This is one of the first vulnerabilities I've tried to exploit on my own to expand my knowledge of exploits.
This is a good summary of the vulnerability. I have been able to control EIP but I'm not sure how to execute code.
My test machine is Ubuntu 11.10 and has ASLR enabled along with NX for the stack, heap, and libraries. The string I control (as described in the article) is stored on the heap so I cannot place any code in there since its not executable. Other than EIP I also control the EDI register but that's all. This is a 32 bit system so brute force is sufficient to defeat ASLR (plus I don't have any other security mechanisms in place; not very realistic, but a good start).
Just found this PoC. Basically the author gets to the same place where I am and then relies on code on the PHP server to take it a step furthur to be able to read the Apache process memory. He states that code execution is "highly possible" but doesn't go into much detail beyond that.