How can CBC-MAC be secure when message length is fixed?
What you think of is called an extension attack and it turns out that this is the way to go if you would like to break the general CBC-MAC when the message length is not fixed. 

All that an adversary needs to do is to mount a chosen message attack.
Suppose he asks for the tag on the message $m=m_1||m_2||...||m_l$. The resulting CBC MAC would be $MAC_k(m)=t$. But now the adversary can easily find another message with a valid tag by extending his original message $m$ by  $m_1\oplus t||m_2||...||m_l$. By looking at the CBC-MAC construction its easy to see that the tag on the new message 
$m'=(m||m_1\oplus t||m_2||...||m_l)$ is also $t$, what is in fact an  existential forgery.

This is a reason why the CBC MAC is just secure when the message length is fixed. The detailed security analysis of CBC MAC and some work arounds for the case where the message length is not fixed can be found in this paper:


Mihir Bellare, Joe Kilian, Phillip Rogaway, The Security of the Cipher Block Chaining Message Authentication Code, Journal of Computer and System Sciences, Volume 61, Issue 3, December 2000, Pages 362-399 http://dx.doi.org/10.1006/jcss.1999.1694.