[Bush2000]

So in order to exploit this, you must have total control over my network, since you are replacing the existing LDAP server

Not true. All that I have to do is get your client machine to use my box as the LDAP server. That isn't difficult, particularly if I have access to the network segment on which the machine-to-be-attacked resides.

[ThinkDifferent]

That isn't difficult, particularly if I have access to the network segment on which the machine-to-be-attacked resides.

You *must* have access to the same subnet as the target. You can't attack a random Mac on the Internet with this technique. The main threat seems to be for the Starbucks wireless user.