What is meant by an "intermediate certificate authority?"
Any CA can be an "intermediate CA". Because "being intermediate" is defined by how the verifier sees it.
When you validate a certificate, you verify the signature which has been generated over that certificate by the CA which emitted the certificate. This signature is verified against the CA public key. If you know the CA public key "inherently" (e.g. it is one of the CA public keys distributed with the operating system), then the CA is a trust anchor, also known as root CA. On the other hand, if you know the CA public key only through validation of a CA certificate (a certificate issued to that CA by another CA), then the CA is deemed "intermediate". One can see the name "intermediate" as describing where the CA is in the chain of trust: the trust anchor is at the beginning, the end-entity is at the end (duh!), and anything in-between is "intermediate".
I can issue certificates for any CA, even without their consent or even awareness, by simply taking the certificate contents and resigning them with a key of my own. This means that every single CA on this planet is, potentially, an intermediate CA.
A CA can delegate signing authority to another "intermediate" CA, and depending on the path validation rules used by the relying party, this may be trusted as much as the original.
This can be a problem, especially since so many CAs are probably in your trusted root store. See e.g. page 20 or so of the transcript in the reference below:
"… world governments are able to legally compel their national SSL Certificate Authorities to issue Intermediate CA certificates which allow agencies of those governments to surreptitiously intercept, decrypt, and monitor secured SSL connections …"
—Steve Gibson, Security Now episode #243 "State Subversion of SSL".
This still requires access to the actual traffic, but there are a variety of ways that a determined adversary can often accomplish that.
Contrast this with the situation in DNSSEC, which has a single root, and in which the keys associated with sub-domains can only vouch for the associated sub-domain.
For a look at some of the complications and possible future resolutions of the problem, see, e.g., ImperialViolet - DNSSEC and TLS to allow for exclusion of certificates issued either mistakenly or maliciously by CAs, and for avoiding MITM for sites even without a CA cert.