Java 'McRAT' flaw patched

Oracle has shipped another update to its widely deployed Java software to close two vulnerabilities, one of which is being used by attackers in active exploits.

The update for Java SE 5, 6 and 7 running in web browsers addresses a pair of flaws – CVE-2013-0809 and CVE-2013-1493.

The latter bug is being actively leveraged in attacks to spread the McRAT executable, researchers from network security company FireEye revealed Thursday.

Oracle learned of this vulnerability on 1 February but could not issue a patch for its update tw weeks later.

The flaws were patched in an out-of-band update Monday, Oracle software security assurance director Eric Maurice said.

Both vulnerabilities were assigned a grade 10 in the Common Vulnerability Scoring System, the highest mark.

Maurice added that Oracle recently changed Java's security settings to "high" by default, meaning users are now prompted whether to install an applet that is unsigned or self-signed.

This article originally appeared at scmagazineus.com