovecot-2.0.beta6/src/lib/randgen.c" line="120"/>
		<grade severity="3"/>
		<output>
			<textoutput><![CDATA[Standard random number generators do not provide a sufficient amount of entropy when used for security purposes. Attackers can brute force the output of pseudorandom number generators such as rand().  If this random number is used where security is a concern, such as generating a session key or session identifier, use a trusted cryptographic random number generator instead. These can be found on the Windows platform in the CryptoAPI or in an open source library such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient entropy.  References:  CWE (http://cwe.mitre.org/data/definitions/331.html)  
]]></textoutput>
		</output>
		<evaluation correctness="unknown">
			<comments><![CDATA[<ol><li>Without having the info of the caller program, it&rsquo;s hard to determine if this code is vulnerable or not.</li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="8" tool_specific_id="409" uid="53320" selected="yes">
		<name cweid="331">Insufficient Entropy</name>
		<location id="0" path="dovecot-2.0.beta6/src/master/service-monitor.c" line="106"/>
		<grade severity="3"/>
		<output>
			<textoutput><![CDATA[Standard random number generators do not provide a sufficient amount of entropy when used for security purposes. Attackers can brute force the output of pseudorandom number generators such as rand().  If this random number is used where security is a concern, such as generating a session key or session identifier, use a trusted cryptographic random number generator instead. These can be found on the Windows platform in the CryptoAPI or in an open source library such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient entropy.  References:  CWE (http://cwe.mitre.org/data/definitions/331.html)  
]]></textoutput>
		</output>
		<evaluation correctness="insignificant">
			<comments><![CDATA[<ol><li>The standard random number generator used in computing the time for process to be idle does not provide a sufficient amount of entropy.</li>

<li>Re-evaluated.  Not clear how one would attack it.  So change the Correctness from security to insignificant.
<br/></li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="10" tool_specific_id="253" uid="53322" selected="yes">
		<name cweid="391">Unchecked Error Condition</name>
		<location id="0" path="dovecot-2.0.beta6/src/auth/auth-client-connection.c" line="152"/>
		<grade severity="4"/>
		<output>
			<textoutput><![CDATA[The result of this call to strchr() is not checked for success before being used. This can result in application instability or crashing if NULL is returned.  Be sure to check the result and make sure it is not NULL before use.  References:  CWE (http://cwe.mitre.org/data/definitions/391.html)  
]]></textoutput>
		</output>
		<evaluation correctness="insignificant">
			<comments><![CDATA[<ol><li>t_strconcat(), which calls vstrconcat(), tolerates a NULL pointer.  See lib/strfuncs.c lines 176 &amp; 177:
<br/>  str = va_arg(args, const char *);
<br/>} while (str != NULL);
<br/></li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="11" tool_specific_id="250" uid="53323" selected="yes">
		<name cweid="391">Unchecked Error Condition</name>
		<location id="0" path="dovecot-2.0.beta6/src/auth/auth-request.c" line="1526"/>
		<grade severity="4"/>
		<output>
			<textoutput><![CDATA[The result of this call to strchr() is not checked for success before being used. This can result in application instability or crashing if NULL is returned.  Be sure to check the result and make sure it is not NULL before use.  References:  CWE (http://cwe.mitre.org/data/definitions/391.html)  
]]></textoutput>
		</output>
		<evaluation correctness="false">
			<comments><![CDATA[<ol><li>The immediate use of tab[2].value is checked for success before being used:
<br/>tab[2].value = strchr(auth_request-&gt;user, &#039;@&#039;);
<br/>    if (tab[2].value != NULL)
<br/>        tab[2].value = escape_func(tab[2].value+1, auth_request);
<br/>
<br/>I checked a couple of uses of the returned table, and those also checked for NULL before using.</li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="12" tool_specific_id="246" uid="53324" selected="yes">
		<name cweid="391">Unchecked Error Condition</name>
		<location id="0" path="dovecot-2.0.beta6/src/auth/auth-request.c" line="1560"/>
		<grade severity="4"/>
		<output>
			<textoutput><![CDATA[The result of this call to strchr() is not checked for success before being used. This can result in application instability or crashing if NULL is returned.  Be sure to check the result and make sure it is not NULL before use.  References:  CWE (http://cwe.mitre.org/data/definitions/391.html)  
]]></textoutput>
		</output>
		<evaluation correctness="false">
			<comments><![CDATA[<ol><li>The immediate use of tab[17].value is checked for success before being used:
<br/>tab[17].value = strchr(login_user, &#039;@&#039;);
<br/>    if (tab[17].value != NULL) {
<br/>         tab[17].value = escape_func(tab[17].value+1, auth_request);
<br/>
<br/>I checked a couple of uses of the returned table, and those also check for NULL before using.</li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="13" tool_specific_id="345" uid="53325" selected="yes">
		<name cweid="391">Unchecked Error Condition</name>
		<location id="0" path="dovecot-2.0.beta6/src/login-common/client-common.c" line="373"/>
		<grade severity="4"/>
		<output>
			<textoutput><![CDATA[The result of this call to getenv() is not captured, so it cannot be checked for success. This can result in application instability or crashing if memory is not available.  Be sure to check the result and make sure it is correct before use. Some functions return a pointer which should be validated as not NULL before use. Other functions return integers or Boolean values that must either be zero or non-zero for the results of the function to be used. Consult the API documentation to determine what a correct result is from the function call.  References:  CWE (http://cwe.mitre.org/data/definitions/391.html)  OWASP (http://www.owasp.org/index.php/Improper_error_handling)  
]]></textoutput>
		</output>
		<evaluation correctness="insignificant">
			<comments><![CDATA[<ol><li>I looked at a couple of uses of the returned table, and those check for NULL before using.</li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="14" tool_specific_id="177" uid="53326" selected="yes">
		<name cweid="391">Unchecked Error Condition</name>
		<location id="0" path="dovecot-2.0.beta6/src/config/config-parser.c" line="65"/>
		<grade severity="4"/>
		<output>
			<textoutput><![CDATA[The result of this call to strchr() is not checked for success before being used. This can result in application instability or crashing if NULL is returned.  Be sure to check the result and make sure it is not NULL before use.  References:  CWE (http://cwe.mitre.org/data/definitions/391.html)  
]]></textoutput>
		</output>
		<evaluation correctness="insignificant">
			<comments><![CDATA[<ol><li>Every single call to config_apply_line() will have &#039;=&#039; in the line somewhere.</li>

<li>... and config_add_type() is only called from config_apply_line()</li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="15" tool_specific_id="252" uid="53327" selected="yes">
		<name cweid="391">Unchecked Error Condition</name>
		<location id="0" path="dovecot-2.0.beta6/src/auth/db-checkpassword.c" line="17"/>
		<grade severity="4"/>
		<output>
			<textoutput><![CDATA[The result of this call to strchr() is not checked for success before being used. This can result in application instability or crashing if NULL is returned.  Be sure to check the result and make sure it is not NULL before use.  References:  CWE (http://cwe.mitre.org/data/definitions/391.html)  
]]></textoutput>
		</output>
		<evaluation correctness="false">
			<comments><![CDATA[<ol><li>The result is checked in the next line.</li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="17" tool_specific_id="561" uid="53329" selected="yes">
		<name cweid="391">Unchecked Error Condition</name>
		<location id="0" path="dovecot-2.0.beta6/src/doveadm/doveadm-who.c" line="69"/>
		<grade severity="4"/>
		<output>
			<textoutput><![CDATA[The result of this call to strchr() is not checked for success before being used. This can result in application instability or crashing if NULL is returned.  Be sure to check the result and make sure it is not NULL before use.  References:  CWE (http://cwe.mitre.org/data/definitions/391.html)  
]]></textoutput>
		</output>
		<evaluation correctness="quality">
			<comments><![CDATA[<ol><li>It looks like there might be lines missing &#039;/&#039;, in which case strchr() would fail.
