Description
lockdownd in Lockdown in Apple iOS before 6.1.3 does not properly consider file types during the permission-setting step of a backup restoration, which allows local users to change the permissions of arbitrary files via a backup that contains a pathname with a symlink.
References
- APPLE-SA-2013-03-19-1 vendor-advisory
- http://support.apple.com/kb/HT5704