IBM Db2 9.5
IBM Db2 9.5
The IBM Db2 9.5 reached end of service life on Apr 30, 2015 — IBM no longer ships security patches or fixes for it. Our third-party support keeps it safe to run: 24/7 engineers manage issues, remediate vulnerabilities, and help you maintain compliance.
24/7 engineers own your IBM Db2 9.5 incidents end to end.
Mitigation and patch-around guidance when the vendor no longer ships fixes.
Controls evidence and documentation that keep auditors satisfied.
Specifications
- product
- ibm-db2
- release
- 9.5
- product Label
- IBM Db2
- release Label
- 9.5
- codename
- lts
- latest Version
- release Date
- 2007-12-14
- maintained
- source Url
- https://endoflife.date/ibm-db2
Lifecycle Dates
- End of Service Life
- Apr 30, 2015
- Last OEM Support
- Apr 30, 2015
OEM vs. 3rd Party Support
See how third-party support compares to the vendor contract for IBM Db2 9.5 — monitoring, break/fix, vulnerability work, operations and compliance, before and after EOSL.
| Feature | OEM Support | 3rd Party Support |
|---|---|---|
| Post-EOSL Support | ||
| Break/Fix Support | Until EOSL | |
| 24/7 Monitoring | ||
| Vulnerability Scanning & Remediation | ||
| Managed Operations | ||
| Procedure & Configuration Review | ||
| Compliance & Audit Documentation | Limited | |
| Discounted Migration to Other Platforms |
Why Choose 3rd Party Support for IBM Db2 9.5?
Vulnerability Remediation
Scanning, mitigation and patch-around guidance for IBM Db2 9.5 when the vendor no longer ships fixes.
Compliance Maintenance
Procedure review, controls evidence and the documentation auditors ask for — maintained continuously, not scrambled at audit time.
24/7 Expert Support
Engineers who know this release monitor, manage and fix issues around the clock — break/fix to managed operations.
IBM Db2 9.5 Support: Frequently Asked Questions
Is the IBM Db2 9.5 still supported?
IBM ended support for the IBM Db2 9.5 on Apr 30, 2015 — no more patches or fixes from the vendor. Third-party support keeps it covered: our engineers manage issues, remediate vulnerabilities, and help you maintain compliance for as long as you run it.
When is the IBM Db2 9.5 end of service life (EOSL) date?
IBM lists the end of service life for the IBM Db2 9.5 as Apr 30, 2015.
Can I keep using the IBM Db2 9.5 after its EOSL date?
Yes. EOSL means IBM stops issuing patches and support — the software itself keeps running. Third-party support covers it from there: issue management, security vulnerability remediation, and the compliance documentation auditors ask for, for as long as you choose to run it.
How much does third-party support for the IBM Db2 9.5 cost?
Typically 40-70% below the OEM maintenance renewal price. Exact pricing depends on quantity, service level and location — request a quote and we respond within 24 hours.
Known Vulnerabilities Affecting IBM Db2 9.5
69 published CVEs affect the IBM Db2 9.5, including 25 rated critical or high severity. IBM no longer ships security patches for this release — our engineers provide mitigation guidance, workarounds and hardening support.
| CVE | Severity | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2012-1797 | HIGH | 10.0 | Mar 20, 2012 | IBM DB2 9.5 uses world-writable permissions for nodes.reg, which has unspecified impact and attack vectors. |
| CVE-2010-3731 | HIGH | 10.0 | Oct 5, 2010 | Stack-based buffer overflow in the validateUser implementation in the com.ibm.db2.das.core.DasSysCmd function in db2dasrrm in the DB2 Administration Server (DAS) component in IBM DB2 9.1 before FP10, 9.5 before FP6a, and 9.7 before FP3 allows remote attackers to execute arbitrary code via a long username string. |
| CVE-2010-3193 | HIGH | 10.0 | Aug 31, 2010 | Unspecified vulnerability in the DB2STST program in IBM DB2 9.1 before FP9, 9.5 before FP6, and 9.7 before FP2 has unknown impact and attack vectors. |
| CVE-2009-4335 | HIGH | 10.0 | Dec 16, 2009 | Multiple unspecified vulnerabilities in bundled stored procedures in the Spatial Extender component in IBM DB2 9.5 before FP5 have unknown impact and remote attack vectors, related to "remote exploits." |
| CVE-2008-6821 | HIGH | 10.0 | Jun 3, 2009 | Buffer overflow in the DAS server in IBM DB2 8 before FP17, 9.1 before FP5, and 9.5 before FP2 might allow attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors, a different vulnerability than CVE-2007-3676 and CVE-2008-3853. |
