JR40822: Entering special char into the LogonID field on the SignIn page result in different char upon an auth failure

7.0.0-WS-WCServer-FP009
WebSphere Commerce Version 7.0.0.6 Fix Pack
WebSphere Commerce Version 7.0.0.7 Fix Pack
WebSphere Commerce Version 7.0.0.8 Fix Pack
WebSphere Commerce Version 7.0.0.9 Fix Pack
JR46386 - Security APAR CVE-2013-0523: Possible security vulnerability could allow disclosure of user personal data

APAR status

• Closed as program error.

Error description

• When trying to Logon in Store with UserName containing special
  characters, on failure redirects to Logon form again but
  displaying the Username with special characters incorrectly -
  Example shaik51ﾇ is displayed as shaik51A￵ because there is the
  problem with encode/decode the UTF-8 characters during Redirect.
  
  
  If the logonId is removed from encrypting (by adding the logonId
  in wc-server.xml) then the characters are displayed correctly.
  

Local fix

Problem summary

• USERS AFFECTED:
  WebSphere Commerce users who have special charachters in
  UserName
  
  PROBLEM ABSTRACT:
  Entering special charachters in Logon form results in odd
  characters being returned if logon fails
  
  BUSINESS IMPACT:
  Users are not able to use Login UserNames with special
  Characters like French, Cyrilic, etc.
  
  RECOMMENDATION:
  

Problem conclusion

• The krypto string used in SSL mode now accounts for encoding.
  This allows special characters to be properly encrypted and
  decrypted according to the corresponding encoding used in the
  current browser session.
  
  -------------------------------------------------------------
  The latest available maintenance information can be obtained
  from the Recommended Fixes for WebSphere Commerce technote:
  http://www.ibm.com/support/docview.wss?rs=3046&uid=swg21261296
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WC BUS EDITION

• Fixed component ID

  5724I3800

Applicable component levels

• R600 PSY

     UP

• R700 PSY

     UP