Buffer Overflows and Remote Root Exploits

[crispin () CSE OGI EDU (Crispin Cowan)]

I'm writing a paper on categorizing buffer overflow attacks and
defenses.  I conjecture (from my experience) that buffer overflow
attacks constitute a *huge* majority of all remote root exploits (the
other major category being weak escapes in CGI scripts).  Two questions:

   * Does the community agree with these conjectures?
   * Can anyone cite a paper or statistic to back up these claims?

Thanks,
    Crispin
-----
 Crispin Cowan, Research Assistant Professor of Computer Science, OGI
    NEW:  Protect Your Linux Host with StackGuard'd Programs  :FREE
       http://www.cse.ogi.edu/DISC/projects/immunix/StackGuard/