lockdownd in Lockdown in Apple iOS before 6.1.3 does not properly consider file types during the permission-setting step of a backup restoration, which allows local users to change the permissions of arbitrary files via a backup that contains a pathname with a symlink.
http://support.apple.com/kb/HT5704
http://lists.apple.com/archives/security-announce/2013/Mar/msg00004.html