Is use of pre-shared key for sharing session key in symmetric key cryptography vulnerable to MITM? Consider the following protocol:

Alice                    ------------------------&gt; R1     Bob
Alice        k(R1),R2    &lt;-----------------------         Bob
Alice                     ------------------------&gt; k(R2) Bob
Alice         k(S)       &lt;------------------------        Bob


Where


k is pre-shared key, known only to Alice and Bob;
k(x) is the encryption of x under key k
R1 is a random number generated by Alice;
R2 is a random number generated by Bob;
S is the session key, generated by Bob.


Is this protocol susceptible to MITM? If yes, then how?
An obvious, but not serious weakness, is that numbers R1 and R2 will be sent in plain text. This means that MITM is able to modify R1 or R2 so that Alice or Bob will always fail at authentication, although they have a legal key K.

I have one suggestion how you can improve this protocol. Just because in the last step of the protocol, Bob only sends encrypted S, MITM can wait while previous steps will be completed successfully, and then send some old message K(S_old), where S_old is an old session key, which was compromised. To avoid such danger, add number R2 to Bob’s last response K(S,R2).