iPhone Mail in Apple iPhone OS and iPhone OS for iPod touch does not validate X.509 certificates which allows man-in-the-middle attackers to spoof arbitrary SSL e-mail servers via a crafted certificate.