Server Bugs

• Use concise, precise descriptions
• Do not include sensitive information.
• Create a support ticket at https://support.secondlife.com for individual account issues or sensitive information.
Any avatar can freeze another resident's moving vehicle by selecting it in edit mode (regression of SVC-34)
Selecting a physical vehicle that another resident is driving — by entering edit mode (Ctrl-3) and clicking it, or by right-clicking it so the context menu opens — stops the vehicle dead for as long as the selection is held. The selecting avatar needs no permissions on the object: not owner, not group, no modify rights. On deselect the vehicle resumes from zero velocity. This is being used (accidentally and otherwise) to disrupt organized racing: a spectator right-clicking a passing car to inspect it halts that car mid-lap. The same behavior was reported as SVC-34 ("Right-clicking another Resident's moving object freezes it") and listed as fixed in server release 11.09.23.241511, alongside "Anybody can freeze an unscripted physical object." The edit-mode selection path still reproduces in 2026. Linden Lab's own QA test script acknowledges it — Object Selection Test, "Select other's vehicles": "verify you can select other's vehicles and their vehicle stops. Unfortunate." (page last edited October 2013). No script-side mitigation exists: STATUS_BLOCK_GRAB does not affect selection (and the same test page notes it doesn't work anyway), the Locked checkbox only restricts the owner, and disabling Build on the parcel does not block selection. ## Steps to reproduce Avatar A rezzes any physical scripted vehicle (a Linden Vehicle Tutorial car is sufficient), sits, and drives it in a straight line at steady speed. Avatar B, who does not own the vehicle and has no modify rights, presses Ctrl-3 to enter edit mode and clicks the moving vehicle. Observe: the vehicle stops immediately and stays stopped while B holds the selection. B presses Esc to deselect. Observe: the vehicle resumes from zero and re-accelerates. Repeat with B right-clicking the vehicle instead of using Ctrl-3. Observe the same stop while the context menu is open. ## Expected behavior Selecting an object you cannot modify should not alter its simulation. Physics should only be suspended for a selection by an agent who has modify rights on the object (owner, or group with appropriate permissions), and ideally only when that agent begins an edit operation. ## Actual behavior Physics is suspended for any selection, regardless of the selecting agent's permissions on the object. ## Environment Region: [fill in region name and server version from Help > About] Viewer: [fill in viewer and version — reproduces with Second Life Viewer and Firestorm] Date observed: [fill in] ## References Object Selection Test (SL Wiki, LL QA test script): https://wiki.secondlife.com/wiki/Object_Selection_Test Server release notes 11.09.23.241511 listing SVC-34 as fixed: https://wiki.secondlife.com/wiki/Release_Notes/Second_Life_Server/11
2
·
needs info
URGENT SECURITY VULNERABILITY – UNAUTHORIZED EJECTS AND FALSE OBJECT ATTRIBUTION
URGENT SECURITY VULNERABILITY – UNAUTHORIZED EJECTS AND FALSE OBJECT ATTRIBUTION I am reporting what appears to be a serious security vulnerability in Second Life involving unauthorized parcel ejects. Residents are being forcibly ejected from parcels by users who do not appear to have the required land ownership, estate, or administrative permissions. This is not limited to a single incident or a single parcel. Multiple residents and lands appear to be affected. A particularly concerning aspect is that the system appears to attribute the action to an innocent object. When an eject occurs, the victim or nearby residents may see a local chat message such as: “The object 'Void - Demure Lashes (Avalon)' at Dearheart (196,46,2338) cannot teleport the parcel owner home.” The referenced object is a cosmetic attachment with no eject or teleport function. There is nothing in the object intended to eject, teleport, or remove users from the parcel. Nevertheless, the system displays the object as if it were involved in the action. This creates the appearance that a legitimate object caused the eject, while the actual source of the action appears to be something else. In one ongoing case, a resident has reportedly been ejected repeatedly, potentially dozens of times per day, across different locations. Entire groups of visitors on a parcel have also been forcibly ejected without authorization. We have already submitted multiple Abuse Reports and contacted Live Support, but the underlying issue remains unresolved. We urgently request that Linden Lab investigate this as a potential Second Life security vulnerability or exploit, rather than treating each incident as an individual land-management issue. Please review the server-side logs associated with the affected parcels and accounts, including: • The exact timestamps of the eject events • The account or system component actually triggering the eject • The permissions involved • The source of the eject request • Why an unrelated object is being displayed as responsible • Whether the same mechanism is being used across multiple regions and parcels If possible, please reproduce the behavior in a controlled environment and investigate how a resident without the appropriate permissions can cause another resident to be removed from a parcel. This issue is creating serious harassment and security concerns for residents and landowners. We need the technical/security team to identify the underlying cause, fix the vulnerability, and prevent unauthorized users from abusing this functionality. This report concerns a suspected platform-level security vulnerability, not a normal parcel eject performed by an authorized land manager.
19
·
tracked
Load More