source: http://www.securityfocus.com/bid/8323/info

It has been reported that under some circumstances, a Cisco appliance running IOS may answer malicious malformed UDP echo packets with replies that contain partial contents from the affected router's memory.

http://www.exploit-db.com/sploits/22978.tgz