<br/></li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="18" tool_specific_id="175" uid="53330" selected="yes">
		<name cweid="391">Unchecked Error Condition</name>
		<location id="0" path="dovecot-2.0.beta6/src/config/doveconf.c" line="271"/>
		<grade severity="4"/>
		<output>
			<textoutput><![CDATA[The result of this call to strchr() is not checked for success before being used. This can result in application instability or crashing if NULL is returned.  Be sure to check the result and make sure it is not NULL before use.  References:  CWE (http://cwe.mitre.org/data/definitions/391.html)  
]]></textoutput>
		</output>
		<evaluation correctness="unknown">
			<comments><![CDATA[<ol><li>I&#039;ll bet this reads from machine-generated text, so &#039;=&#039; is guaranteed, but I can&#039;t find it.</li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="19" tool_specific_id="682" uid="53331" selected="yes">
		<name cweid="391">Unchecked Error Condition</name>
		<location id="0" path="dovecot-2.0.beta6/src/dsync/dsync.c" line="29"/>
		<grade severity="4"/>
		<output>
			<textoutput><![CDATA[Message could not be created!
]]></textoutput>
		</output>
		<evaluation correctness="false">
			<comments><![CDATA[<ol><li>The enclosing switch is the check for errors.</li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="21" tool_specific_id="108" uid="53333" selected="yes">
		<name cweid="391">Unchecked Error Condition</name>
		<location id="0" path="dovecot-2.0.beta6/src/lib/file-dotlock.c" line="329"/>
		<grade severity="4"/>
		<output>
			<textoutput><![CDATA[The result of this call to strrchr() is not checked for success before being used. This can result in application instability or crashing if NULL is returned.  Be sure to check the result and make sure it is not NULL before use.  References:  CWE (http://cwe.mitre.org/data/definitions/391.html)  
]]></textoutput>
		</output>
		<evaluation correctness="quality">
			<comments><![CDATA[<ol><li>This is ultimately called by file_dotlock_create() and file_dotlock_open(), which are used in many places.  Maybe each use guarantees that there is &#039;/&#039; in the path, but why not make the code more obviously correct?</li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="22" tool_specific_id="498" uid="53334" selected="yes">
		<name cweid="391">Unchecked Error Condition</name>
		<location id="0" path="dovecot-2.0.beta6/src/lib-index/mail-cache.c" line="25"/>
		<grade severity="4"/>
		<output>
			<textoutput><![CDATA[The result of this call to unlink() is not captured, so it cannot be checked for success. This can result in application instability or crashing if memory is not available.  Be sure to check the result and make sure it is correct before use. Some functions return a pointer which should be validated as not NULL before use. Other functions return integers or Boolean values that must either be zero or non-zero for the results of the function to be used. Consult the API documentation to determine what a correct result is from the function call.  References:  CWE (http://cwe.mitre.org/data/definitions/391.html)  OWASP (http://www.owasp.org/index.php/Improper_error_handling)  
]]></textoutput>
		</output>
		<evaluation correctness="insignificant">
			<comments><![CDATA[<ol><li>What can you do when you fail to unlink() your own file?  The cast to void on an unlink check suggest the issue was considered and rejected.</li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="23" tool_specific_id="611" uid="53335" selected="yes">
		<name cweid="391">Unchecked Error Condition</name>
		<location id="0" path="dovecot-2.0.beta6/src/lib-index/mail-index-strmap.c" line="247"/>
		<grade severity="4"/>
		<output>
			<textoutput><![CDATA[The result of this call to unlink() is not captured, so it cannot be checked for success. This can result in application instability or crashing if memory is not available.  Be sure to check the result and make sure it is correct before use. Some functions return a pointer which should be validated as not NULL before use. Other functions return integers or Boolean values that must either be zero or non-zero for the results of the function to be used. Consult the API documentation to determine what a correct result is from the function call.  References:  CWE (http://cwe.mitre.org/data/definitions/391.html)  OWASP (http://www.owasp.org/index.php/Improper_error_handling)  
]]></textoutput>
		</output>
		<evaluation correctness="insignificant">
			<comments><![CDATA[<ol><li>What can you do when you fail to unlink() your own file? The cast to void of unlink() result could suggest the issue was considered and rejected.</li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="24" tool_specific_id="600" uid="53336" selected="yes">
		<name cweid="391">Unchecked Error Condition</name>
		<location id="0" path="dovecot-2.0.beta6/src/lib-index/mail-index-strmap.c" line="289"/>
		<grade severity="4"/>
		<output>
			<textoutput><![CDATA[The result of this call to unlink() is not captured, so it cannot be checked for success. This can result in application instability or crashing if memory is not available.  Be sure to check the result and make sure it is correct before use. Some functions return a pointer which should be validated as not NULL before use. Other functions return integers or Boolean values that must either be zero or non-zero for the results of the function to be used. Consult the API documentation to determine what a correct result is from the function call.  References:  CWE (http://cwe.mitre.org/data/definitions/391.html)  OWASP (http://www.owasp.org/index.php/Improper_error_handling)  
]]></textoutput>
		</output>
		<evaluation correctness="insignificant">
			<comments><![CDATA[<ol><li>What can you do when you fail to unlink() your own file? The cast to void of unlink() result could suggest the issue was considered and rejected.</li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="27" tool_specific_id="99" uid="53339" selected="yes">
		<name cweid="391">Unchecked Error Condition</name>
		<location id="0" path="dovecot-2.0.beta6/src/util/maildirlock.c" line="32"/>
		<grade severity="4"/>
		<output>
			<textoutput><![CDATA[The result of this call to getenv() is not checked for success before being used. This can result in application instability or crashing if memory is not available.  Be sure to check the result and make sure it is correct before use. Some functions return a pointer which should be validated as not NULL before use. Other functions return integers or Boolean values that must either be zero or non-zero for the results of the function to be used. Consult the API documentation to determine what a correct result is from the function call.  References:  CWE (http://cwe.mitre.org/data/definitions/391.html)  OWASP (http://www.owasp.org/index.php/Improper_error_handling)  
]]></textoutput>
		</output>
		<evaluation correctness="false">
			<comments><![CDATA[<ol><li>The result is checked in that very statement.</li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="28" tool_specific_id="156" uid="53340" selected="yes">
		<name cweid="391">Unchecked Error Condition</name>
		<location id="0" path="dovecot-2.0.beta6/src/lib-master/master-service.c" line="175"/>
		<grade severity="4"/>
		<output>
			<textoutput><![CDATA[The result of this call to getenv() is not checked for success before being used. This can result in application instability or crashing if memory is not available.  Be sure to check the result and make sure it is correct before use. Some functions return a pointer which should be validated as not NULL before use. Other functions return integers or Boolean values that must either be zero or non-zero for the results of the function to be used. Consult the API documentation to determine what a correct result is from the function call.  References:  CWE (http://cwe.mitre.org/data/definitions/391.html)  OWASP (http://www.owasp.org/index.php/Improper_error_handling)  
]]></textoutput>
		</output>
		<evaluation correctness="false">
			<comments><![CDATA[<ol><li>Context clearly shows that getenv(&quot;USER&quot;) will always succeed at line 176
<br/>line 174 if (getenv(&quot;USER&quot;) != NULL) {
<br/>line 175 i_set_failure_prefix(t_strdup_printf(&quot;%s(%s): &quot;,
<br/>line 176    name, getenv(&quot;USER&quot;)));</li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="29" tool_specific_id="173" uid="53341" selected="yes">
		<name cweid="391">Unchecked Error Condition</name>
		<location id="0" path="dovecot-2.0.beta6/src/config/old-set-parser.c" line="119"/>
		<grade severity="4"/>
		<output>
			<textoutput><![CDATA[The result of this call to strrchr() is not checked for success before being used. This can result in application instability or crashing if NULL is returned.  Be sure to check the result and make sure it is not NULL before use.  References:  CWE (http://cwe.mitre.org/data/definitions/391.html)  
]]></textoutput>
		</output>
		<evaluation correctness="false">
			<comments><![CDATA[<ol><li>Context clearly guarantees that strchr() will succeed:
<br/>if (strcmp(key, &quot;ssl_cert_file&quot;) == 0 ||
<br/>    strcmp(key, &quot;ssl_key_file&quot;) == 0 ||
<br/>    strcmp(key, &quot;ssl_ca_file&quot;) == 0) {
<br/>  ...
<br/>    p = t_strdup_until(key, strrchr(key, &#039;_&#039;));
<br/></li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="30" tool_specific_id="201" uid="53342" selected="yes">
		<name cweid="391">Unchecked Error Condition</name>
		<location id="0" path="dovecot-2.0.beta6/src/util/rawlog.c" line="347"/>
		<grade severity="4"/>
		<output>
			<textoutput><![CDATA[The result of this call to getenv() is not captured, so it cannot be checked for success. This can result in application instability or crashing if memory is not available.  Be sure to check the result and make sure it is correct before use. Some functions return a pointer which should be validated as not NULL before use. Other functions return integers or Boolean values that must either be zero or non-zero for the results of the function to be used. Consult the API documentation to determine what a correct result is from the function call.  References:  CWE (http://cwe.mitre.org/data/definitions/391.html)  OWASP (http://www.owasp.org/index.php/Improper_error_handling)  
]]></textoutput>
		</output>
		<evaluation correctness="insignificant">
			<comments><![CDATA[<ol><li>restrict_access_by_env() checks if the parameter is null, so this never causes a problem.</li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="33" tool_specific_id="154" uid="53345" selected="yes">
		<name cweid="391">Unchecked Error Condition</name>
		<location id="0" path="dovecot-2.0.beta6/src/lib/restrict-access.c" line="406"/>
		<grade severity="4"/>
		<output>
			<textoutput><![CDATA[The result of this call to getenv() is not captured, so it cannot be checked for success. This can result in application instability or crashing if memory is not available.  Be sure to check the result and make sure it is correct before use. Some functions return a pointer which should be validated as not NULL before use. Other functions return integers or Boolean values that must either be zero or non-zero for the results of the function to be used. Consult the API documentation to determine what a correct result is from the function call.  References:  CWE (http://cwe.mitre.org/data/definitions/391.html)  OWASP (http://www.owasp.org/index.php/Improper_error_handling)  
]]></textoutput>
		</output>
		<evaluation correctness="false">
			<comments><![CDATA[<ol><li>Analysis is incorrect: the result is captured.  In addition, null_if_empty() replaces NULL with the empty string.</li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="35" tool_specific_id="109" uid="53347" selected="yes">
		<name cweid="391">Unchecked Error Condition</name>
		<location id="0" path="dovecot-2.0.beta6/src/lib/safe-mkstemp.c" line="67"/>
		<grade severity="4"/>
		<output>
			<textoutput><![CDATA[The result of this call to unlink() is not captured, so it cannot be checked for success. This can result in application instability or crashing if memory is not available.  Be sure to check the result and make sure it is correct before use. Some functions return a pointer which should be validated as not NULL before use. Other functions return integers or Boolean values that must either be zero or non-zero for the results of the function to be used. Consult the API documentation to determine what a correct result is from the function call.  References:  CWE (http://cwe.mitre.org/data/definitions/391.html)  OWASP (http://www.owasp.org/index.php/Improper_error_handling)  
]]></textoutput>
		</output>
		<evaluation correctness="insignificant">
			<comments><![CDATA[<ol><li>What can you do when you fail to unlink() your own file? The cast to void of unlink() result could suggest the issue was considered and rejected.</li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="37" tool_specific_id="267" uid="53349" selected="yes">
		<name cweid="391">Unchecked Error Condition</name>
		<location id="0" path="dovecot-2.0.beta6/src/ssl-params/ssl-params.c" line="173"/>
		<grade severity="4"/>
		<output>
			<textoutput><![CDATA[The result of this call to unlink() is not captured, so it cannot be checked for success. This can result in application instability or crashing if memory is not available.  Be sure to check the result and make sure it is correct before use. Some functions return a pointer which should be validated as not NULL before use. Other functions return integers or Boolean values that must either be zero or non-zero for the results of the function to be used. Consult the API documentation to determine what a correct result is from the function call.  References:  CWE (http://cwe.mitre.org/data/definitions/391.html)  OWASP (http://www.owasp.org/index.php/Improper_error_handling)  
]]></textoutput>
		</output>
		<evaluation correctness="insignificant">
			<comments><![CDATA[<ol><li>What can you do when you fail to unlink() your own file? The cast to void of unlink() result could suggest the issue was considered and rejected.</li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="38" tool_specific_id="182" uid="53350" selected="yes">
		<name cweid="391">Unchecked Error Condition</name>
		<location id="0" path="dovecot-2.0.beta6/src/config/sysinfo-get.c" line="50"/>
		<grade severity="4"/>
		<output>
			<textoutput><![CDATA[The result of this call to strrchr() is not captured, so it cannot be checked for success. Using the unchecked value can result in application instability or crashing if NULL is returned.  Be sure to capture and check the result and make sure it is not NULL before use.  References:  CWE (http://cwe.mitre.org/data/definitions/391.html)  
]]></textoutput>
		</output>
		<evaluation correctness="false">
			<comments><![CDATA[<ol><li>The result is captured.  It is passed to t_strdup_until() which has an assertion that aborts if there is a NULL.  See lib/strfuncs.c line 61
<br/></li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="39" tool_specific_id="172" uid="53351" selected="yes">
		<name cweid="391">Unchecked Error Condition</name>
		<location id="0" path="dovecot-2.0.beta6/src/lib/var-expand.c" line="170"/>
		<grade severity="4"/>
		<output>
			<textoutput><![CDATA[The result of this call to getenv() is not checked for success before being used. This can result in application instability or crashing if memory is not available.  Be sure to check the result and make sure it is correct before use. Some functions return a pointer which should be validated as not NULL before use. Other functions return integers or Boolean values that must either be zero or non-zero for the results of the function to be used. Consult the API documentation to determine what a correct result is from the function call.  References:  CWE (http://cwe.mitre.org/data/definitions/391.html)  OWASP (http://www.owasp.org/index.php/Improper_error_handling)  
]]></textoutput>
		</output>
		<evaluation correctness="false">
			<comments><![CDATA[<ol><li>The result is checked before use.  The function is only called at line 255, and the value is checked at line 256.</li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="9" tool_specific_id="243" uid="53321" selected="no">
		<name cweid="391">Unchecked Error Condition</name>
		<location id="0" path="dovecot-2.0.beta6/src/auth/auth-client-connection.c" line="42"/>
		<grade severity="4"/>
		<output>
			<textoutput><![CDATA[The result of this call to strchr() is not checked for success before being used. This can result in application instability or crashing if NULL is returned.  Be sure to check the result and make sure it is not NULL before use.  References:  CWE (http://cwe.mitre.org/data/definitions/391.html)  
]]></textoutput>
		</output>
	</weakness>
	<weakness id="16" tool_specific_id="554" uid="53328" selected="no">
		<name cweid="391">Unchecked Error Condition</name>
		<location id="0" path="dovecot-2.0.beta6/src/doveadm/doveadm-who.c" line="66"/>
		<grade severity="4"/>
		<output>
			<textoutput><![CDATA[The result of this call to strchr() is not checked for success before being used. This can result in application instability or crashing if NULL is returned.  Be sure to check the result and make sure it is not NULL before use.  References:  CWE (http://cwe.mitre.org/data/definitions/391.html)  
]]></textoutput>
		</output>
	</weakness>
	<weakness id="20" tool_specific_id="702" uid="53332" selected="no">
		<name cweid="391">Unchecked Error Condition</name>
		<location id="0" path="dovecot-2.0.beta6/src/dsync/dsync.c" line="97"/>
		<grade severity="4"/>
		<output>
			<textoutput><![CDATA[The result of this call to getenv() is not checked for success before being used. This can result in application instability or crashing if memory is not available.  Be sure to check the result and make sure it is correct before use. Some functions return a pointer which should be validated as not NULL before use. Other functions return integers or Boolean values that must either be zero or non-zero for the results of the function to be used. Consult the API documentation to determine what a correct result is from the function call.  References:  CWE (http://cwe.mitre.org/data/definitions/391.html)  OWASP (http://www.owasp.org/index.php/Improper_error_handling)  
]]></textoutput>
		</output>
	</weakness>
	<weakness id="25" tool_specific_id="610" uid="53337" selected="no">
		<name cweid="391">Unchecked Error Condition</name>
		<location id="0" path="dovecot-2.0.beta6/src/lib-index/mail-index-strmap.c" line="1038"/>
		<grade severity="4"/>
		<output>
			<textoutput><![CDATA[The result of this call to unlink() is not captured, so it cannot be checked for success. This can result in application instability or crashing if memory is not available.  Be sure to check the result and make sure it is correct before use. Some functions return a pointer which should be validated as not NULL before use. Other functions return integers or Boolean values that must either be zero or non-zero for the results of the function to be used. Consult the API documentation to determine what a correct result is from the function call.  References:  CWE (http://cwe.mitre.org/data/definitions/391.html)  OWASP (http://www.owasp.org/index.php/Improper_error_handling)  
]]></textoutput>
		</output>
	</weakness>
	<weakness id="26" tool_specific_id="502" uid="53338" selected="no">
		<name cweid="391">Unchecked Error Condition</name>
		<location id="0" path="dovecot-2.0.beta6/src/lib-index/mailbox-list-index.c" line="89"/>
		<grade severity="4"/>
		<output>
