[antiRepublicrat]

Explain to me one buffer overlow you can exploit on a fully patched box?

This one in W2K3. It isn't remote (as you never specified it must be), but it is an unpatched buffer overflow error that can give system-level access.

[for-q-clinton]

Earlier in my post I mentioned physical security. If the machine isn't physically secure you have all the info you ever need. So that doesn't count.

Name one where the box is physically secure.