For the record if you don't MAC your data then an attacker can basically completely decrypt the entire thing. If you *do* MAC your data then the only person you're vulnerable to is the other end which is typically assumed to be trusted (but bugs etc are possible yes).