Ruby 2.0, 7471 characters
f=->s,g{[x=(0..3).count{|n|s[n]==g[n]},g.chars.count{|e|s[e]&&s[e]=''|e|s.sub!e,''}-x]}
This function actually modifies the first parameter, which is obviously a bit dodgy. Would be easy enough to fix if it's actually against the rules.
I'm sure there's something sneaky you could do with String#count
but I couldn't think of a nice way to handle duplicates.
Example usage:
p f['1342'f['1254', '1254']'1342'] #=> [1, 2]
p f['1111'f['1234', '1234']'1111'] #=> [1, 0]
p f['1234'f['5441', '5441']'1234'] #=> [0, 2]
p f['4531'f['5441', '5441']'4531'] #=> [1, 2]
p f['4441'f['5441', '5441']'4441'] #=> [3, 0]
p f['5441', '5441'] #=> [4, 0]