You can skip the malloc() calls if you declare your strings as arrays not pointers:
char aOneString[sizeof(username) + sizeof(realm) + sizeof(password) + 3];
char aTwoString[sizeof(method) + sizeof(uri) + 2];
You can also simplify the concatenation code (whether is saves memory I don't know):
strcpy(aOneString, username);
strcat(aOneString, ":");
strcat(aOneString, realm);
strcat(aOneString, ":");
strcat(aOneString, password);
would become:
sprintf(aOneString, "%s:%s:%s",username,realm,password); //where the %s is replaced by the corresponding string