My host said that they have to disable it for security reason.
Yes. Many bad hosts think this. It's a common misconception. They are wrong. For security, they should disable allow_url_include, not allow_url_fopen. This, of course, assumes they are running a modern version of PHP in the first place (5.2 and up). Sadly, many hosts still support PHP 4, and so resort to extremely stupid measures like this in the name of security.
Are there anyways of making this pingback works without changing host.
No.
** They told me that Curl can be used.
Yes, WordPress already supports using curl if allow_url_fopen is disabled. If it's not working, then they don't have curl working.
I would simply switch hosts. If a host, whom I'm paying for, doesn't understand basic security principles, then I don't want to use them.
Could you tell us who the hosting company is so that we can recommend that WordPress users avoid them in the future?