Go Back   Winamp & Shoutcast Forums > Winamp > Winamp Wishlist

Reply
Thread Tools Search this Thread Display Modes
Old 23rd September 2012, 03:30   #1
leo5151
Junior Member
 
Join Date: Sep 2012
Posts: 4
skins/language packs installation on Windows 7 without triggering UAC

Hi to all. I am Leo from Brazil. Winamp is a great media player and got a lot better in the last year, but currently (on the latest version) misses something simple:

skin/language packs installation for restricted users.

I did some search and found out Winamp installs, for example, skins in

%programfiles%\winamp\skins

The original skin (.wal or .wsz) file you try to install gets copied to this directory, but the permissions does not allow restricted or admin users to create files or folders there, so there is an application called "Elevator.exe" that triggers UAC every time you try to install a skin, so that "Elevator.exe" is executed as administrator (With elevated privileges, even for Admin users) and thus able to create files on the directory I mentioned above.

What I would suggest is something much more simple:

a) upon installing Winamp, assign the "Users" group "Control/modify" access instead of only "read/execute" to the "skins" and "lang" directories. This would give both restricted users and admins write access to those directories without the need of "Elevator.exe" application or triggering UAC every time you wish to install a new skin of language pack.

or... instead of copying skin and language pack files to the "%programfiles%\winamp" subdirectories, copy them to eg.

%appdata%\winamp

since the currently logged on user have write access to them. The only side effect is that the other users would not use Winamp with the changed skin/language pack

Also, if there is a vulnerability in the "Elevator.exe" program it will be exploited with Administrator privileges, giving malicious people full access to the system, since users (theoretically) trusts Winamp applications.

Below is a simple script to change directory permissions that could be easily added and executed upon Winamp installation :

--------restricted/admin-users-skins-langpacks-install-winVista-7-8-without-triggering-UAC or run stuff with elevated privileges.CMD------------------

CD %programfiles%\winamp
icacls skins /grant *S-1-5-32-545:M
icacls lang /grant *S-1-5-32-545:M
REM alternatively lets restricted users install plugins...Just remove the 'REM' :
REM icacls plugins /grant *S-1-5-32-545:M

--------------------------------------------------------------------------------

S-1-5-32-545 is the SID (security identifier) for the "Users" (restricted users) group. This is needed even for Admin users because on Windows Vista, 7 and above the Admins by default have the same rights as "restricted users" for security reasons.

I have also provided the code to change the permissions for the "plugins" folder but with a comment before (REM)


My suggestion could be very good because:

1) UAC is not triggered every time a user, being him/she "restricted user" or Admin, wanna install a new skin or language pack. This, sorry to say, really sucks.

2) restricted users who doesnt have access to an Admin account are able to install skins and language packs without having to ask admins to login and install. If an admin doesnt like it, he/she can simply change the language or skin, via Winamp menu, or deleting the respective file in Winamp\skin or lang directory.

3) Avoid local/remote privilege escalation vulnerabilities because "Elevator" application would not be needed anymore and thus not executed with "elevated Admin" privileges.

And..apart from that the player continues very cool. Congrats
leo5151 is offline   Reply With Quote
Old 23rd September 2012, 20:49   #2
DrO
 
Join Date: Sep 2003
Posts: 27,873
you can already tell Winamp to use a different folder for the skins and language packs - has been a preference option in Winamp for years.