			<textoutput><![CDATA[The result of this call to unlink() is not captured, so it cannot be checked for success. This can result in application instability or crashing if memory is not available.  Be sure to check the result and make sure it is correct before use. Some functions return a pointer which should be validated as not NULL before use. Other functions return integers or Boolean values that must either be zero or non-zero for the results of the function to be used. Consult the API documentation to determine what a correct result is from the function call.  References:  CWE (http://cwe.mitre.org/data/definitions/391.html)  OWASP (http://www.owasp.org/index.php/Improper_error_handling)  
]]></textoutput>
		</output>
	</weakness>
	<weakness id="31" tool_specific_id="199" uid="53343" selected="no">
		<name cweid="391">Unchecked Error Condition</name>
		<location id="0" path="dovecot-2.0.beta6/src/util/rawlog.c" line="349"/>
		<grade severity="4"/>
		<output>
			<textoutput><![CDATA[The result of this call to getenv() is not checked for success before being used. This can result in application instability or crashing if memory is not available.  Be sure to check the result and make sure it is correct before use. Some functions return a pointer which should be validated as not NULL before use. Other functions return integers or Boolean values that must either be zero or non-zero for the results of the function to be used. Consult the API documentation to determine what a correct result is from the function call.  References:  CWE (http://cwe.mitre.org/data/definitions/391.html)  OWASP (http://www.owasp.org/index.php/Improper_error_handling)  
]]></textoutput>
		</output>
	</weakness>
	<weakness id="32" tool_specific_id="158" uid="53344" selected="no">
		<name cweid="391">Unchecked Error Condition</name>
		<location id="0" path="dovecot-2.0.beta6/src/lib/restrict-access.c" line="405"/>
		<grade severity="4"/>
		<output>
			<textoutput><![CDATA[The result of this call to getenv() is not captured, so it cannot be checked for success. This can result in application instability or crashing if memory is not available.  Be sure to check the result and make sure it is correct before use. Some functions return a pointer which should be validated as not NULL before use. Other functions return integers or Boolean values that must either be zero or non-zero for the results of the function to be used. Consult the API documentation to determine what a correct result is from the function call.  References:  CWE (http://cwe.mitre.org/data/definitions/391.html)  OWASP (http://www.owasp.org/index.php/Improper_error_handling)  
]]></textoutput>
		</output>
		<evaluation correctness="false">
			<comments><![CDATA[<ol><li>Analysis is incorrect: the result is captured. In addition, null_if_empty() replaces NULL with the empty string.</li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="34" tool_specific_id="155" uid="53346" selected="no">
		<name cweid="391">Unchecked Error Condition</name>
		<location id="0" path="dovecot-2.0.beta6/src/lib/restrict-access.c" line="407"/>
		<grade severity="4"/>
		<output>
			<textoutput><![CDATA[The result of this call to getenv() is not captured, so it cannot be checked for success. This can result in application instability or crashing if memory is not available.  Be sure to check the result and make sure it is correct before use. Some functions return a pointer which should be validated as not NULL before use. Other functions return integers or Boolean values that must either be zero or non-zero for the results of the function to be used. Consult the API documentation to determine what a correct result is from the function call.  References:  CWE (http://cwe.mitre.org/data/definitions/391.html)  OWASP (http://www.owasp.org/index.php/Improper_error_handling)  
]]></textoutput>
		</output>
		<evaluation correctness="false">
			<comments><![CDATA[<ol><li>Analysis is incorrect: the result is captured. In addition, null_if_empty() replaces NULL with the empty string.</li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="36" tool_specific_id="148" uid="53348" selected="no">
		<name cweid="391">Unchecked Error Condition</name>
		<location id="0" path="dovecot-2.0.beta6/src/lib-settings/settings-parser.c" line="700"/>
		<grade severity="4"/>
		<output>
			<textoutput><![CDATA[The result of this call to strrchr() is not checked for success before being used. This can result in application instability or crashing if NULL is returned.  Be sure to check the result and make sure it is not NULL before use.  References:  CWE (http://cwe.mitre.org/data/definitions/391.html)  
]]></textoutput>
		</output>
	</weakness>
	<weakness id="40" tool_specific_id="72" uid="53352" selected="no">
		<name cweid="656">Reliance on Security through Obscurity</name>
		<location id="0" path="dovecot-2.0.beta6/src/auth/checkpassword-reply.c" line="11"/>
		<grade severity="5"/>
		<output>
			<textoutput><![CDATA[The binary contains embedded data that has a high level of entropy. 0 blocks of high entropy data were discovered in the code section of the binary and 1 blocks in the data section. This indicates the use of either compression or encryption. Encryption of data is typically used for obfuscation purposes and to hide functionality or static data within the binary.  Ensure that the high entropy blocks within the binary are tied to data or code that is expected to be embedded into the application. Do not rely on embedded encryption to secure sensitive data.  References:  CWE (http://www.mitre.org/data/definitions/656.html)  
]]></textoutput>
		</output>
	</weakness>
	<weakness id="41" tool_specific_id="379" uid="53353" selected="no">
		<name cweid="656">Reliance on Security through Obscurity</name>
		<location id="0" path="dovecot-2.0.beta6/src/dns/dns-client.c" line="130"/>
		<grade severity="5"/>
		<output>
			<textoutput><![CDATA[The binary contains embedded data that has a high level of entropy. 0 blocks of high entropy data were discovered in the code section of the binary and 1 blocks in the data section. This indicates the use of either compression or encryption. Encryption of data is typically used for obfuscation purposes and to hide functionality or static data within the binary.  Ensure that the high entropy blocks within the binary are tied to data or code that is expected to be embedded into the application. Do not rely on embedded encryption to secure sensitive data.  References:  CWE (http://www.mitre.org/data/definitions/656.html)  
]]></textoutput>
