Commit 271333b6 by devttys0

Updated README.md to include extraction security notice.

parent dd4f2efd
......@@ -7,10 +7,17 @@
Binwalk is a fast, easy to use tool for analyzing, reverse engineering, and extracting firmware images.
### *** Extraction Security Notice ***
Prior to Binwalk v2.3.3, extracted archives could create symlinks which point anywhere on the file system, potentially resulting in a directory traversal attack if subsequent extraction utilties blindly follow these symlinks. More generically, Binwalk makes use of many third-party extraction utilties which may have unpatched security issues; Binwalk v2.3.3 and later allows external extraction tools to be run as an unprivileged user using the `run-as` command line option (this requires Binwalk itself to be run with root privileges). Additionally, Binwalk v2.3.3 and later will refuse to perform extraction as root unless `--run-as=root` is specified.
### *** Python 2.7 Deprecation Notice ***
Even though many major Linux distros are still shipping Python 2.7 as the default interpreter in their currently stable release, we are making the difficult decision to move binwalk support exclusively to Python 3. This is likely to make many upset and others rejoice. If you need to install binwalk into a Python 2.7 environment we will be creating a tag `python27` that will be a snapshot of `master` before all of these major changes are made. Thank you for being patient with us through this transition process.
### Installation and Usage
* [Installation](./INSTALL.md)
......
......@@ -12,7 +12,7 @@ except ImportError:
from distutils.dir_util import remove_tree
MODULE_NAME = "binwalk"
MODULE_VERSION = "2.3.2"
MODULE_VERSION = "2.3.3"
SCRIPT_NAME = MODULE_NAME
MODULE_DIRECTORY = os.path.dirname(os.path.realpath(__file__))
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment