Ruby 2.0, 71 characters
--

<!-- language: lang-ruby -->

    f=->s,g{[x=(0..3).count{|n|s[n]==g[n]},g.chars.count{|e|s.sub!e,''}-x]}

This function actually modifies the first parameter, which is obviously a bit dodgy.  Would be easy enough to fix if it's actually against the rules.

I'm sure there's something sneaky you could do with `String#count` but I couldn't think of a nice way to handle duplicates.

Example usage:

    p f['1254', '1342'] #=> [1, 2]
    p f['1234', '1111'] #=> [1, 0]
    p f['5441', '1234'] #=> [0, 2]
    p f['5441', '4531'] #=> [1, 2]
    p f['5441', '4441'] #=> [3, 0]
    p f['5441', '5441'] #=> [4, 0]