recent security patch breaks desktop.ini CLSID folder-app association and custom icon  
Index ‹ Windows XP ‹ Windows XP
Author Message
artwalk
PostPosted: Fri Aug 25 22:14:05 CDT 2006 Top
Windows XP >> recent security patch breaks desktop.ini CLSID folder-app association and custom icon We (the software company I work for) have been using a desktop.ini file
to (1) create a unique icon for the "library folders" used with our
application and (2) to associate these folders with our application so
that double-clicking on the folder launches our application and lets
our application open the library.

The desktop.in just looks like this:

[.ShellClassInfo]
ConfirmFileOp=0
CLSID={our-class-id}

And then in the registry:

To assign an icon to the folder:

Key Name:
HKEY_CLASSES_ROOT\CLSID\{our-class-id}\DefaultIcon
Class Name: <NO CLASS>
Value 0
Name: <NO NAME>
Type: REG_SZ
Data: path to our icon

To associate the folder with our application:

Key Name:
HKEY_CLASSES_ROOT\CLSID\{our-class-id}\Shell\Open\command
Class Name: <NO CLASS>
Value 0
Name: <NO NAME>
Type: REG_SZ
Data: "path to our application" "%1"


Unfortunately, the most recent XP security patch has broken this.
According to <http://secunia.com/advisories/11633/>:

"The problem is that "desktop.ini" files may contain CLSID references
to arbitrary executables in the "[.ShellClassInfo]" section. This can
be exploited to execute arbitrary files with another user's privileges
when the user browses a folder containing a malicious "desktop.ini"
file."


Does anybody know if there might be another way to accomplish this? I
spent a lot of time making this work, and now it's broke!

Thanks

Windows XP460  
 
 
Kelly
PostPosted: Fri Aug 25 22:14:05 CDT 2006 Top
Windows XP >> recent security patch breaks desktop.ini CLSID folder-app association and custom icon Hmm, interesting!

--

All the Best,
Kelly (MS-MVP/DTS&XP)

Taskbar Repair Tool
http://www.kellys-korner-xp.com/taskbarplus!.htm


"asinning" <EMail@HideDomain.com> wrote in message
news:EMail@HideDomain.com...
> We (the software company I work for) have been using a desktop.ini file
> to (1) create a unique icon for the "library folders" used with our
> application and (2) to associate these folders with our application so
> that double-clicking on the folder launches our application and lets
> our application open the library.
>
> The desktop.in just looks like this:
>
> [.ShellClassInfo]
> ConfirmFileOp=0
> CLSID={our-class-id}
>
> And then in the registry:
>
> To assign an icon to the folder:
>
> Key Name:
> HKEY_CLASSES_ROOT\CLSID\{our-class-id}\DefaultIcon
> Class Name: <NO CLASS>
> Value 0
> Name: <NO NAME>
> Type: REG_SZ
> Data: path to our icon
>
> To associate the folder with our application:
>
> Key Name:
> HKEY_CLASSES_ROOT\CLSID\{our-class-id}\Shell\Open\command
> Class Name: <NO CLASS>
> Value 0
> Name: <NO NAME>
> Type: REG_SZ
> Data: "path to our application" "%1"
>
>
> Unfortunately, the most recent XP security patch has broken this.
> According to <http://secunia.com/advisories/11633/>:
>
> "The problem is that "desktop.ini" files may contain CLSID references
> to arbitrary executables in the "[.ShellClassInfo]" section. This can
> be exploited to execute arbitrary files with another user's privileges
> when the user browses a folder containing a malicious "desktop.ini"
> file."
>
>
> Does anybody know if there might be another way to accomplish this? I
> spent a lot of time making this work, and now it's broke!
>
> Thanks
>


 
 
Keith
PostPosted: Sat Oct 07 02:04:32 CDT 2006 Top
Windows XP >> recent security patch breaks desktop.ini CLSID folder-app association and custom icon I just ran RegMon during Boot and saw explorer looking for the following policy keys:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\AllowCLSIDPROGIDMapping

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\AllowFileCLSIDJunctions

Can't find any info googling, but the names look promising!!! :) -- You might try creating the
values as DWORDS and setting them to 1. See if that allows your app to work.


--
Good Luck,

Keith
Microsoft MVP [Windows XP Shell/User]


"asinning" <EMail@HideDomain.com> wrote in message
news:EMail@HideDomain.com...
> We (the software company I work for) have been using a desktop.ini file
> to (1) create a unique icon for the "library folders" used with our
> application and (2) to associate these folders with our application so
> that double-clicking on the folder launches our application and lets
> our application open the library.
>
> The desktop.in just looks like this:
>
> [.ShellClassInfo]
> ConfirmFileOp=0
> CLSID={our-class-id}
>
> And then in the registry:
>
> To assign an icon to the folder:
>
> Key Name:
> HKEY_CLASSES_ROOT\CLSID\{our-class-id}\DefaultIcon
> Class Name: <NO CLASS>
> Value 0
> Name: <NO NAME>
> Type: REG_SZ
> Data: path to our icon
>
> To associate the folder with our application:
>
> Key Name:
> HKEY_CLASSES_ROOT\CLSID\{our-class-id}\Shell\Open\command
> Class Name: <NO CLASS>
> Value 0
> Name: <NO NAME>
> Type: REG_SZ
> Data: "path to our application" "%1"
>
>
> Unfortunately, the most recent XP security patch has broken this.
> According to <http://secunia.com/advisories/11633/>:
>
> "The problem is that "desktop.ini" files may contain CLSID references
> to arbitrary executables in the "[.ShellClassInfo]" section. This can
> be exploited to execute arbitrary files with another user's privileges
> when the user browses a folder containing a malicious "desktop.ini"
> file."
>
>
> Does anybody know if there might be another way to accomplish this? I
> spent a lot of time making this work, and now it's broke!
>
> Thanks
>

 
 
 
Index ‹ Windows XP ‹ Windows XP