buffer overflow exploits can happen just as easily in
Linux
or any other OS.
The practical difference is that Linux users tend to patch theoretical
exploits, where as Windows users usually only get round to security
updates once real damage is being done, and not even then sometimes.
I've known plenty of organisations that have suffered real damage from
Windows exploits, either lost data or significant downtime.
But probably the greatest exploit is human ignorance. I know of one
organisation which I helped arrange a Linux firewall after thousands
of pounds worth of damage to servers on the LAN from script kiddies.
Following up later, I found the sysadmin had been ordered to remove
the firewall by senior management - because one of them had a tantrum
when they found they could no longer access their work PC directly
from home. The sysadmin tried to explain about VPNs, but the manager
wasn't interested. "Switch it off now - that's an order!"
Cheers
Daniel