As we said earlier, we have just finished the new Gigas Item Server, Version 2.2.8 patch which addresses certain potential vunerabilities opened by the recent LSL script exploit.
We advise anyone using a Gigas server with a version number less than or equal to 2.2.7 to update your servers to 2.2.8, as soon as you can. The 2.2.8 package also includes a new vendor script, which will also need to be applied.
What this patch does:
- We've placed an new level of authentication on transfers. We've also made it easier to catch people who attempt to exploit a server object.
- We have also changed the RemoteLoadScript pin to prevent a possible intrusion exploit.
- We have also patched the webshop to be compatible with this new authentication (however unpatched servers will still work)
When a request is made through the older version of the protocol without authentication, the seller will recieve a message like follows:
"Adam Zaius attempted to purchase SecondServer Shirt from an older version vendor located in Aleph. Please confirm the user paid you, and then transfer the inventory."
The buyer will recieve a message like this:
"Thankyou for your purchase. Unfortunately, purchases from this vendor need to be manually processed by the seller. Please wait while the seller transfers the items to you. If you do not recieve a copy of your item soon, please IM the seller."
Servers and Vendors which are both on version 2.2.8 or higher will not trigger this message. This message will only be triggered by a 2.2.7 (or below) vendor trying to buy from a 2.2.8 server. This message is only triggered when 2.2.8 authentication is not present, or is not valid.
The following are links to the update server kits, and the system updater. If you currently have your server and vendor objects currently deployed, we recommend using the update kit, so you do not need to perform any configuration changes.
2.2.8 Updater Kit (For people with a server out currently) 2.2.8 Vendor Kit (For people who have deleted their server, or want to setup additional vendors.)Myself and Nexus are also putting the finishing touches on our new Version3.0, we will be opening it up for public beta testing (which will be availible without cost for the duration of the beta test) shortly. I'll keep people posted as we get the final steps inplace. We will release a full list of new features with the beta release announcement.
-Adam
