In ad-hoc mode, a group of users who agree on an SSID and a channel can form a network with no AP. The security implications of this scenario are potentially serious because each user can be attacked by any of the other users in the network. At this point, each user is not protected from the other users by external firewalls. Thus, personal firewalls are essential in ad-hoc networking. Actually, they are a good idea in any networking scenario. The prevalence of network worms means that malicious code could be running on any machine, even if you trust the owner. Of course, this applies to AP-based or wired networks, too.
Many default operating system configurations allow ad-hoc networking. For example, Windows XP allows connections to both AP and ad-hoc networks by default, so a user could inadvertently join an ad-hoc network and be open to attack. Unless a user needs it, he should disable ad-hoc networking.