So the possibilities are only limited to your imagination, especially if you start combining the techniques from section 11. Now the MITM attack isn't required to take advantage of any part of this attack. It would be if the attacker couldn't predict the server's and the user's sequence numbers. The attacker doesn't need to artifically ACK the server's responses. The MITM attack isn't needed to modify a program on the fly.
Any single workstation can implement the attack.
Netware 3.x does not use the public key crypto stuff that Netware 4.x uses, so to transmit a password across the wire during a password change it has to be encrypted with something. The new password is encrypted with the previous password. Novell's data validation scheme involves packet signature and a checksum. The other problem involves the fact that packet signature only uses the first 52 bytes of the data portion, which means any data from byte 89 and on could be altered, a new checksum generated, and the packet would now have a valid signature AND checksum, but altered data. Of course, this assumes an attacker could write code that could do something interesting beyond byte 89 AND generate a checksum AND retransmit the forged packet AND beat the real packet to its destination.