I saw a reference to this paper on an internal mailing list.

From “Comparing Java and .NET Security: Lessons Learned and Missed” http://www.cs.virginia.edu/~nrp3d/papers/computers_and_security-net-java.pdf

 

"Both platforms share many design and implementation properties, but there are key differences between Java and .NET that have an impact on their security. This paper examines how .NET’s design avoids vulnerabilities and limitations discovered in Java and discusses lessons learned (and missed) from experience with Java security."