A method to bypass SSL certificate name vs. host name verification via NUL
('\0') character embedded in X509 certificate's CommonName or subjectAltName
was presented at Black Hat USA 2009:

http://www.blackhat.com/html/bh-usa-09/bh-usa-09-archives.html#Marlinspike

References:
-----------
[1] http://lists.manyfish.co.uk/pipermail/neon/2009-August/001044.html
[2] http://lists.manyfish.co.uk/pipermail/neon/2009-August/001046.html

More information from Joe Orton about vulnerable Neon versions:
---------------------------------------------------------------

All versions of neon versions up to 0.28.5 inclusive are vulnerable to 
this issue, where neon is built with SSL support using OpenSSL.

All versions of neon older than 0.28.6 are affected, where linked 
against OpenSSL. 

Versions of neon <= 0.28.5 linked against any version of GnuTLS 
(including >= 2.8.2) are still vulnerable to at least one type of 
embedded-NUL issue.  

It is necessary to upgrade to neon 0.28.6 to fix the issue completely, 
if built against GnuTLS.

So far as this vulnerability affects neon, it is neither sufficient nor 
necessary to update to GnuTLS 2.8.2.  (i.e. neon 0.28.6 will not be 
vulnerable if linked against older versions of GnuTLS).