lockdownd in Lockdown in Apple iOS before 6.1.3 does not properly consider file types during the permission-setting step of a backup restoration, which allows local users to change the permissions of arbitrary files via a backup that contains a pathname with a symlink.
Apple Security Advisory 2013-03-19-1 - iOS 6.1.3 is now available and addresses multiple security issues such as execution of unsigned code, permission changes, and more.