The students are skeptical that turning off non-executable stacks, turning off canaries and turning off ASLR represents a realistic environment.  If PaX, DEP, W^X, etc., are effective at stopping buffer overflow exploits, is there still value in learning about them?
Absolutely.  ASLR and DEP are defense-in-depth measures.  There are exploits that exist that can bypass each of them (for a real-world example, look at Peter Vreugdenhil's Pwn2Own exploit that he used against IE).

All you need to bypass ASLR for Windows is an information disclosure vulnerability that will let you know the base address of a loaded DLL in the process (that was the first vuln that Vreugdenhil exploited).  From that, you can use a ret-to-libc attack to call any function in that DLL.  

The bottom line: stack (and heap) overflows are absolutely still relevant today.  They're harder to exploit than they used to be but they're still relevant.