		</output>
	</weakness>
	<weakness id="42" tool_specific_id="569" uid="53354" selected="no">
		<name cweid="656">Reliance on Security through Obscurity</name>
		<location id="0" path="dovecot-2.0.beta6/src/doveadm/doveadm.c" line="284"/>
		<grade severity="5"/>
		<output>
			<textoutput><![CDATA[The binary contains embedded data that has a high level of entropy. 0 blocks of high entropy data were discovered in the code section of the binary and 1 blocks in the data section. This indicates the use of either compression or encryption. Encryption of data is typically used for obfuscation purposes and to hide functionality or static data within the binary.  Ensure that the high entropy blocks within the binary are tied to data or code that is expected to be embedded into the application. Do not rely on embedded encryption to secure sensitive data.  References:  CWE (http://www.mitre.org/data/definitions/656.html)  
]]></textoutput>
		</output>
	</weakness>
	<weakness id="43" tool_specific_id="179" uid="53355" selected="no">
		<name cweid="656">Reliance on Security through Obscurity</name>
		<location id="0" path="dovecot-2.0.beta6/src/config/doveconf.c" line="533"/>
		<grade severity="5"/>
		<output>
			<textoutput><![CDATA[The binary contains embedded data that has a high level of entropy. 0 blocks of high entropy data were discovered in the code section of the binary and 1 blocks in the data section. This indicates the use of either compression or encryption. Encryption of data is typically used for obfuscation purposes and to hide functionality or static data within the binary.  Ensure that the high entropy blocks within the binary are tied to data or code that is expected to be embedded into the application. Do not rely on embedded encryption to secure sensitive data.  References:  CWE (http://www.mitre.org/data/definitions/656.html)  
]]></textoutput>
		</output>
	</weakness>
	<weakness id="44" tool_specific_id="707" uid="53356" selected="no">
		<name cweid="656">Reliance on Security through Obscurity</name>
		<location id="0" path="dovecot-2.0.beta6/src/dsync/dsync.c" line="76"/>
		<grade severity="5"/>
		<output>
			<textoutput><![CDATA[The binary contains embedded data that has a high level of entropy. 0 blocks of high entropy data were discovered in the code section of the binary and 1 blocks in the data section. This indicates the use of either compression or encryption. Encryption of data is typically used for obfuscation purposes and to hide functionality or static data within the binary.  Ensure that the high entropy blocks within the binary are tied to data or code that is expected to be embedded into the application. Do not rely on embedded encryption to secure sensitive data.  References:  CWE (http://www.mitre.org/data/definitions/656.html)  
]]></textoutput>
		</output>
	</weakness>
	<weakness id="45" tool_specific_id="6" uid="53357" selected="no">
		<name cweid="656">Reliance on Security through Obscurity</name>
		<location id="0" path="dovecot-2.0.beta6/src/util/gdbhelper.c" line="13"/>
		<grade severity="5"/>
		<output>
			<textoutput><![CDATA[The binary contains embedded data that has a high level of entropy. 0 blocks of high entropy data were discovered in the code section of the binary and 1 blocks in the data section. This indicates the use of either compression or encryption. Encryption of data is typically used for obfuscation purposes and to hide functionality or static data within the binary.  Ensure that the high entropy blocks within the binary are tied to data or code that is expected to be embedded into the application. Do not rely on embedded encryption to secure sensitive data.  References:  CWE (http://www.mitre.org/data/definitions/656.html)  
]]></textoutput>
		</output>
	</weakness>
	<weakness id="46" tool_specific_id="132" uid="53358" selected="no">
		<name cweid="656">Reliance on Security through Obscurity</name>
		<location id="0" path="dovecot-2.0.beta6/src/util/listview.c" line="129"/>
		<grade severity="5"/>
		<output>
			<textoutput><![CDATA[The binary contains embedded data that has a high level of entropy. 0 blocks of high entropy data were discovered in the code section of the binary and 1 blocks in the data section. This indicates the use of either compression or encryption. Encryption of data is typically used for obfuscation purposes and to hide functionality or static data within the binary.  Ensure that the high entropy blocks within the binary are tied to data or code that is expected to be embedded into the application. Do not rely on embedded encryption to secure sensitive data.  References:  CWE (http://www.mitre.org/data/definitions/656.html)  
]]></textoutput>
		</output>
	</weakness>
	<weakness id="47" tool_specific_id="104" uid="53359" selected="no">
		<name cweid="656">Reliance on Security through Obscurity</name>
		<location id="0" path="dovecot-2.0.beta6/src/util/maildirlock.c" line="39"/>
		<grade severity="5"/>
		<output>
			<textoutput><![CDATA[The binary contains embedded data that has a high level of entropy. 0 blocks of high entropy data were discovered in the code section of the binary and 1 blocks in the data section. This indicates the use of either compression or encryption. Encryption of data is typically used for obfuscation purposes and to hide functionality or static data within the binary.  Ensure that the high entropy blocks within the binary are tied to data or code that is expected to be embedded into the application. Do not rely on embedded encryption to secure sensitive data.  References:  CWE (http://www.mitre.org/data/definitions/656.html)  
]]></textoutput>
		</output>
	</weakness>
	<weakness id="48" tool_specific_id="315" uid="53360" selected="no">
		<name cweid="656">Reliance on Security through Obscurity</name>
		<location id="0" path="dovecot-2.0.beta6/src/config/main.c" line="18"/>
		<grade severity="5"/>
		<output>
			<textoutput><![CDATA[The binary contains embedded data that has a high level of entropy. 0 blocks of high entropy data were discovered in the code section of the binary and 1 blocks in the data section. This indicates the use of either compression or encryption. Encryption of data is typically used for obfuscation purposes and to hide functionality or static data within the binary.  Ensure that the high entropy blocks within the binary are tied to data or code that is expected to be embedded into the application. Do not rely on embedded encryption to secure sensitive data.  References:  CWE (http://www.mitre.org/data/definitions/656.html)  
]]></textoutput>