-daz
DrO is offline   Reply With Quote
Old 24th September 2012, 08:32   #3
leo5151
Junior Member
 
Join Date: Sep 2012
Posts: 4
surely you can, but that very simple script saves users from manually changing settings every time they install the player. Windows have changed, and so should Winamp (in this aspect I mean) I have seen other software installing skins on a software subfolder which it assigns write/modify access to restricted users upon installation. Much better this way. Not to mention it eliminates a security risk dealing with "Elevator.exe". That´s why I took my time to write a big message. Let´s see what the developer team and also the community thinks. Awaiting their reply. Thanks for your time

ps: by the way I was thinking... what about moving/copying this thread to "Winamp Discussion" forum?

thks

Last edited by leo5151; 24th September 2012 at 08:46. Reason: added stuff
leo5151 is offline   Reply With Quote
Old 24th September 2012, 11:07   #4
DrO
 
Join Date: Sep 2003
Posts: 27,873
Winamp will not be changed to override permissions on folders and overriding things to prevent a UAC prompt in that manner is not eliminating a security risk - everything in the Program Files folder is write-restricted on purpose, if you don't like that then disable UAC or do you hacks but _do_not_ suggest that as something anyone and everyone should do, that is irresponsible.

the only thing that would be done (as was talked about some time back with other members of the dev team) is altering the default folders for where the skins and language packs are installed to but alas nothing has been done towards that yet.

-daz
DrO is offline   Reply With Quote
Old 24th September 2012, 13:31   #5
leo5151
Junior Member
 
Join Date: Sep 2012
Posts: 4
with all due respect If you had read the post attentiously you would have noticed I talked about changing the default permission *only* for the skins and language pack folders not for the Winamp folder or program files, that would be terrible for sure and you possibly easily become NT AUTHORITY\SYSTEM without effort. Some programs prefer their stuff in subdirectories of their own, so to avoid UAC prompts everytime the user/admin (on Win Vista and above) wishes to write to that folder, it doesnt need to either elevate privileges, reply to prompts, etc. This is an exception permission, it will never apply to 'Winamp', 'program files' or any subfolder of the program files. But putting an elevation program that parses a file that comes from the internet (I *do know* winamp displays a prompt when you install skins, but *usually* it is not unsafe to install something that changes the language of the application or its visual, so most people will just accept the prompt without thinking twice, at least Windows users) can *indeed* be dangerous because the "Elevator" application *could* have vulnerabilities. Thinking this way my suggestion would be more responsible than running "Elevator.exe" every time for a file that can be auto-downloaded on IE and Google Chrome.

Now back to the UAC issue, yes it is annoying when not needed, like in this case.
Upon eg. installing a program it is indeed necessary and its meant for security purposes not annoying. the "Control/Modify" access on a folder like 'lang' or 'skins' is not a problem because you can only create files and folders there, not in 'Winamp' folder or much less in program files or any of its subdirs.

Changing UAC settings would also pose a serious security problem and would surely be iresponsible if I did so, so I just ran that script I provided and everything is fine.

My original suggestion was for people not having to mess with UAC or default skin locations since I have seen some topics regarding people complaining they couldnt install skins on Vista/7. If the dev team understand my suggestion/solution they will surely consider it.

Changing the skin/lang/plugin directories to %appdata%\winamp would be even better, but again, on a multi user computer only the user who installed the skin/plugin/language pack would be able to see.

Thanks

Last edited by leo5151; 24th September 2012 at 13:36. Reason: added stuff
leo5151 is offline   Reply With Quote
Old 24th September 2012, 13:52   #6
DrO
 
Join Date: Sep 2003
Posts: 27,873
and as someone on the dev team (though focused on SHOUTcast currently), i am telling you that changing folder permissions (irrespective of it only being on those two folders) is not going to happen.

changing the default folder is the only thing that would be done but it has not been but as i clearly said, it is not hard for a user to change it if needed. and there is the ProgramData folder which is suitable for putting in shared skins / language packs for users (from what i remember of the discussions which were made about this at the time).
DrO is offline   Reply With Quote
Old 25th September 2012, 00:22   #7
leo5151
Junior Member
 
Join Date: Sep 2012
Posts: 4
ok bud, I just suggested 2 things to make all our lives easier. but I am glad you understood I wasnt suggestnig something to put the user at risk.
leo5151 is offline   Reply With Quote
Reply
Go Back   Winamp & Shoutcast Forums > Winamp > Winamp Wishlist

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump