Wasn't .NET suposed to stop this sort of thing? [Simon Fell]

Yes, and it does, however the piece of code that is affected with the buffer overrun is an unmanaged component of the ASP.NET ISAPI extension. Still, I'm dissapointed that this wasn't caught by new security practices that were supposed to have been in place already at Microsoft before .NET was released.