		</output>
	</weakness>
	<weakness id="49" tool_specific_id="330" uid="53361" selected="no">
		<name cweid="656">Reliance on Security through Obscurity</name>
		<location id="0" path="dovecot-2.0.beta6/src/log/main.c" line="38"/>
		<grade severity="5"/>
		<output>
			<textoutput><![CDATA[The binary contains embedded data that has a high level of entropy. 0 blocks of high entropy data were discovered in the code section of the binary and 1 blocks in the data section. This indicates the use of either compression or encryption. Encryption of data is typically used for obfuscation purposes and to hide functionality or static data within the binary.  Ensure that the high entropy blocks within the binary are tied to data or code that is expected to be embedded into the application. Do not rely on embedded encryption to secure sensitive data.  References:  CWE (http://www.mitre.org/data/definitions/656.html)  
]]></textoutput>
		</output>
	</weakness>
	<weakness id="50" tool_specific_id="221" uid="53362" selected="no">
		<name cweid="656">Reliance on Security through Obscurity</name>
		<location id="0" path="dovecot-2.0.beta6/src/anvil/main.c" line="51"/>
		<grade severity="5"/>
		<output>
			<textoutput><![CDATA[The binary contains embedded data that has a high level of entropy. 0 blocks of high entropy data were discovered in the code section of the binary and 1 blocks in the data section. This indicates the use of either compression or encryption. Encryption of data is typically used for obfuscation purposes and to hide functionality or static data within the binary.  Ensure that the high entropy blocks within the binary are tied to data or code that is expected to be embedded into the application. Do not rely on embedded encryption to secure sensitive data.  References:  CWE (http://www.mitre.org/data/definitions/656.html)  
]]></textoutput>
		</output>
	</weakness>
	<weakness id="51" tool_specific_id="635" uid="53363" selected="no">
		<name cweid="656">Reliance on Security through Obscurity</name>
		<location id="0" path="dovecot-2.0.beta6/src/lmtp/main.c" line="69"/>
		<grade severity="5"/>
		<output>
			<textoutput><![CDATA[The binary contains embedded data that has a high level of entropy. 0 blocks of high entropy data were discovered in the code section of the binary and 1 blocks in the data section. This indicates the use of either compression or encryption. Encryption of data is typically used for obfuscation purposes and to hide functionality or static data within the binary.  Ensure that the high entropy blocks within the binary are tied to data or code that is expected to be embedded into the application. Do not rely on embedded encryption to secure sensitive data.  References:  CWE (http://www.mitre.org/data/definitions/656.html)  
]]></textoutput>
		</output>
	</weakness>
	<weakness id="52" tool_specific_id="364" uid="53364" selected="no">
		<name cweid="656">Reliance on Security through Obscurity</name>
		<location id="0" path="dovecot-2.0.beta6/src/dict/main.c" line="81"/>
		<grade severity="5"/>
		<output>
			<textoutput><![CDATA[The binary contains embedded data that has a high level of entropy. 0 blocks of high entropy data were discovered in the code section of the binary and 1 blocks in the data section. This indicates the use of either compression or encryption. Encryption of data is typically used for obfuscation purposes and to hide functionality or static data within the binary.  Ensure that the high entropy blocks within the binary are tied to data or code that is expected to be embedded into the application. Do not rely on embedded encryption to secure sensitive data.  References:  CWE (http://www.mitre.org/data/definitions/656.html)  
]]></textoutput>
		</output>
	</weakness>
	<weakness id="53" tool_specific_id="268" uid="53365" selected="no">
		<name cweid="656">Reliance on Security through Obscurity</name>
		<location id="0" path="dovecot-2.0.beta6/src/ssl-params/main.c" line="116"/>
		<grade severity="5"/>
		<output>
			<textoutput><![CDATA[The binary contains embedded data that has a high level of entropy. 0 blocks of high entropy data were discovered in the code section of the binary and 1 blocks in the data section. This indicates the use of either compression or encryption. Encryption of data is typically used for obfuscation purposes and to hide functionality or static data within the binary.  Ensure that the high entropy blocks within the binary are tied to data or code that is expected to be embedded into the application. Do not rely on embedded encryption to secure sensitive data.  References:  CWE (http://www.mitre.org/data/definitions/656.html)  
]]></textoutput>
		</output>
	</weakness>
	<weakness id="54" tool_specific_id="153" uid="53366" selected="no">
		<name cweid="656">Reliance on Security through Obscurity</name>
		<location id="0" path="dovecot-2.0.beta6/src/director/main.c" line="164"/>
		<grade severity="5"/>
		<output>
			<textoutput><![CDATA[The binary contains embedded data that has a high level of entropy. 0 blocks of high entropy data were discovered in the code section of the binary and 1 blocks in the data section. This indicates the use of either compression or encryption. Encryption of data is typically used for obfuscation purposes and to hide functionality or static data within the binary.  Ensure that the high entropy blocks within the binary are tied to data or code that is expected to be embedded into the application. Do not rely on embedded encryption to secure sensitive data.  References:  CWE (http://www.mitre.org/data/definitions/656.html)  
]]></textoutput>
		</output>
	</weakness>
	<weakness id="55" tool_specific_id="462" uid="53367" selected="no">
		<name cweid="656">Reliance on Security through Obscurity</name>
		<location id="0" path="dovecot-2.0.beta6/src/pop3/main.c" line="186"/>
		<grade severity="5"/>
		<output>
			<textoutput><![CDATA[The binary contains embedded data that has a high level of entropy. 0 blocks of high entropy data were discovered in the code section of the binary and 1 blocks in the data section. This indicates the use of either compression or encryption. Encryption of data is typically used for obfuscation purposes and to hide functionality or static data within the binary.  Ensure that the high entropy blocks within the binary are tied to data or code that is expected to be embedded into the application. Do not rely on embedded encryption to secure sensitive data.  References:  CWE (http://www.mitre.org/data/definitions/656.html)  
]]></textoutput>
		</output>
	</weakness>
