Oracle Releases Another Emergency Java Patch

Datamation content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.

For the fifth time this year and the third time in less than a month, Oracle has released an emergency security patch for Java. This update addresses the so-called “McRat” vulnerability.

CNET’s Dana Kerr reported, “In response to discovering that hackers were actively exploiting two vulnerabilities in Java running in Web browsers, Oracle has released an emergency patch that it says should deal with the problem. ‘These vulnerabilities may be remotely exploitable without authentication, i.e., they may be exploited over a network without the need for a username and password,’ Oracle wrote in a security alert today. ‘For an exploit to be successful, an unsuspecting user running an affected release in a browser must visit a malicious web page that leverages these vulnerabilities. Successful exploits can impact the availability, integrity, and confidentiality of the user’s system.'”

Sean Michael Kerner with eSecurity Planet noted, “It’s only March, but 2013 has not been a good year so far for Oracle Java security. On the negative side, Java has been repeatedly shamed and blamed for being at the root cause of big name exploits. On the positive side, Oracle is continuing to swim upstream issuing fixes as rapidly as it can. Late Monday, Oracle’s upstream swim continued with its fifth major update to Java this year for security fixes. Java 7 Update 15 provides two fixes for vulnerabilities being exploited in the wild today. Both vulnerabilities are remotely exploitable without user authentication, and both carry the highest possible CVSS (Common Vulnerabilities Scoring System) rating of 10.”

Ars Technica’s Nathan Mattise explained, “This particular vulnerability is being exploited to install a remote-access trojan dubbed McRat. The attacks targeted Java versions 1.6 Update 41 and 1.7 Update 15, which are the latest available releases of the widely used software.”

Brian Krebs with KrebsonSecurity observed, “What makes Java vulnerabilities so dangerous is that Java is a cross-platform product, meaning exploits against vulnerabilities in Java can be used to deliver malicious payloads to Mac and Linux systems just the same as they can Windows PCs. The previous Java update released on Feb. 19 came amid revelations by Apple, Facebook and Twitter that employees at these organizations and dozens of others were hacked using exploits that attacked Java vulnerabilities on Mac and Windows machines.”