After installing the remote client from JON 3.0, the extracted root directory is world readable/writeable/executable (0777). Although the child directories are not world writeable, by the parent directory being left in a world writeable state, it is possible to modify directory and file attributes on the child contents to trick the user into executing malicious scripts or code. A local attacker could use this flaw to compromise a remote JON server, using the credentials stolen from a privileged JON user who is using the remote client CLI from a system the local attacker has access to.