From the spec:
The subject alternative name extension allows identities to be bound to the subject of the certificate. These identities may be included in addition to or in place of the identity in the subject field of the certificate.
This has numerous uses; in particular, consider a hosting / reverse-proxy situation, with multiple sites colocated. These sites do not particularly trust each other, and do not have any kind of affiliation; they are just being hosted by the same server, and thus sharing the same certificate.
Is this as risky as it sounds?
At first glance I would say that being as the sites are not trusted to each other, it might be possible for siteA to spoof siteB, even over SSL, since siteA uses the same private key that siteB does. DNS would still need to be spoofed, but there are several ways to do so (even if they are not trivial).
Am I wrong, IS there some other cryptographic (or other) mitigation that I am not seeing here?