A spoofing issue exists in the CryptoAPI component when handling X.509 certificates. This issue allows man-in-the-middle attackers to impersonate arbitrary SSL servers via a crafted certificate. The problem arises from the improper handling of a '0' character in a domain name in the subject's Common Name field of an X.509 certificate.