Protecting inbound interfaces (re: Cisco exploit)

Is there a way to globally protect all inbound interfaces on a router via ACL (specifically hundreds of frame/sub-interfaces) without applying the same ACL to each individual interface? Is the "line vty" config only for telnet/ssh, etc. or is it the magic global that I'm looking for? I'd post this on inet-access but this is where the conversation is taking place. Thanks, Rick