	<weakness id="56" tool_specific_id="657" uid="53368" selected="no">
		<name cweid="656">Reliance on Security through Obscurity</name>
		<location id="0" path="dovecot-2.0.beta6/src/lda/main.c" line="240"/>
		<grade severity="5"/>
		<output>
			<textoutput><![CDATA[The binary contains embedded data that has a high level of entropy. 0 blocks of high entropy data were discovered in the code section of the binary and 1 blocks in the data section. This indicates the use of either compression or encryption. Encryption of data is typically used for obfuscation purposes and to hide functionality or static data within the binary.  Ensure that the high entropy blocks within the binary are tied to data or code that is expected to be embedded into the application. Do not rely on embedded encryption to secure sensitive data.  References:  CWE (http://www.mitre.org/data/definitions/656.html)  
]]></textoutput>
		</output>
	</weakness>
	<weakness id="57" tool_specific_id="236" uid="53369" selected="no">
		<name cweid="656">Reliance on Security through Obscurity</name>
		<location id="0" path="dovecot-2.0.beta6/src/auth/main.c" line="262"/>
		<grade severity="5"/>
		<output>
			<textoutput><![CDATA[The binary contains embedded data that has a high level of entropy. 0 blocks of high entropy data were discovered in the code section of the binary and 1 blocks in the data section. This indicates the use of either compression or encryption. Encryption of data is typically used for obfuscation purposes and to hide functionality or static data within the binary.  Ensure that the high entropy blocks within the binary are tied to data or code that is expected to be embedded into the application. Do not rely on embedded encryption to secure sensitive data.  References:  CWE (http://www.mitre.org/data/definitions/656.html)  
]]></textoutput>
		</output>
	</weakness>
	<weakness id="58" tool_specific_id="599" uid="53370" selected="no">
		<name cweid="656">Reliance on Security through Obscurity</name>
		<location id="0" path="dovecot-2.0.beta6/src/imap/main.c" line="290"/>
		<grade severity="5"/>
		<output>
			<textoutput><![CDATA[The binary contains embedded data that has a high level of entropy. 0 blocks of high entropy data were discovered in the code section of the binary and 1 blocks in the data section. This indicates the use of either compression or encryption. Encryption of data is typically used for obfuscation purposes and to hide functionality or static data within the binary.  Ensure that the high entropy blocks within the binary are tied to data or code that is expected to be embedded into the application. Do not rely on embedded encryption to secure sensitive data.  References:  CWE (http://www.mitre.org/data/definitions/656.html)  
]]></textoutput>
		</output>
	</weakness>
	<weakness id="59" tool_specific_id="414" uid="53371" selected="no">
		<name cweid="656">Reliance on Security through Obscurity</name>
		<location id="0" path="dovecot-2.0.beta6/src/master/main.c" line="597"/>
		<grade severity="5"/>
		<output>
			<textoutput><![CDATA[The binary contains embedded data that has a high level of entropy. 0 blocks of high entropy data were discovered in the code section of the binary and 1 blocks in the data section. This indicates the use of either compression or encryption. Encryption of data is typically used for obfuscation purposes and to hide functionality or static data within the binary.  Ensure that the high entropy blocks within the binary are tied to data or code that is expected to be embedded into the application. Do not rely on embedded encryption to secure sensitive data.  References:  CWE (http://www.mitre.org/data/definitions/656.html)  
]]></textoutput>
		</output>
	</weakness>
	<weakness id="60" tool_specific_id="200" uid="53372" selected="no">
		<name cweid="656">Reliance on Security through Obscurity</name>
		<location id="0" path="dovecot-2.0.beta6/src/util/rawlog.c" line="362"/>
		<grade severity="5"/>
		<output>
			<textoutput><![CDATA[The binary contains embedded data that has a high level of entropy. 0 blocks of high entropy data were discovered in the code section of the binary and 1 blocks in the data section. This indicates the use of either compression or encryption. Encryption of data is typically used for obfuscation purposes and to hide functionality or static data within the binary.  Ensure that the high entropy blocks within the binary are tied to data or code that is expected to be embedded into the application. Do not rely on embedded encryption to secure sensitive data.  References:  CWE (http://www.mitre.org/data/definitions/656.html)  
]]></textoutput>
		</output>
	</weakness>
	<weakness id="61" tool_specific_id="536" uid="53373" selected="no">
		<name cweid="656">Reliance on Security through Obscurity</name>
		<location id="0" path="dovecot-2.0.beta6/src/util/script-login.c" line="181"/>
		<grade severity="5"/>
		<output>
			<textoutput><![CDATA[The binary contains embedded data that has a high level of entropy. 0 blocks of high entropy data were discovered in the code section of the binary and 1 blocks in the data section. This indicates the use of either compression or encryption. Encryption of data is typically used for obfuscation purposes and to hide functionality or static data within the binary.  Ensure that the high entropy blocks within the binary are tied to data or code that is expected to be embedded into the application. Do not rely on embedded encryption to secure sensitive data.  References:  CWE (http://www.mitre.org/data/definitions/656.html)  
]]></textoutput>
		</output>
	</weakness>
	<weakness id="62" tool_specific_id="284" uid="53374" selected="no">
		<name cweid="656">Reliance on Security through Obscurity</name>
		<location id="0" path="dovecot-2.0.beta6/src/util/script.c" line="94"/>
		<grade severity="5"/>
		<output>
			<textoutput><![CDATA[The binary contains embedded data that has a high level of entropy. 0 blocks of high entropy data were discovered in the code section of the binary and 1 blocks in the data section. This indicates the use of either compression or encryption. Encryption of data is typically used for obfuscation purposes and to hide functionality or static data within the binary.  Ensure that the high entropy blocks within the binary are tied to data or code that is expected to be embedded into the application. Do not rely on embedded encryption to secure sensitive data.  References:  CWE (http://www.mitre.org/data/definitions/656.html)  
]]></textoutput>
		</output>
	</weakness>
</report>