An Eweek article reviews the 1988 attack of the Morris worm concludes the same problems remain today.
1. Buffer overflows
2. Poor configuration
3. Bad/default passwords