One real problem is that lack of authentication between the two sides. Here's one possible problem:
Alice generates an RSA keypair (we assume Alice is using proper random numbers)
Alice sends the public key as plain text to Bob.
Eve intercepts this message, and forwards on a message to Bob with her public key
Bob generates a 3DES session key: BA
Bob sends BA encrypted with [Eve]'s public key, together with a checksum of BA
Eve intercepts this message, and decrypts it with her private key, giving her the value of BA. She then takes BA and the checksum, and encrypts it with Alice's public key, and sends that on to Alice
Alice receives and decrypts BA using its private key.
all following sensitive data is encrypted with BA and integrity is checked via the checksum.
That is, all sensitive data is encrypted by a key that Eve knows. Furthermore, she can modify anything she wants.
In general, you cannot really have secure communication unless you know who you're actually communicating with. In this case, Bob has no reason to believe that the public key he gets is from Alice, and not someone impersonating Alice.