| CVE-2008-6820 | HIGH | 10.0 | Jun 3, 2009 | The db2fmp process in IBM DB2 8 before FP17, 9.1 before FP5, and 9.5 before FP2 on Windows runs with "OS privilege," which has unknown impact and attack vectors, a different vulnerability than CVE-2008-3856. |
| CVE-2008-4692 | HIGH | 10.0 | Oct 22, 2008 | The Native Managed Provider for .NET component in IBM DB2 8 before FP17, 9.1 before FP6, and 9.5 before FP2, when a definer cannot maintain objects, preserves views and triggers without marking them inoperative or dropping them, which has unknown impact and attack vectors. |
| CVE-2012-3324 | HIGH | 9.0 | Sep 25, 2012 | Directory traversal vulnerability in the UTL_FILE module in IBM DB2 and DB2 Connect 10.1 before FP1 on Windows allows remote authenticated users to modify, delete, or read arbitrary files via a pathname in the file field. |
| CVE-2008-1997 | HIGH | 9.0 | Apr 28, 2008 | Unspecified vulnerability in the ADMIN_SP_C2 procedure in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 allows remote authenticated users to execute arbitrary code via unknown vectors. NOTE: the ADMIN_SP_C issue is already covered by CVE-2008-0699. |
| CVE-2008-0699 | HIGH | 9.0 | Feb 12, 2008 | Unspecified vulnerability in the ADMIN_SP_C procedure (SYSPROC.ADMIN_SP_C) in IBM DB2 UDB before 8.2 Fixpak 16, 9.1 before FP4a, and 9.5 before FP1 allows remote authenticated users to execute arbitrary code via unspecified attack vectors. |
| CVE-2013-6744 | HIGH | 8.5 | May 30, 2014 | The Stored Procedure infrastructure in IBM DB2 9.5, 9.7 before FP9a, 10.1 before FP3a, and 10.5 before FP3a on Windows allows remote authenticated users to gain privileges by leveraging the CONNECT privilege and the CREATE_EXTERNAL_ROUTINE authority. |
| CVE-2012-4826 | HIGH | 8.5 | Oct 20, 2012 | Stack-based buffer overflow in the SQL/PSM (aka SQL Persistent Stored Module) Stored Procedure (SP) infrastructure in IBM DB2 9.1, 9.5, 9.7 before FP7, 9.8, and 10.1 might allow remote authenticated users to execute arbitrary code by debugging a stored procedure. |
| CVE-2008-1998 | HIGH | 8.5 | Apr 28, 2008 | The NNSTAT (aka SYSPROC.NNSTAT) procedure in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 on Windows allows remote authenticated users to overwrite arbitrary files via the log file parameter. |
| CVE-2012-0711 | HIGH | 7.5 | Mar 20, 2012 | Integer signedness error in the db2dasrrm process in the DB2 Administration Server (DAS) in IBM DB2 9.1 through FP11, 9.5 before FP9, and 9.7 through FP5 on UNIX platforms allows remote attackers to execute arbitrary code via a crafted request that triggers a heap-based buffer overflow. |
| CVE-2011-0731 | HIGH | 7.5 | Feb 1, 2011 | Buffer overflow in the DB2 Administration Server (DAS) component in IBM DB2 9.1 before FP10, 9.5 before FP7, and 9.7 before FP3 on Linux, UNIX, and Windows allows remote attackers to execute arbitrary code via unspecified vectors. |
| CVE-2010-3194 | HIGH | 7.5 | Aug 31, 2010 | The DB2DART program in IBM DB2 9.1 before FP9, 9.5 before FP6, and 9.7 before FP2 allows attackers to bypass intended file access restrictions via unspecified vectors related to overwriting files owned by an instance owner. |
| CVE-2009-4333 | HIGH | 7.5 | Dec 16, 2009 | The Relational Data Services component in IBM DB2 9.5 before FP5 allows attackers to obtain the password argument from the SET ENCRYPTION PASSWORD statement via vectors involving the GET SNAPSHOT FOR DYNAMIC SQL command. |
| CVE-2009-3471 | HIGH | 7.5 | Sep 29, 2009 | IBM DB2 8 before FP18, 9.1 before FP8, 9.5 before FP4, and 9.7 before FP2 does not perform the expected drops of certain table functions upon a loss of privileges by the functions' definers, which has unspecified impact and remote attack vectors. |
| CVE-2014-0907 | HIGH | 7.2 | May 30, 2014 | Multiple untrusted search path vulnerabilities in unspecified (1) setuid and (2) setgid programs in IBM DB2 9.5, 9.7 before FP9a, 9.8, 10.1 before FP3a, and 10.5 before FP3a on Linux and UNIX allow local users to gain root privileges via a Trojan horse library. |
| CVE-2013-3475 | HIGH | 7.2 | Jun 5, 2013 | Stack-based buffer overflow in db2aud in the Audit Facility in IBM DB2 and DB2 Connect 9.1, 9.5, 9.7, 9.8, and 10.1, as used in Smart Analytics System 7600 and other products, allows local users to gain privileges via unspecified vectors. |
Showing the 20 most severe of 69 known CVEs.
Get Third Party Support