Why is a MAC needed with CBC?
To see why CBC mode still needs a MAC to guarantee message integrity, first recall how CBC mode decryption works:

$$P_i = D_K(C_i) \oplus C_{i-1}$$

Here, $D_K$ denotes block cipher decryption using the key $K$, and $C_i$ and $P_i$ denote the $i$-th ciphertext and plaintext blocks respectively.

Now, consider what happens if you modify the encrypted message to replace $C_i$ with $C_i' = C_i \oplus X$ for some $i$.  Now, the corresponding plaintext block $P_i'$ will be garbled, since $D_K(C_i')$ will in general bear no predictable resemblance to $D_K(C_i)$.  However, the next plaintext block $P_{i+1}'$ will now become

$$P_{i+1}' = D_K(C_{i+1}) \oplus C_i' = D_K(C_{i+1}) \oplus C_i \oplus X = P_{i+1} \oplus X.$$

Thus, even with CBC mode, you can still flip arbitrary bits in any given plaintext block, provided that you don't mind the previous plaintext block being garbled.  Whether this is actually practical depends on the what the plaintext is supposed to be, but it's generally not safe to assume that it isn't.

Of course, since the garbled block will, in general, be essentially random and unpredictable by the attacker, it might seem plausible that a simple non-cryptographic checksum could detect such modification.  However, it's not entirely implausible for the attacker to be able to predict $D_K(C_i')$, and thus $P_i'$: for example, if the attacker has access to some known ciphertext/plaintext message pairs, this provides them with a bunch of blocks whose image under $D_K$ is known.  If they choose $C_i'$ to be one of such blocks, they'll be able to predict $P_i'$, and if they can also guess the original plaintext block $P_i$, they may be able to spoof many non-cryptographic checksums.

(In particular, if the IV is sent alongside the message &mdash; as is usually done &mdash; flipping bits in the first plaintext block is particularly easily done just by flipping the corresponding bits in the IV.  Thus, for the first block, CBC mode is just as malleable as CTR or OFB.)

The bottom line of all this is that, if you want to protect the integrity of your messages, you need to use an encryption mode that is actually designed to be provably non-malleable.  In addition to the generic combination of a classical block cipher mode and a MAC, there also exist several authenticated encryption modes specifically designed for this purpose.