The OSI model which describes networks as a set of rigid layers has never been a good match for TCP/IP networks. It is a remnant of an old terminology war between the world of elegant, abstract, intellectual constructions, and the world of the Internet, aka the network which exists and works.
SSL is built on top of a medium which, in the OSI model, would be "transport" (layer 4): SSL uses a bidirectional channel for untyped bytes; SSL needs that this channel, under non-hostile condition, is reliable (bytes are unaltered and eventually show up at the receiving end in the right order). On the other hand, SSL provides a transport medium (there again, a bidirectional channel for untyped bytes, this times with confidentiality and guaranteed integrity). So, in OSI model terminology, SSL sits between layer 4 and layer 4. Yes, not between two "distinct" layers, but right "in the middle" of a layer.
All of this just shows that the OSI model does not apply to the real world. Why this model is universally taught in all network courses is beyond me.