Here a nice explanation of the vulnerability: https://blog.exodusintel.com/2016/02/10/firewall-hacking/

There is also a Snort signature to detect attempts to exploit this vulnerability.