Among other sources, this Wikipedia entry states that triple-DES using three separate keys $(k_1, k_2, k_3)$ is vulnerable to meet-in-the-middle-attacks, while triple-DES using only two keys $(k_1, k_2, k_1)$ is not.
Why is this attack possible if all the keys are different, but not if the first and the third are the same?
The main difference is that with two 56 bit keys the maximal security level is 112 bit, and thus an attack that has a cost of $2^{112}$ operations is no attack, whereas for three 56 bit keys the maximal security level is 168 bits, and an attack that has a cost of $2^{112}$ operations counts as an attack.
This means that two-key 3DES is still a bit weaker than three-key 3DES, but not as much as we'd expect of an ideal 168 bit cipher.
With meet-in-the middle the cipher gets split into two halves, which are attacked separately. The cost of the attack is the sum of the attacks on the two halves, which is dominated by the more expensive half. So meet-in-the-middle is possible if you can split the cipher in a way that the more expensive half is cheaper to attack than guessing the whole key. (Disregarding memory use)
With two keys, one half has (k1,k2) and the other k1. Attacking the first half costs $2^{112}$ operations, attacking the second half costs $2^{56}$ operations. For a total of $~2^{112}$ operations.
With three keys, one half has (k1,k2) and the other k3. Attacking the first half costs $2^{112}$ operations, attacking the second half costs $2^{56}$ operations. For a total of $2^{112} + 2^{56} \approx 2^{112}$ operations.
So meet-in-the-middle gives us an attack with $2^{112}$ operations against either of them, but it's only better than brute-force when using three keys.
