Well, an educated guess would be that an external cookie is something set not by the site you are visiting, but by an element originating elsewhere.
So for instance, if your sig had set a cookie on my computer to save some display preferences (an interactive sig, maybe?

), that would be classified as an external cookie. Not vBulletin.org native.
Course, I may be wrong