No, CAs aren't that stupid.... (Score 1)

...mostly.
Verisign (& presumably the rest of their group - Thawte, Geotrust) and Comodo didn't issue it - their systems never allowed null characters in subjects.

Some evidence so far (as this isn't the first time it's come up, just the first to be published like this and as with so much at Blackhat, sensationalised) points to Globalsign as the issuing CA, although I'd be surprised if they hadn't fixed it by now.