Cisco IOS 12.0 through 12.4 when IP-based tunnels and the Cisco Express Forwarding feature are enabled allows remote attackers to cause a denial of service (device reload) via malformed packets aka Bug ID CSCsx70889.