CentOS - Feb 2008 - Remember the unknown rootkit problem previously reported?

If the attacker could get a shell, the attacker could have used this 
local root exploit to get the necessary privileges to install the rootkit.

One reason why there seem to be few RHEL reports is that RHEL5 is not 
that widely available yet but lots of vulnerable Fedora/Debian 
installations are available.