[CentOS-mirror] Halted Web Server Compromise

[Shawn M. Jones]

I discovered this morning that SELinux had stopped a user from executing 
commands through my apache web server.  He was using a vulnerability in 
php-pear to get in, which I had patched a few months ago.  
Unfortunately, I had foolishly not restarted the apache service after 
the patch, so he started adding interesting scripts to my temp directories.

I'm going to perform a partial rebuild of the server.  By what I can 
tell, he was not able to leave his SELinux jail and execute any 
programs.  I've used rpm to validate the MD5 checksums of all package 
files and verified that the only ones that came back were ones that I 
had modified.

As he was restricted to executing everything as the apache user with a 
security context of root:system_r:httpd_sys_script_t, he was not able to 
start any of the back doors or IRC bots that he had placed on the 
system, but I am concerned about the content accessible to 
httpd_sys_script_t, so I'm going to remove all web server related 
material and restore it from backups.

What I did not back up was the mirror of CentOS, which I need to rebuild 
as a precautionary measure.

I'm currently removing alias to the CentOS mirror on the server.  Please 
remove me from the CentOS mirrors page until I get the system rebuilt.

Sorry for the inconvenience.

Sincerely,

Shawn M. Jones
Admin of the LittleProjects.org site in VA, USA