The code has undefined behavior and is invalid.

Anyway, the statement:

printf ("%16u%n", 7350, (int *) &foo[0]);

is basically doing:

*(int *)&foo[0] = 16;

The biggest issue is with the last one:

printf("%128u%n", 7350, (int *) &foo[3]);

it's doing:

*(int *)&foo[3] = 128;

but foo[3] is an unsigned char. Assuming sizeof(int) = 4, ie. int has 4 bytes, then this writes 3 bytes out of bounds to foo + 3. x86 stores stack in reverse order - the memory reserved for canary is put after the memory for foo. The stack memory looks like this:

   <-- foo ---><--- canary ----->
   [0][1][2][3][0][1][2][3][4][5]
            ^^^^^^^^^^^^ 
                 storing (int)128 here in **little endian**

Because x86 is little endian, foo[3] is assigned the value of 128, and canary[0..2] are zeroed (because 128 = 0x00000080).

You can do:

// I want it to print 0xDEAD
// I swap bytes for endianess I get 0xADDE
// I then shift it left by 8 bytes and get 0xADDE00
// 0xADDE00 = 11394560
// The following printf will do foo[3] = 0x00
// but also: canary[0] = 0xDE, canary[1] = 0xAD and canary[2] = 0x00
fprintf("%11394560u%n", 7350, (int *) &foo[3]);
printf("0x%02x%02x\n", canary[0], canary[1]);
// will output 0xDEAD

printf cannot write anywhere without using the %n format specifier. This is the one you're missing. Something like %.987654d%n will write the number 987654 (the number of characters output so far) to an address specified by the second argument, where the first argument is an int. This should be enough to get you started.

It's a lot of questions, here are a few answers:

How can we write something in memory with a format string vulnerability ?

For this, you need to know two specific features used in the printf format string specifications. First, %n is a format specifier that has the following effect (according to the manual page):

%n The number of characters written so far is stored into the integer indicated by the int * (or variant) pointer argument. No argument is converted.

Now, the second format string feature will allow us to select a specific argument from the format string. The main selection operator is $, and the following code means that we select the second argument (here the outcome will be to display 2):

printf("%2$x", 1, 2, 3)

But, in the general case, we can do printf("%<some number>$x") to select an arbitrary argument of the current printf function (format string argument does not count).

If we could pass the string AAAA%10$n to the program and make it appear as a format string, then we could write the value 4 to the address 0x41414141.

So, format string bugs may offer a full access to the memory and you can decide what to write and where in the memory.

I really advise you to read "Exploiting Format String Vulnerabilities" from Scut (2001) to get a whole grasp on these kind of manipulations.

Are they other languages than C/C++ that are vulnerable to these bugs ?

Well, format string bugs are tied up to the printf function family and the way format strings may be passed to the function. It's a whole class of security issue itself. So, you might find ways to exploit similar problems in some other languages. Though, you may not find the exact same features as the format string capabilities in other languages may differ a lot.

I do think about languages such as Perl, Python, and so on, that all offer similar access to format string features.

How can I spot format string vulnerabilities if I have only the binary ?

First, you have to locate the calls to procedure of the printf family. Then, I would say that fuzz-testing (fuzzing) should be a good way to find the vulnerabilities. Especially if you can forge a few entries with seeds such as AAAA%10$n.

If you want a more accurate and exhaustive way to find it, you will probably need to do some binary analysis and taint analysis on every call to a procedure of the printf family.