TerraMaster Forum

TOS 4.2.28 (X86) Release Notes

Applicable models: F2-220, F2-221, F2-420, F2-421, F2-422, F4-220, F4-221, F4-420, F4-421, F4-422, F5-220, F5-221, F5-225, F5-420, F5-421, F5-422, F8-421, F8-422

This update includes the following bug fixes for the previous version and new features:
1. Added pam authentication mechanism for SSH, Telnet, AFP, and FTP;
2. Fixed the vulnerability of php encryption;
3. Fixed the issue of Windows Backup;
4. Fixed the issue of HDD hibernation;
5. Fixed the issue of SSD cache;
6. Fixed the issue of SMB password setting;
7. Optimized the fan control.

Important Notes
1. This update is only for TOS 4.2.01 or later versions. If your TOS is 4.1.27 or an earlier version, please refer to here.
2. Under normal circumstances, the system update will not affect the data in your hard drives, but for your data safety, it is strongly recommended that you back up your data before the update!
3. If you are running vbox in TOS, please update the vbox before updating 4.2.28, otherwise, your system will fail irreparably!
VirtualBox download link

How to update your TOS?
Online update:
1. Go to TOS > Control Panel > General settings > Software update;
2. Check the option "Online update", click "Apply";
3. Follow the prompt to finish the update;

Issue report
If you encounter issues during use, please report to TerraMaster's official forum “TOS update”.

Will this also be released for the 210 series (ARM)?


The majority of those fixes should be applied to that series as well, especially the PHP exploit that's leaving devices vulnerable to attack/being compromised.

Additionally, if there's a kernel update in this or any updates (past, present & future), can that be indicated in the changelog with full version/point release numbering as it is quite pertinent information.

Please be more transparent with these updates, so further development on your platforms can flourish & exploit resolution can be resolved by the community alongside your internal team, when/where possible.

---

As per this post: viewtopic.php?f=28&t=2887#p15805, Please indicate if previous patches are integrated, as was stated in said post by TMRyan

Hi! Updates for ARM will be released as soon as possible, please wait.

All updated parts of the system are already indicated in the release notes, nothing needs to be hidden. Once again, all TOS updates will include past patches.

TMroy wrote: ↑20 Jan 2022, 17:23 All updated parts of the system are already indicated in the release notes, nothing needs to be hidden.

It's denoted in the simplest of details; if further details can be indicated, this may be preferred by select users.

If having this simplified changelog with an expandable verbose one is possible (such that those that want the minute details, can access them), this could be great for all.

TMroy wrote: ↑20 Jan 2022, 17:23Once again, all TOS updates will include past patches.

Every patch has been an out of band release, so just adding a line indicating that this release has Patch 1.18 + 1.24 (x64) integrated, will avoid inquiries about applying said patch(es).

Fixed the vulnerability of php encryption

Have you actually fixed the underlying issue though, user input being passed to system/shell_exec with no validation?

And what about the F4-210 which also have the issue

Am I blind? Where is the link to the download that's usually present?

I found it in the "Download" section of their website. . . . Perhaps they just forgot to include the link when posting in the forum.

Wow! You have sorted online updates out